Method and system for monitoring application program of mobile device

• US 9,313,216 B2
• Filed: 11/09/2012
• Issued: 04/12/2016
• Est. Priority Date: 11/15/2011
• Status: Expired due to Fees

• Current Assignee: Beijing Netqin Technology Company Limited
• Original Assignee: Beijing Netqin Technology Company Limited
• Inventors: Zeng, Yang, Shi, Huaguo, Yang, Wei, Chen, Yaowei, Lin, Yu, Zou, Shihong
• Primary Examiner(s): Sholeman, Abu
• Assistant Examiner(s): Lwin, Maung
• Application Number:
  US14/129,762
• Publication Number:
  US 20140242945A1
• Time in Patent Office: 1,250 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

The present disclosure provides a method and system for monitoring an application. The method includes creating a simulated system service; establishing a connection with a function in a device driver that manages an Input/Output (I/O) channel of the device; intercepting data transmitted from the application to the function in the device driver that manages the I/O channel of the device; replacing, based on the intercepted data, a system service requested by the application with a corresponding simulated system service; and recording a request received by the simulated system service and forwarding the request to an analysis module for analysis.

Claims

1. A method for monitoring an application in a mobile device, comprising the following steps of:

a) creating a simulated system service;

b) establishing a connection with a function in a device driver that manages an Input/Output (I/O) channel of the mobile device;

c) intercepting data transmitted from the application to the function in the device driver that manages the I/O channel of the mobile device;

d) replacing, based on the intercepted data, a system service requested by the application with a corresponding simulated system service and transmitting the data to the simulated system service;

e) recording a request by the application received by the simulated system service and forwarding the request to an analysis module for analysis;

wherein step e) further includes creating a proxy service between a service at a system layer and a service at an application layer,

registering an application service in the proxy service, and

converting the request recorded by the simulated system service at the system layer into a request visible at the application layer;

f) creating a user rule database and storing a name of the application, a type of the operation and a selection by the user in the user rule database; and

g) searching, by the analysis module after receiving the request visible at the application layer, the user rule database for a user rule associated with the application and automatically authorizing or prohibiting an operation associated with the request based on the user rule.

2. The method of claim 1, wherein the step c) comprises:

reading the data from a data reception buffer in a system driving device for communication between system processes.

3. The method of claim 2, wherein the system driving device for communication between system processes is a binder kernel driving device in an Android operating system.

4. The method of claim 1 further comprising:

presenting, by the analysis module, the request visible at the application layer to a user and prompting the user to select to authorize or prohibit an operation associated with the request.

5. The method of claim 4, further comprising:

converting, when the user selects to authorize the operation, the request visible at the application layer along with an authorization instruction into a request for the simulated system service at the system layer, to cause the corresponding system service to execute the operation associated with the request;

or

terminating the operation when the user selects to prohibit the operation.

6. A system for monitoring an application in a mobile device, comprising a client installed in the mobile device, the client comprising a simulated system service module, a function hook module, a proxy service module, an analysis module and a user rule database, wherein:

the simulated system service module corresponds to a system service module in an operating system of the mobile device;

the function hook module, communicative with a kernel of the operating system of the mobile device, establishes a connection with a function in a device driver that manages an Input/Output (I/O) channel of the mobile device, intercepts data transmitted from the application to the function in the device driver that manages the I/O channel of the mobile device, and forwards, based on the intercepted data, a system service requested by the application to the corresponding simulated system service module;

the proxy service module, communicative with the simulated system service module, communicates between a service at a system layer and a service at an application layer and converts the request recorded by the simulated system service at the system layer into a request visible at the application layer; and

the analysis module, communicative with the proxy service module and the user rule database, reads an operation requested by the application, and authorizes or prohibits the operation requested by the application based on a rule stored in the user rule database or based on a selection by a user in response to a prompt presented on a screen of the mobile device.

7. The system of claim 6, wherein, when the analysis module authorizes the operation requested by the application, the proxy service module converts the request visible at the application layer along with an authorization or prohibition instruction into a request for the simulated system service at the system layer, and the simulated system service invokes the corresponding system service to execute the operation associated with the request;

or

when the analysis module prohibits the operation requested by the application, the operation is terminated and the request is not forwarded to the corresponding system service for processing, thereby blocking the request.