Method, device and system for processing notification bar message

• US 9,953,161 B2
• Filed: 01/27/2014
• Issued: 04/24/2018
• Est. Priority Date: 02/06/2013
• Status: Active Grant

• Current Assignee: Beijing Qihu Technology Co. Ltd. (360 Security Technology, Inc.)
• Original Assignee: Beijing Qihu Technology Co. Ltd. (360 Security Technology, Inc.)
• Inventors: Ding, Yi, Li, Yuan
• Primary Examiner(s): Sholeman, Abu
• Application Number:
  US14/766,095
• Publication Number:
  US 20150371040A1
• Time in Patent Office: 1,548 Days
• Field of Search: 726 22, 726 23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

Disclosed are a method, device and system for processing notification bar message, the method comprising: triggering an interception program pre-injected in a notification bar message process; and the interception program, when capturing a notification bar message satisfying a preset rule, intercepting the notification bar message satisfying the preset rule, and sending a prompt message. The disclosure can timely recognize and block a notification bar advertisement.

Claims

1. A method for processing a notification bar message, the method comprising:

injecting an interception program into a notification bar message process by searching for a memory address of an existing notification bar message processing program in the notification bar message process, and

replacing a memory address of the notification bar message processing program with the memory address of the preset interception program;

triggering the interception program pre-injected into the notification bar message process; and

capturing, by the interception program, a notification bar message satisfying a preset rule, the interception program intercepting the notification bar message satisfying the preset rule, and

sending a prompt message, the notification bar message comprising a system message notification area deployed in an Android cell phone operating system.

2. The method according to claim 1, wherein the notification bar message satisfying the preset rule comprises a notification bar message sent by an application with a malicious advertisement plug-in, and a notification bar message containing a malicious advertisement feature, and before the interception program intercepts the notification bar message satisfying the preset rule and sends the prompt message, the method further comprises:

determining whether the notification bar message sent by the application of a mobile terminal is a notification bar message satisfying the preset rule, which comprises;

scanning applications in the mobile terminal to determine whether the application has a malicious advertisement plug-in; and

if the application has a malicious advertisement plug-in, determining that the notification bar message sent by the application with the malicious advertisement plug-in is a notification bar message satisfying the preset rule,

if the application has no malicious advertisement plug-in, the interception program determining whether the sent notification bar message contains a malicious advertisement feature when capturing the notification bar message sent by the application without a malicious advertisement plug-in, and

if the sent notification bar message contains a malicious advertisement feature, determining that the notification bar message is a notification bar message satisfying the preset rule.

3. The method according to claim 2, further comprising:

when the sent notification bar message does not contain the malicious advertisement feature, the interception program recording the notification bar message.

4. The method according to claim 1, wherein the prompt message comprises information about whether to allow the notification bar message, and the method further comprises:

receiving a selection instruction via a user interface; and

allowing the notification bar message to be sent, or blocking the notification bar message from being sent, according to the selection instruction.

5. The method according to claim 1, wherein before injecting the interception program into the notification bar message process, the method further comprises:

obtaining a Root privilege of a mobile terminal system.

6. The method according to claim 4, wherein the prompt message further comprises information about an application sending the notification bar message.

7. The method according to claim 2, wherein the malicious advertisement feature comprises an advertisement plug-in code feature and a preset keyword feature.

8. A device for processing a notification bar message, the device comprising:

one or more non-transitory computer readable media configured to store computer-executable instructions;

at least one processor to execute a plurality of software modules configured to execute the computer-executable instructions to cause;

injecting an interception program into a notification bar message process by searching for a memory address of an existing notification bar message processing program in the notification bar message process, and

replacing a memory address of the notification bar message processing program with the memory address of the preset interception program;

triggering the interception program pre-injected in the notification bar message process; and

capturing a notification bar message satisfying a preset rule, intercepting the notification bar message satisfying the preset rule, and

sending a prompt message, the notification bar message comprising a system message notification area deployed in an Android cell phone operating system.

9. The device according to claim 8, wherein the notification bar message satisfying the preset rule comprises a notification bar message sent by an application with a malicious advertisement plug-in, and a notification bar message containing a malicious advertisement feature, and the processor executes at least one of the software modules configured to execute the computer-executable instruction to cause:

before the interception program intercepts the notification bar message satisfying the preset rule and sends the prompt message, determining whether the notification bar message sent by the application of a mobile terminal is a notification bar message satisfying the preset rule, which comprises;

scanning applications in the mobile terminal to determine whether the application has a malicious advertisement plug-in, and

if yes, confirming that the notification bar message sent by the application is a notification bar message satisfying the preset rule;

otherwise, determining whether the sent notification bar message contains a malicious advertisement feature when capturing the notification bar message sent by the application without a malicious advertisement plug-in; and

if yes, confirming that the notification bar message sent by the application is a notification bar message satisfying the preset rule.

10. The device according to claim 9, the processor executes at least one of the software modules configured to execute the computer-executable instruction to cause:

recording the notification bar message when the sent notification bar message does not contain the malicious advertisement feature.

11. The device according to claim 8, wherein the prompt message comprises information about whether to allow the notification bar message, and the processor executes at least one of the software modules configured to execute the computer-executable instruction to cause:

receiving a selection instruction via a user interface; and

allowing the notification bar message to be sent, or blocking the notification bar message from being sent, according to the selection instruction.

12. The device according to claim 8, wherein the processor executes at least one of the software modules configured to execute the computer-executable instruction to cause:

obtaining a Root privilege of a mobile terminal system before the interception program is injected into the notification bar message process.

13. The device according to claim 11, wherein the prompt message further comprises information about an application sending the notification bar message.

14. The device according to claim 9, wherein the malicious advertisement feature comprises an advertisement plug-in code feature and a preset keyword feature.

15. A non-transitory computer readable recording medium having instructions stored thereon that, when executed by at least one processor, cause the at least one processor to perform a method for processing a notification bar message, which comprises:

injecting an interception program into a notification bar message process by searching for a memory address of an existing notification bar message processing program in the notification bar message process, and

replacing a memory address of the notification bar message processing program with the memory address of the preset interception program;

triggering the interception program pre-injected into the notification bar message process; and

capturing, by the interception program, a notification bar message satisfying a preset rule, the interception program intercepting the notification bar message satisfying the preset rule, and

sending a prompt message, the notification bar message comprising a system message notification area deployed in an Android cell phone operating system.