Method, Device And System For Processing Notification Bar Message

• US 20150371040A1
• Filed: 01/27/2014
• Published: 12/24/2015
• Est. Priority Date: 02/06/2013
• Status: Active Grant

• Current Assignee: Beijing Qihu Technology Co. Ltd. (360 Security Technology, Inc.)
• Original Assignee: Beijing Qihu Technology Co. Ltd. (360 Security Technology, Inc.), Qizhi Software (Beijing) Company Limited (360 Security Technology, Inc.)
• Inventors: DING, Yi, LI, Yuan
• Granted Patent: US 9,953,161 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

Disclosed are a method, device and system for processing notification bar message, the method comprising: triggering an interception program pre-injected in a notification bar message process; and the interception program, when capturing a notification bar message satisfying a preset rule, intercepting the notification bar message satisfying the preset rule, and sending a prompt message. The disclosure can timely recognize and block a notification bar advertisement.

Claims

1. A method for processing a notification bar message, the method comprising:

triggering an interception program pre-injected into a notification bar message process; and

the interception program, when capturing a notification bar message satisfying a preset rule, intercepting the notification bar message satisfying the preset rule and sending a prompt message.

2. The method according to claim 1, wherein the notification bar message satisfying the preset rule comprises a notification bar message sent by an application with a malicious advertisement plug-in, and a notification bar message containing a malicious advertisement feature, and before the interception program, when capturing a notification bar message satisfying a preset rule, intercepting the notification bar message satisfying the preset rule and sending a prompt message, the method further comprises:

determining whether the notification bar message sent by the application of a mobile terminal is a notification bar message satisfying the preset rule, which comprises;

scanning applications in the mobile terminal to determine whether the application has a malicious advertisement plug-in; and

if the application has a malicious advertisement plug-in, determining that the notification bar message sent by the application with the malicious advertisement plug-in is a notification bar message satisfying the preset rule,

if the application has no malicious advertisement plug-in, the interception program determining whether the sent notification bar message contains a malicious advertisement feature when capturing the notification bar message sent by the application without a malicious advertisement plug-in, and

if the sent notification bar message contains a malicious advertisement feature, determining that the notification bar message is a notification bar message satisfying the preset rule.

3. The method according to claim 2, further comprising:

when the sent notification bar message does not contain malicious advertisement feature, the interception program recording the notification bar message.

4. The method according to claim 1, wherein the prompt message comprises information about whether to allow the notification bar message, and the method further comprises:

receiving a selection instruction via a user interface, and allowing the notification bar message to be sent, or blocking the notification bar message from being sent, according to the selection instruction.

5. The method according to claim 1, wherein before the triggering the interception program pre-injected in the notification bar message process, the method further comprises:

injecting the interception program into the notification bar message process, which comprises;

searching for the memory address of an existing notification bar message processing program in the notification bar message process, and

replacing the memory address of the notification bar message processing program with the memory address of the preset interception program.

6. The method according to claim 5, wherein before the step of injecting the interception program into the notification bar message process, the method further comprises:

obtaining a Root privilege of a mobile terminal system.

7. The method according to claim 4, wherein the prompt message further comprises information about the application sending the notification bar message.

8. The method according to claim 2, wherein the malicious advertisement feature comprises an advertisement plug-in code feature and a preset keyword feature.

9. A device for processing a notification bar message, the device comprising:

one or more non-transitory computer readable medium configured to store computer-executable instruction;

at least one processor to execute a plurality of software modules configured to execute the computer-executable instruction to cause;

triggering an interception program pre-injected in a notification bar message process; and

intercepting a notification bar message satisfying a preset rule and sending a prompt message, when capturing the notification bar message satisfying the preset rule.

10. The device according to claim 9, wherein the notification bar message satisfying the preset rule comprises a notification bar message sent by an application with a malicious advertisement plug-in, and a notification bar message containing a malicious advertisement feature, and the processor executes at least one of the software modules configured to execute the computer-executable instruction to cause:

determining whether the notification bar message sent by the application of a mobile terminal is a notification bar message satisfying the preset rule, before the interception program intercepting the notification bar message satisfying the preset rule and sending the prompt message when capturing the notification bar message satisfying the preset rule, which comprises;

scanning applications in the mobile terminal to determine whether the application has a malicious advertisement plug-in, and if yes, confirming that the notification bar message sent by the application is a notification bar message satisfying the preset rule;

otherwise, determining whether the sent notification bar message contains a malicious advertisement feature when capturing the notification bar message sent by the application without a malicious advertisement plug-in; and

if yes, confirming that the notification bar message sent by the application is a notification bar message satisfying the preset rule.

11. The device according to claim 10, the processor executes at least one of the software modules configured to execute the computer-executable instruction to cause:

recording the notification bar message when the sent notification bar message not containing malicious advertisement feature.

12. The device according to claim 9, wherein the prompt message comprises information about whether to allow the notification bar message, and the processor executes at least one of the software modules configured to execute the computer-executable instruction to cause:

receiving a selection instruction via a user interface, and allowing the notification bar message to be sent, or blocking the notification bar message from being sent, according to the selection instruction.

13. The device according to claim 9, further the processor executes at least one of the software modules configured to execute the computer-executable instruction to cause:

injecting the interception program into the notification bar message process before the interception program pre-injected in the notification bar message process being triggered, which comprises;

searching for the memory address of an existing notification bar message processing program in the notification bar message process, and

replacing the memory address of the notification bar message processing program with the memory address of the preset interception program.

14. The device according to claim 13, the processor executes at least one of the software modules configured to execute the computer-executable instruction to cause:

obtaining a Root privilege of a mobile terminal system before the interception program is injected into the notification bar message process.

15. The device according to claim 12, wherein the prompt message further comprises information about the application sending the notification bar message.

16. The device according to claim 10, wherein the malicious advertisement feature comprises an advertisement plug-in code feature and a preset keyword feature.

17-19. -19. (canceled)

20. A non-transitory computer readable recording medium having instructions stored thereon that, when executed by at least one processor, cause the at least one processor to perform a method for processing a notification bar message, which comprises the steps of:

triggering an interception program pre-injected into a notification bar message process; and

the interception program, when capturing a notification bar message satisfying a preset rule, intercepting the notification bar message satisfying the preset rule and sending a prompt message.