CN108810018A - A mobile application detection cloud platform - Google Patents

Abstract

The invention discloses a mobile application detection cloud platform, which comprises a detection cloud platform and a mobile security application front end, wherein the mobile security application front end is installed on an intelligent terminal of a user or an enterprise, the detection cloud platform is deployed on a distributed computer cluster, the mobile security application front end is connected with the detection cloud platform through a network to perform data interaction, and the mobile security application front end is used for monitoring the mobile application of the intelligent terminal, collecting mobile application data information and sending the mobile application data information to the detection cloud platform to perform detection, pushing security threat information to the user, and positioning and controlling a threat source; the detection cloud platform is used for monitoring the safety condition of the intelligent terminal, auditing the mobile application source codes, evaluating the safety condition of the mobile application and testing the function of the mobile application, and can detect and monitor the application data information acquired by the front end at the cloud end, push related threat information to a user, position and control a threat source and ensure the information data safety of the user.

Description

A mobile application detection cloud platform

technical field

The invention relates to the field of information security, in particular to a mobile application detection cloud platform.

Background technique

With the rapid development of the software industry, the scale and complexity of mobile applications are increasing day by day. While bringing convenience to users, many criminals are also eyeing the rapid development of mobile applications. By implanting malicious codes in mobile applications To seek personal gain for oneself, and at the same time pose a great threat to the security of users' private information. For most smart terminal users today, there are often more than dozens of mobile applications installed in the smart terminals used. For these mobile Application security monitoring has become a difficult problem for users, especially for mobile applications used in conjunction with enterprise management. Due to inadequate security monitoring measures and malicious code damage, it will bring huge harm to individuals and even the entire enterprise. Therefore, it is particularly important to conduct research on mobile application security detection technology and establish a mobile application detection cloud platform to fully protect information security.

Contents of the invention

In view of this, the object of the present invention is to provide a mobile application detection cloud platform to at least solve the above problems.

A mobile application detection cloud platform, including a detection cloud platform and a mobile security application front-end, the mobile security application front-end is installed on the smart terminal of a user or an enterprise, the detection cloud platform is deployed on a distributed computer cluster, and the mobile security application The front end establishes a connection with the detection cloud platform through the network for data interaction,

The mobile security application front end is used to monitor mobile applications of smart terminals, collect mobile application data information and send it to the detection cloud platform for detection, push security threat information to users, and locate and control threat sources;

The detection cloud platform is used for monitoring the security situation of the smart terminal, auditing the source code of the mobile application, evaluating the security situation of the mobile application, and testing the function of the mobile application.

Further, the mobile security application front-end includes a front-end data transceiver module, a mobile application monitoring module, a terminal monitoring module, an information push module, and a threat processing module, and the mobile application monitoring module, the terminal monitoring module, and the information push module are respectively connected to the The front-end data transceiver module is connected, the threat processing module is connected to the mobile application monitoring module, and the front-end data transceiver module is connected to the detection cloud platform through a network.

Further, the detection cloud platform includes a cloud data transceiver module, a terminal security monitoring module, a threat early warning module, a function test module, a security evaluation module, a source code audit module, and a malicious code sample library, and the cloud data transceiver module is respectively connected to the The threat early warning module, the source code audit module, and the function test module are connected, and the source code audit module and the function test module are respectively connected to the security evaluation module, the security evaluation module is connected to the terminal security monitoring module, and the malicious code The sample library is connected with the source code audit module.

Further, a load balancing module is provided between the cloud data sending and receiving module, the threat warning module, the source code audit module, and the function testing module.

Further, the malicious code sample library includes a malicious code feature library and a malicious behavior library, the malicious code feature library is used to store the feature code as a malicious code identifier; the malicious behavior library is used to store the Malicious behavior characteristic information.

Further, the feature code includes a single feature code and a composite feature code.

Further, the malicious behavior characteristics include intrusion infection, malicious self-starting, image hijacking, hiding, remote control terminal, stealing private information, destroying user data, and modifying system configuration.

Further, the detection cloud platform is deployed on a distributed computer cluster based on the MapReduce distributed computing framework.

Compared with prior art, the beneficial effect of the present invention is:

The mobile application detection cloud platform provided by the present invention collects the mobile application data information installed on the smart terminal through the mobile security application front end and sends it to the detection cloud platform for detection. At the same time, the detection cloud platform has terminal security monitoring, source code audit, functions Testing, security evaluation and other functions can push relevant threat information to front-end users of mobile security applications, and at the same time locate and control threat sources to fully guarantee the security of mobile applications and user information data. Based on the MapReduce distributed computing framework, the platform can realize large-scale Parallel processing of scale datasets.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings that need to be used in the description of the embodiments. Obviously, the drawings in the following description are only preferred embodiments of the present invention. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

FIG. 1 is a schematic diagram of the overall structure of a mobile application detection cloud platform according to an embodiment of the present invention.

Fig. 2 is a schematic diagram of the operation flow of the mobile application monitoring module according to the embodiment of the present invention.

In the figure, 1 is the detection cloud platform, 2 is the mobile security application front end, 11 is the cloud data sending and receiving module, 12 is the terminal security monitoring module, 13 is the threat early warning module, 14 is the function testing module, 15 is the security evaluation module, 16 is the Source code audit module, 17 is a malicious code sample library, 21 is a front-end data sending and receiving module, 22 is a mobile application monitoring module, 23 is a terminal monitoring module, 24 is an information push module, and 25 is a threat processing module.

Detailed ways

The principles and features of the present invention will be described below in conjunction with the accompanying drawings, and the enumerated embodiments are only used to explain the present invention, and are not intended to limit the scope of the present invention.

With reference to Fig. 1, the present invention provides a kind of mobile application detection cloud platform, described mobile application detection cloud platform is mainly made up of two parts: the mobile security application front-end 2 installed on the intelligent terminal of user or enterprise, and deployment on distributed computer Detection cloud platform 1 on the cluster. The mobile security application front end 2 is used to monitor mobile applications of smart terminals, collect mobile application data information and send them to the detection cloud platform 1 for detection, push security threat information to users, and locate and control threat sources; the detection cloud platform 1 It is used to monitor the security of smart terminals, audit the source code of mobile applications, evaluate the security of mobile applications, and test the functions of mobile applications.

The mobile security application front-end 2 includes a front-end data transceiving module 21 , a mobile application monitoring module 22 , a terminal monitoring module 23 , an information push module 24 and a threat processing module 25 . The mobile application monitoring module 22, the terminal monitoring module 23, and the information push module 24 are respectively connected to the front-end data transceiving module 21, the threat processing module 25 is connected to the mobile application monitoring module 22, and the front-end data The transceiver module 21 is connected with the detection cloud platform 2 through a network.

Specifically, the front-end data transceiving module 21 is used for receiving, sending, and processing the information exchange data flow between the mobile security application front-end 2 and the detection cloud platform 1 .

The mobile application monitoring module 22 is used to monitor the security of the mobile applications installed on the smart terminal. Referring to FIG. 2 , the mobile application monitoring module 22 monitors the mobile application on the smart terminal including detection of the source code of the mobile application and monitoring of suspicious behavior of the mobile application. Mobile application monitoring module 22 will search all mobile applications on the smart terminal, and traverse and analyze all data files of each mobile application. The file is sent to the detection cloud platform 2 for malicious code detection. On the other hand, during the operation of the mobile application, the mobile application monitoring module 22 will record the operation behavior of the mobile application, and send the operation behavior record to the detection cloud platform 2 through the front-end data transceiver module 21 for malicious behavior matching. If the behavior matches successfully, it means that there may be malicious code in the mobile application. The mobile application monitoring module 22 will analyze the mobile application and send the application data file to the detection cloud platform 2 for malicious code detection to determine the specific location of the malicious code. The mobile application monitoring module 22 sends the source code files and operation behavior records of the monitored mobile application to the detection cloud platform 2 for detection to determine whether the mobile application contains malicious code, so as to avoid further damage caused by malicious code and ensure the data security of the smart terminal .

The terminal monitoring module 23 is used to monitor the system running status of the smart terminal. When the mobile application monitoring module 22 monitors malicious codes, the terminal monitoring module 23 can send the real-time running status of the smart terminal system to the detection cloud platform 2, so that the background Personnel collect system operating status information, summarize the operating characteristics of malicious code, and provide a basis for judging malicious code based on system operating status. The system running status includes the current value of each register, current process information, the image of the relevant memory, and the network data flow in the recent period.

The information push module 24 is used to display the security threat intelligence information sent to the front-end data transceiver module 21 by the detection cloud platform 1 to the user through a visual interface, so as to help the user take preventive measures according to the security threat intelligence and corresponding rectification suggestions to improve Security of smart terminals.

The threat processing module 25 is used for locating malicious codes and controlling and processing them. After the mobile application monitoring module 22 monitors the malicious code, the mobile application monitoring module 22 sends the specific file path, location information and related characteristics of the malicious code to the threat processing module 25, and the threat processing module 25 displays the malicious code to the user through a visual interface. At the same time, the user can perform operations such as deleting malicious code data and uninstalling mobile applications containing malicious code through the threat processing module 25, so as to eliminate the security threat of the smart terminal.

The detection cloud platform 1 includes a cloud data transceiving module 11, a terminal security monitoring module 12, a threat early warning module 13, a functional testing module 14, a security evaluation module 15, a source code audit module 16 and a malicious code sample library 17. Module 11 is connected with described threat early warning module 13, source code audit module 16, function test module 14 respectively, and described source code audit module 16, function test module 14 are connected with described safety evaluation module 15 respectively, safety evaluation module 15 and The terminal security monitoring module 12 is connected, and the malicious code sample library 17 is connected with the source code auditing module 16 .

Specifically, the cloud data transceiving module 11 is used for receiving, sending, processing and detecting the information interaction data flow between the cloud platform 1 and the mobile security application front end 2 .

The threat early warning module 13 is used to collect network threat information and push relevant threat information to background personnel or smart terminal users. The threat information includes network threat information and malicious code threat information recorded in the detection cloud platform 1 .

The functional testing module 14 is used for functional testing of mobile applications to detect whether their functions are normal. Backstage personnel will write the mobile application test case input function test module 14 and specify the mobile application to be tested, and the function test module 14 will automatically test the specified mobile application according to the test case, and record the output result of the mobile application, and output The result is sent to the safety evaluation module 15 .

The source code audit module 16 is used to audit the source code of the mobile application to detect whether malicious code is contained therein. The source code auditing module 16 is connected with the malicious code sample library 17, and the malicious code sample library 17 is used for storing malicious code feature data as a basis for judging malicious code. The source code audit module 16 receives the analyzed mobile application data file sent by the mobile application monitoring module 22 through the cloud data transceiver module 11, audits the content of the file and matches it with the malicious code feature data. If the match is successful, it means that the mobile application The application contains malicious code, and the source code audit module 16 records the specific location of the malicious code, and calls the characteristics of the corresponding malicious code in the malicious code sample library 17 and sends them to the security evaluation module 15 together; if no matching is successful until the audit is completed, it means that the No malicious code is contained in the mobile application, and the source code audit module 16 outputs the result that no malicious code is found to the security evaluation module 15 .

The malicious code sample library 17 includes a malicious code feature library and a malicious behavior library. The malicious code feature library is used to store a feature code as a malicious code identifier, the feature code is a character string extracted from a malicious code sample, and is used as a basis for judging the malicious code, and the character string includes a single feature code and Composite feature code, a single feature code is a continuous character string extracted from malicious code samples, which has the advantages of small size, easy maintenance, and strong pertinence, but it is prone to false detection and killing; the composite feature code is composed of malicious code samples Several discontinuous character strings extracted from , as feature codes, can effectively prevent accidental detection and killing. The malicious behavior library is used to store malicious behavior characteristic information as a basis for judging malicious codes, and the malicious behaviors include intrusion infection, malicious self-starting, image hijacking, hiding, remote control terminal, stealing private information, destroying user data, modifying system configuration etc.

The security evaluation module 15 is used to evaluate the security performance of the mobile application and the security level of the smart terminal according to the test results of the function test module 14 and the audit results of the source code audit module 16, and the specific evaluation criteria are determined by the developer according to the actual situation. Formulated, the evaluation results will be sent to the front end of the mobile security application through the cloud data transceiver module 11 through the network for users to view. At the same time, the safety evaluation module 15 will send the evaluation data to the terminal safety monitoring module 12 .

The terminal security monitoring module 12 is used to monitor the security level and mobile application information of each intelligent terminal, and the background personnel can know the security information of all intelligent terminals through the terminal security monitoring module 12, and provide information for the staff to take corresponding measures to improve information security. in accordance with.

Specifically, the detection cloud platform 1 is deployed on a distributed computer cluster based on the MapReduce distributed computing framework. MapReduce is a framework for parallel processing of large-scale data sets. The detection cloud platform 1 may face data processing requests from multiple mobile security application front ends 2 at the same time, which is a great challenge for the parallel computing capability of the detection cloud platform 1. , by adopting the MapReduce distributed computing framework, the detection cloud platform 1 can be deployed on a distributed computer cluster composed of common commercial servers, automatically complete the parallel processing of computing tasks, automatically divide computing data and computing tasks, and run Automatically assign and execute tasks and collect results, greatly reducing the burden on development and maintenance personnel, and at the same time improving the parallel computing capability of the detection cloud platform 1.

A load balancing module is provided between the cloud data transceiving module 11 and the threat warning module 13 , source code auditing module 16 and function testing module 14 . The load balancing module is used to reasonably arrange computing tasks according to the data processing requests received by the cloud data transceiver module 11 and the idleness of the computing nodes of the distributed computer cluster, so as to further strengthen the data processing capability of the detection cloud platform 1 and improve the flexibility of business processing.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (8)

1. A mobile application detection cloud platform, characterized in that the platform includes a detection cloud platform and a mobile security application front end, the mobile security application front end is installed on the smart terminal of a user or an enterprise, and the detection cloud platform is deployed on On the distributed computer cluster, the front end of the mobile security application establishes a connection with the detection cloud platform through the network for data interaction, The mobile security application front end is used to monitor mobile applications of smart terminals, collect mobile application data information and send it to the detection cloud platform for detection, push security threat information to users, and locate and control threat sources; The detection cloud platform is used for monitoring the security situation of the smart terminal, auditing the source code of the mobile application, evaluating the security situation of the mobile application, and testing the function of the mobile application. 2. A kind of mobile application detection cloud platform according to claim 1, characterized in that, the mobile security application front-end comprises a front-end data transceiver module, a mobile application monitoring module, a terminal monitoring module, an information push module and a threat processing module, The mobile application monitoring module, the terminal monitoring module, and the information push module are respectively connected to the front-end data transceiver module, the threat processing module is connected to the mobile application monitoring module, and the front-end data transceiver module is connected to the front-end data transceiver module through the network. The above detection cloud platform is connected. 3. A mobile application detection cloud platform according to claim 1, wherein the detection cloud platform includes a cloud data transceiver module, a terminal security monitoring module, a threat early warning module, a functional testing module, a security evaluation module, a source code An audit module and a malicious code sample library, the cloud data sending and receiving module are respectively connected with the threat early warning module, source code audit module, and function test module, and the source code audit module and function test module are respectively connected with the security evaluation module , the security assessment module is connected to the terminal security monitoring module, and the malicious code sample library is connected to the source code audit module. 4. A mobile application detection cloud platform according to claim 3, wherein a load balancing module is provided between the cloud data sending and receiving module, the threat warning module, the source code audit module, and the function testing module. 5. A kind of mobile application detecting cloud platform according to claim 3, it is characterized in that, described malicious code sample library comprises malicious code feature library and malicious behavior library, and described malicious code feature library is used for storing as malicious code identification feature code; the malicious behavior library is used to store malicious behavior feature information as a basis for judging malicious codes. 6 . A mobile application detection cloud platform according to claim 5 , wherein the feature codes include single feature codes and composite feature codes. 7 . 7. A mobile application detection cloud platform according to claim 5, wherein the malicious behavior features include intrusion infection, malicious self-starting, image hijacking, hiding, remote control terminal, stealing private information, destroying user data , Modify the system configuration. 8. A mobile application detection cloud platform according to claim 1, wherein the detection cloud platform is deployed on a distributed computer cluster based on the MapReduce distributed computing framework.