WO2023236884A1

WO2023236884A1 - Fraudulent behavior detection method and apparatus, electronic device, and readable storage medium

Info

Publication number: WO2023236884A1
Application number: PCT/CN2023/098223
Authority: WO
Inventors: 翟东岩; 史领航; 姚平; 胡志远
Original assignee: 维沃移动通信有限公司
Priority date: 2022-06-10
Filing date: 2023-06-05
Publication date: 2023-12-14
Also published as: CN115037482A

Abstract

The present application relates to the technical field of data processing, and discloses a fraudulent behavior detection method and apparatus, an electronic device, and a readable storage medium. The method comprises: when a rich execution environment (REE) side of a terminal receives a detection request sent by a target application, obtaining feature information associated with the target application, and sending the feature information to a trusted execution environment (TEE) side of the terminal, the detection request being used for requesting to perform fraudulent behavior detection; and when authorization verification of the target application by the TEE side of the terminal succeeds, comparing the feature information with fraud feature data in a fraud feature dataset to determine a fraudulent behavior detection result.

Description

Fraud detection methods, devices, electronic equipment and readable storage media

Cross-references to related applications

This application claims priority to Chinese Patent Application No. 202210656948.7 filed in China on June 10, 2022, the entire content of which is incorporated herein by reference.

Technical field

This application belongs to the field of data processing technology, and specifically relates to a fraud detection method, device, electronic equipment and readable storage medium.

Background technique

With the development of payment technology, mobile online payments are becoming more and more popular, and fraudulent behaviors are becoming more and more frequent. For example, fraud teams publish malicious/fake connections through communication, social networking and other platforms, or publish malicious applications. Users are induced to make fund payments, and the fraud team transfers the funds. This kind of payment fraud causes property losses to people.

In order to combat fraud, the identification and detection of fraud is becoming more and more important. Currently, commonly used fraud detection methods are mainly implemented at the application level. For example, applications use blacklists to detect fraud. However, applications are vulnerable to attacks or modifications, which can easily lead to the detection logic being easily bypassed and the detection accuracy being low.

Contents of the invention

The purpose of the embodiments of this application is to provide a fraud detection method, device, electronic device and readable storage medium, which can improve the accuracy of fraud detection.

In the first aspect, embodiments of the present application provide a method for detecting fraud, which method includes:

When the terminal receives the detection request sent by the target application on the rich execution environment REE side, it obtains the characteristic information associated with the target application and sends the characteristic information to the trusted execution environment TEE side of the terminal. The above detection request is used to request fraud detection;

If the terminal successfully performs authorization verification on the target application on the TEE side, the terminal compares the characteristic information with the fraud characteristic data in the fraud characteristic data set to determine the fraud detection result.

In the second aspect, embodiments of the present application provide a fraud detection device, including:

An acquisition module configured to acquire, on the Rich Execution Environment REE side, the characteristic information associated with the target application upon receiving a detection request sent by the target application;

The first sending module is used to send the characteristic information to the trusted execution environment TEE side of the terminal, and the detection request is used to request fraud detection;

The first determination module is used to compare the characteristic information with the fraud characteristic data in the fraud characteristic data set to determine the fraud detection result when the terminal successfully performs authorization verification on the target application on the TEE side. .

In a third aspect, embodiments of the present application provide an electronic device. The electronic device includes a processor and a memory. The memory stores programs or instructions that can be run on the processor. The programs or instructions are processed by the processor. When the processor is executed, the steps of the method described in the first aspect are implemented.

In a fourth aspect, embodiments of the present application provide a readable storage medium. Programs or instructions are stored on the readable storage medium. When the programs or instructions are executed by a processor, the steps of the method described in the first aspect are implemented. .

In a fifth aspect, embodiments of the present application provide a chip. The chip includes a processor and a communication interface. The communication interface is coupled to the processor. The communication interface is used to transmit image data. The processor is used to transmit image data. Run a program or instruction to implement the method described in the first aspect.

In a sixth aspect, embodiments of the present application provide a computer program product, the program product is stored in a storage medium, and the program product is executed by at least one processor to implement the method as described in the first aspect.

In this embodiment, the TEE side can provide a safer environment and can reduce interference with fraud detection. The TEE side of the terminal performs comparison to achieve fraud detection and obtains fraud detection results, which can improve the accuracy of fraud. Moreover, on the TEE side, when the authorization verification of the target application is successful, the feature information associated with the target application and the number of fraud features in the fraud feature data set are Compare the data to achieve fraud detection and obtain fraud detection results to improve the accuracy of fraud detection.

Description of the drawings

Figure 1 is one of the flow charts of the fraud detection method provided by the embodiment of the present application;

Figure 2 is a structural diagram of a fraud detection system that implements a fraud detection method provided by an embodiment of the present application;

Figure 3 is a schematic diagram of the fraud detection method provided by the embodiment of the present application;

Figure 4 is a schematic module diagram of a fraud detection device provided by an embodiment of the present application;

Figure 5 is a schematic structural diagram of an electronic device provided by an embodiment of the present application;

FIG. 6 is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art fall within the scope of protection of this application.

The terms "first", "second", etc. in the description and claims of this application are used to distinguish similar objects and are not used to describe a specific order or sequence. It is to be understood that the figures so used are interchangeable under appropriate circumstances so that the embodiments of the present application can be practiced in orders other than those illustrated or described herein, and that "first," "second," etc. are distinguished Objects are usually of one type, and the number of objects is not limited. For example, the first object can be one or multiple. In addition, "and/or" in the description and claims indicates at least one of the connected objects, and the character "/" generally indicates that the related objects are in an "or" relationship.

The fraud detection method provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings through specific embodiments and application scenarios.

As shown in Figure 1, this application provides an embodiment of a fraud detection method, which can be Terminal execution, this method includes:

Step 101: When the terminal receives the detection request sent by the target application on the rich execution environment REE side, it obtains the characteristic information associated with the target application and sends the characteristic information to the trusted execution environment TEE side of the terminal;

Among them, the detection request is used to request fraud detection;

Step 102: If the terminal successfully authenticates the target application on the TEE side, compares the characteristic information with the fraud characteristic data in the fraud characteristic data set to determine the fraud detection result.

It can be understood that the terminal can include a rich execution environment (Rich Execution Environment, REE) side and a trusted execution environment (TrustedExecution Environment, TEE) side. The TEE provides a secure operating environment for the terminal, and is often used for digital rights management, for example. , mobile payment and data protection, etc., REE provides a common environment for terminals, such as running common operating systems and applications.

Target applications may include but are not limited to financial applications. It should be noted that financial applications may include applications with payment functions, etc., for example, they may be payment applications. When the target application is called or triggered, the fraud detection process in this embodiment can be triggered. For example, the target application is called to make a payment. Specifically, the payment function of the target application can be called, which can trigger the fraud detection. During the detection process, first, the target application can send a detection request to the REE side of the terminal. It can be understood that the detection request can be sent to the REE side when the payment function is triggered by the target application to trigger fraud detection.

When the REE side of the terminal receives the detection request, it can obtain the characteristic information associated with the target application and send it to the TEE side of the terminal. The TEE side of the terminal can perform authorization verification on the target application. When the authorization verification is passed, the TEE side of the terminal can compare the above feature information with the fraud feature data in the fraud feature data set to determine the fraud detection results and implement fraud detection. That is, the REE side receives the detection request and obtains the feature information associated with the target application, the TEE side receives the feature information associated with the target application sent by the REE side, and the TEE side compares the feature information associated with the target application with the fraud feature data set Compare fraud characteristic data to detect fraud The REE side and TEE side of the terminal work together to detect fraud. In addition, it should be noted that the fraud characteristic data set on the TEE side can be obtained from the cloud in advance and stored on the TEE side.

In this embodiment, the TEE side can provide a safer environment, thereby reducing interference to fraud detection. The TEE side of the terminal performs comparison to implement fraud detection, and obtains fraud detection results, which can improve the accuracy of fraud. Moreover, when the authorization verification of the target application is successful, the TEE side realizes fraud detection by comparing the characteristic information associated with the target application and the fraud characteristic data in the fraud characteristic data set, and obtains the fraud detection results to improve fraud. Accuracy of behavior detection. At the same time, the REE side of the terminal receives the detection request and obtains the feature information associated with the target application. The TEE side of the terminal compares the feature information with the fraud feature data in the fraud feature data set to obtain the fraud detection results. The process of fraud detection is shared among different execution environments, thereby reducing the execution pressure on the execution environment of one side caused by the terminal performing the entire detection process in that side of the execution environment.

In one embodiment, the characteristic information includes at least one of the following:

Application link information. Application link information is used to represent the calling sequence information for calling multiple applications including the target application;

The package name information of the application in the application link information;

The signature information of the application in the application link information;

Behavioral characteristics of the application in the application link information.

It can be understood that the target application is called according to the application calling order in the application link information, that is, the target application is the last application to be called and run among multiple applications, and among the multiple applications, the calling order is adjacent to the application. , the previous application calls the next application to run, and the latter application is called to run by the previous application. Because during the process of calling the target application, if there is fraud, there are certain rules in the order of application calls to achieve the target application. For example, a malicious application (also called a fraudulent application, etc.) can call an intermediate application (for example, a browser, etc.) ), and then calls the target application through the intermediate application, that is, the calling sequence is: malicious application, intermediate application, and target application. Therefore, in this embodiment, the application link information can be obtained and compared with the fraud characteristic data to implement fraud detection.

In this embodiment, during the comparison process, the feature information associated with the target application may include application link information, application package name information in the application link information, application signature information and application information in the application link information. At least one of the behavioral features applied in the link information is compared with the fraud feature data to complete fraud detection, which can improve the accuracy of fraud detection.

In one embodiment, the characteristic information is compared with the fraud characteristic data in the fraud characteristic data set to determine the fraud behavior detection results, including:

Compare the feature information with the fraud feature data in the fraud feature data set according to the target comparison strategy to determine the fraud detection results;

Among them, the target comparison strategy is obtained by the terminal from the cloud in advance, and the fraud characteristic data set is obtained by the terminal from the cloud in advance.

It should be noted that the target comparison strategy can be configured in the cloud in advance. The REE side can obtain the target comparison strategy from the cloud in advance and pass it to the TEE side. The TEE side will compare the feature information with the fraud feature database according to the target comparison strategy. Yes, confirm the fraud detection results.

It is understandable that the target comparison strategy can be determined based on the usage feedback of multiple users, that is, the illegal calling methods, called applications, etc. feedback from multiple users are collected and integrated to form a fraud feature data set.

That is, in this embodiment, the target comparison strategy can be configured according to the needs and stored in the cloud. The terminal obtains the pre-configured target comparison strategy from the cloud, compares the feature information with the fraud feature data in the fraud feature data set, and determines the fraud behavior detection The result is to improve fraud detection accuracy.

In one embodiment, the feature information is compared with the fraud feature data in the fraud feature data set according to the target comparison strategy to determine the fraud behavior detection results, including:

When the application link information of multiple applications in the feature information matches the application calling sequence of multiple applications in the fraud feature data set, it is determined that the fraud detection result is that fraud exists; or

The application link information in the feature information matches the application calling sequence of multiple applications in the fraud feature data set, and the package name information and signature information in the feature information in the fraud feature data set match and at least one of the behavioral characteristics, it is determined that the detection result of the fraudulent behavior is that there is a fraudulent behavior.

The fraud feature data set may include multiple predetermined application calling sequences, as well as package name information, signature information, behavioral characteristics, code characteristics, permission characteristics, etc. of multiple preset malicious applications. The application link information is associated with multiple users. In this embodiment, the target comparison strategy can be a strategy of matching the application call order. The application link information in the feature information can be matched with the application call order of the multiple applications in the fraud feature data set. In the feature information If the application link information in the fraud feature data set successfully matches the application calling sequence of multiple applications in the fraud feature data set, it means that the target application was called in the predetermined order in the fraud feature data set, and it can be determined that there is fraud, and the representation can be obtained Fraud detection results showing the existence of fraud can improve the accuracy of fraud detection. Alternatively, when the application link information in the characteristic information successfully matches the application calling sequence of multiple applications in the fraud characteristic data set, it can be further detected that at least one of the package name information, signature information and behavioral characteristics in the characteristic information is in the fraud characteristic data set. Whether the matching can be successful in the fraud feature data set. If at least one of the package name information, signature information and behavioral characteristics in the feature information is matched in the fraud feature data set, it can mean that the information of the malicious application is hit, and the existence of fraud is determined. , the fraud detection results indicating the existence of fraud can be obtained, which can further improve the accuracy of fraud detection.

In one embodiment, the detection request includes an authorization token, and the method further includes:

The terminal sends the authorization token to the TEE side on the REE side;

When the terminal successfully verifies the authorization token on the TEE side, it determines that the target application authorization verification is successful.

After receiving the detection request, the REE side can pass the authorization token to the TEE side, and the TEE side will verify the validity of the authorization token. It can be understood that only when the authorization token verification is successful (that is, authorization Token is valid), it can be determined that the authorization verification of the target application is successful. In this case, further data comparison is performed to compare the feature information with the fraud feature data in the fraud feature data set to determine the fraud detection results, which can improve The effectiveness of data comparison, thereby improving the effectiveness of the fraud detection results obtained.

In one embodiment, when the TEE successfully verifies the authorization token, the terminal determines that the target application authorization verification is successful, including:

The terminal determines that the target application authorization verification is successful when the TEE successfully decrypts the authorization token and the decrypted authorization token has not expired.

It should be noted that if the authorization token is valid, the authorization token should be successfully decrypted by the terminal and the validity period has not expired. If the terminal can successfully decrypt the authorization token, it means that the authorization token is issued by the cloud management service. As an example, in the process of verifying the authorization token, it can be verified whether the authorization token comes from the management service in the cloud and/or whether the validity period has expired. (indicating valid), it is determined that the authorization token verification is successful; otherwise, it is determined that the authorization token verification fails, and an error prompt information can be returned to the REE side, and the REE side can return the error prompt information to the target application.

In one embodiment, the detection request includes at least one of package name information and signature information of the target application;

Obtain feature information associated with the target application, including:

Send an authentication request to the cloud. The authentication request includes at least one of the package name information and signature information of the target application. The authentication request is used to request authentication of the target application;

Receive the authentication result sent by the cloud in response to the authentication request;

When the identity verification result indicates that the identity verification is passed, the characteristic information is obtained.

That is, in the process of obtaining the characteristic information associated with the target application, the target application also needs to be authenticated. REE sends an authentication request for the target application to the cloud. After the cloud receives the authentication request, it can use the package name of the target application. At least one of the information and signature information is authenticated, and the authentication result is obtained and sent to the REE side. When the authentication result indicates that the authentication is passed, the REE side obtains the characteristic information associated with the target application to ensure that the characteristic information Get security.

In one embodiment, the terminal receives the data update request sent by the target application on the REE side; if the update verification of the target application is successful, the update data in the data update request is sent to the TEE side, and the TEE side uses the update data to verify the fraud characteristics. The data set is updated.

That is to say, during the data update process, the target application needs to be updated and verified. The update verification of the target application can be understood as the identity verification of the target application. Only when the verification is passed can the update data in the data update request be sent to the TEE. On the TEE side, the updated data is used to detect fraud characteristics. The update of the data set, on the one hand, ensures the security of data updates, and on the other hand, it can improve the timeliness of the fraud feature data in the fraud feature data set.

The process of the above-mentioned fraud detection method will be described in detail below with a specific embodiment.

The fraud detection method in the embodiment of this application is an anti-fraud detection method that integrates terminal-side hardware, framework, application layer capabilities and cloud service capabilities, and includes the following aspects:

Protection scheme for black and gray feature data sets (fraud feature data sets) based on the TEE side:

Black and gray product characteristic data sets can be collected through attack and defense confrontation analysis, black and gray product intelligence and other channels, including but not limited to malicious application package names, malicious application signatures, malicious behavior characteristics, malicious application code characteristics (such as runtime memory usage, specific categories name, etc.), malicious application permission characteristics, etc. The cloud management service can deliver the collected black and gray product characteristic data sets to the terminal side through the trusted data transmission channel. In addition, the black and gray product characteristic data sets can be stored in the TEE side of the terminal side and can be updated, etc. .

Black and gray production characteristic data set update scheme based on TEE side:

The feature data set of black and gray products is delivered/preset by the corresponding cloud of the terminal, and the terminal can reserve a feature data update interface. The update interface performs permission verification through identity authentication, signature authentication, and feature recognition of terminal-side applications. Those who pass the verification can update the update data received by the update interface to the black and gray production characteristic data set on the TEE side. A single application can independently supplement the black and gray production characteristic data set and specify it for its own use only. The data will be used without authorization. It is not used for other process matching to achieve the effect of data customization.

Framework layer call chain detection:

The complete application call link detection, its logic is divided into two dimensions:

The first is the general logic, that is, the life cycle from application installation => use => uninstallation. During the application installation process, the system scans the application installation package, extracts its installation package characteristics and code characteristics, and integrates them with the above black and gray product characteristic data Comparison is carried out to complete risk identification. During the use process, the application running status is extracted to identify its malicious behavior characteristics (such as hidden payment applications, induced payment in the interface, gambling, etc.), and comparison of characteristics is performed.

Secondly, in the usage logic, the application running behavior information during the user's use, such as the application startup sequence (i.e., application call sequence or application call link), assumes the payment process of the fraudulent application. For: Fraudulent application => Photo browser => Browser => Payment application), in the application call link, match this process and identify and match the fraudulent application through the characteristics in the above general logic, you can complete the link The identification of fraudulent behaviors on the road can provide risk warnings before users pay. In the implementation method, link characteristics can also be extracted, such as calculating the hash value (hash) comparison of key link fields to achieve data comparison. equal.

As shown in Figure 2, it is a structural diagram of a fraud detection system that implements the fraud detection method.

For REE side:

(1) Anti-fraud detection

Receive a security capability assessment request from the terminal's "Anti-Fraud Security Detection", which contains the behavioral identifier of the "Anti-Fraud Behavior Detection" and the authorization token of the management service;

Use the REE side communication agent and the TEE side communication agent to transfer the fraud characteristic data set to the TEE side for "anti-fraud security detection";

Return the fraud detection results of the "anti-fraud security detection" on the TEE side to the caller (target application).

(2)Framework security capabilities

Accept the call request for "anti-fraud detection" and obtain the anti-fraud data and policy corresponding detection collection requirements on the TEE side through the communication agent (including application link information, behavioral characteristics, signature information, package name information, etc.);

Relying on the policy, the data is roughly calibrated and the application link information within the policy scope is organized and transmitted to the TEE side for "anti-fraud security detection";

(3) Anti-fraud data support application programming interface (API)

Accept the caller's data writing request and communicate with the "anti-fraud data management service" through the communication agent. The anti-fraud data management service is a cloud management service that verifies whether the caller's identity and data are legal. Through a trusted client and The end updates the "Fraud Feature Data Set" in the TEE side.

For TEE side:

(1) Anti-fraud security detection

Accept the anti-fraud query capability request from the REE side "Anti-Fraud Detection", which contains The behavior identifier of "anti-fraud behavior detection", the authorization token of the management service and the security status information on the REE side are used to detect whether the access request is valid according to the response policy, for example:

According to the terminal's "anti-fraud detection" identification, check whether the target application has the permission to call "anti-fraud detection";

Verify the validity of the authorization token (such as whether the token comes from the management service of this mobile device, whether the token has expired, etc.), and check whether the management service has the authority to call "anti-fraud detection".

Digitally sign the fraud detection results using the terminal’s private key;

Obtain the specific policy scope application stack information in front of the caller through the "framework security capability", compare it with the fraud characteristic data in the fraud characteristic data set preset (delivered) in the TEE, and combine the fraud detection results and digital signatures Return to the direct REE side "anti-fraud detection";

Accept updated data from the "Fraud Characteristic Data Set" and "Anti-Fraud Data Support Application Program Interface" in the "Anti-Fraud Data Management Service" to update the TEE policy data set (the update priority is based on time first).

For anti-fraud data management services:

Among them, basic data can include:

(1) Fraud feature data set

A comprehensive fraud characteristic data set can be established by accessing the National Anti-Fraud Center, system protection black product data buried points, actual offensive and defensive confrontations, black and gray product intelligence and other sources, including but not limited to: package name, signature, application link information, Behavioral characteristics, etc.;

(2) Anti-fraud strategy (comparison strategy)

Anti-fraud detection capability configuration, such as call chain scope policy setting, that is, the call process with specific numbers before the target application, what kind of calculation feature configuration exists in the process, etc.

Among them, basic services and interfaces:

(1) Authorization management

Receive the authorization request for the anti-fraud security detection capability of "anti-fraud detection" (anti-fraud end-side data incoming);

Certified "anti-fraud detection";

Generate an authorization token for "anti-fraud detection";

Return the authorization token to Anti-Fraud Detection;

(2) Anti-fraud data supports data authentication interface

When updating end-to-end data, verify whether the data has passed the compliance review to ensure data controllability when updating end-to-end data.

As shown in Figure 3, the specific process of the method in the embodiment of this application is as follows:

1. Preparation stage:

Configure anti-fraud capability information:

Collect multi-dimensional fraud feature data and generate a comprehensive fraud feature data set based on the strategy;

Configure fraud feature policy content, such as detecting the calling sequence information of the pulled application, etc.;

Apply authorization configuration:

Generate and configure authorization tokens and access rights for authorized applications;

Configure an access rights whitelist in the "Authorization Management" module in the cloud. After signature protection, the authorization token is sent to the TEE side through the trusted data transmission channel. The TEE side performs signature verification through the preset key to unlock the authorization token and its validity period;

Import the client-side data model into the background configuration:

Data configuration: The model that can be updated on the terminal side is reviewed in the cloud and the characteristic values are saved;

Import authorization configuration: Generate and configure tokens and access rights that can import fraud data on the endpoint side.

2. Query stage (detection stage)

The caller (target application) initiates a detection request (including authorization token) to the "anti-fraud detection" on the REE side;

The "anti-fraud detection" on the REE side of the terminal authenticates the visitor (target application). During the verification process, the REE side communicates with the cloud. The cloud implements the identity verification of the target application and sends the identity verification results to the REE side. After passing the verification, the "framework security capability" side collects characteristic information associated with the target application according to the policy, such as application link information, package name information, signature information, behavioral characteristics, etc., and transfers the characteristic information to the "anti-fraud security capability" on the TEE side. .

The "anti-fraud security capability" on the terminal TEE side verifies the authorization token. If the verification fails, That is, the operation is terminated and the error message is returned to the "Anti-Fraud Detection" on the REE side. The "Anti-Fraud Detection" records the error information through the access control mechanism and returns it to the caller. At the same time, frequent access and frequent authentication failures occur within the application unit time. Under certain circumstances (such as 1,000 consecutive failures within 1 minute), "anti-fraud detection" can appropriately limit the frequency and number of calls made by the caller (for example, prohibiting requests for 30 minutes);

The TEE side compares the feature information transmitted by the REE side with the features in the fraud feature data set according to the comparison strategy. For example, the comparison strategy stipulates that when the calling sequence is malicious application => specific application => payment application rule, the TEE side will match based on the rules. , if the information about the application calling sequence and malicious application is hit, the risk prompt information will be returned to "anti-fraud detection", and the risk prompt information will be informed to the caller through anti-fraud detection. If it is not hit, the information that no problem has been found yet will be returned;

(3) Terminal side data synchronization stage:

The authorization method refers to the logic of the query phase. If the permission is passed, the updated data will be transmitted to the TEE side through REE, and the "anti-fraud security capability" in the TEE side will complete the update of the data.

For the fraud detection method provided by the embodiments of this application, the execution subject may be a fraud detection device. In the embodiments of this application, a fraud detection device performing a fraud detection method is used as an example to illustrate the fraud detection device provided in the embodiments of this application.

As shown in Figure 4, an embodiment of a fraud detection device 400 is provided, which can be used in electronic devices. The device 400 includes:

The acquisition module 401 is configured to obtain the characteristic information associated with the target application when the rich execution environment REE side receives a detection request sent by the target application;

The first sending module 402 is used to send the characteristic information to the trusted execution environment TEE side of the terminal, and the detection request is used to request fraud detection;

The first determination module 403 is used to compare the characteristic information with the fraud characteristic data in the fraud characteristic data set to determine the fraud detection result when the terminal successfully authenticates the target application on the TEE side.

In one embodiment, the first determination module 403 is specifically configured to compare the feature information with the fraud feature data in the fraud feature data set according to the target comparison strategy, and determine the fraud behavior detection result;

In one embodiment, the first determination module 403 is also specifically used to:

The application link information of multiple applications in the feature information matches the application calling sequence of multiple applications in the fraud feature data set, and the fraud feature data set matches at least one of the package name information, signature information and behavioral features in the feature information. In the case of one item, it is determined that the fraud detection result is that fraud exists.

In one embodiment, the detection request includes an authorization token, and the device further includes:

The second sending module is used to send the authorization token from the REE side to the TEE side;

The second determination module is used to determine on the TEE side that the authorization verification of the target application is successful when the authorization token is successfully verified.

Get modules including:

The third sending module is used to send an identity verification request to the cloud. The identity verification request includes at least one of the package name information and signature information of the target application. The identity verification request is used to request identity verification for the target application;

The first receiving module is used to receive the identity verification result sent by the cloud in response to the identity verification request;

The characteristic information acquisition module is used to obtain characteristic information when the identity verification result indicates that the identity verification is passed.

The fraud detection device in the embodiment of the present application may be an electronic device or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal or other devices other than the terminal. The electronic device can be a mobile phone, a tablet computer, a notebook computer, a handheld computer, a vehicle-mounted electronic device, a Mobile Internet Device (MID), or an augmented reality device. (augmented reality, AR)/virtual reality (VR) equipment, robots, wearable devices, ultra-mobile personal computers (ultra-mobile personal computers, UMPC), netbooks or personal digital assistants (personal digital assistant, PDA), etc. , it can also be a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which are not specifically limited in the embodiments of this application.

The fraud detection device in the embodiment of the present application may be a device with an operating system. The operating system can be an Android operating system, an ios operating system, or other possible operating systems, which are not specifically limited in the embodiments of this application.

The fraud detection device provided by the embodiment of the present application can implement each process implemented by the above-mentioned fraud detection method embodiment. For example, it can implement each process implemented by the method embodiment of Figures 1 to 3. To avoid duplication, no details will be described here. .

Optionally, as shown in Figure 5, this embodiment of the present application also provides an electronic device 500, including a processor 501 and a memory 502. The memory 502 stores programs or instructions that can be run on the processor 501. The program or instructions are When executed, the processor 501 implements each step of the above embodiment of the fraud detection method and can achieve the same technical effect. To avoid duplication, the details will not be described here.

It should be noted that the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.

FIG. 6 is a schematic diagram of the hardware structure of an electronic device implementing an embodiment of the present application.

The electronic device 600 includes but is not limited to: radio frequency unit 601, network module 602, audio output unit 603, input unit 604, sensor 605, display unit 606, user input unit 607, Interface unit 608, memory 609, processor 610 and other components.

Those skilled in the art can understand that the electronic device 600 may also include a power supply (such as a battery) that supplies power to various components. The power supply may be logically connected to the processor 610 through a power management system, thereby managing charging, discharging, and function through the power management system. Consumption management and other functions. The structure of the electronic device shown in Figure 6 does not constitute a limitation on the electronic device. The electronic device may include more or less components than shown in the figure, or combine certain components, or arrange different components, which will not be described again here. .

Among them, processor 610 is used for:

When the rich execution environment REE side receives the detection request sent by the target application, it obtains the characteristic information associated with the target application;

Send the characteristic information to the trusted execution environment TEE side of the terminal, and the detection request is used to request fraud detection;

When the authorization verification of the target application on the TEE side is successful, the characteristic information is compared with the fraud characteristic data in the fraud characteristic data set to determine the fraud detection result.

In one embodiment, the processor 610 is configured to compare the feature information with the fraud feature data in the fraud feature data set according to the target comparison strategy, and determine the fraud behavior detection result;

In one embodiment, the processor 610 is further specifically configured to determine that the fraud behavior detection result is when the application link information of multiple applications in the feature information matches the application calling sequence of multiple applications in the fraud feature data set. There has been fraud; or

Application link information of multiple applications in the feature information and multiple applications in the fraud feature data set The application call sequence matches, and when at least one of the package name information, signature information and behavioral characteristics in the characteristic information is matched in the fraud characteristic data set, it is determined that the fraud detection result is that fraud exists.

In one embodiment, the detection request includes an authorization token;

Radio frequency unit 601, used to send the authorization token on the REE side to the TEE side;

The processor 610 is configured to determine that the target application authorization verification is successful when the authorization token is successfully verified on the TEE side.

The radio frequency unit 601 is used to send an identity verification request to the cloud. The identity verification request includes at least one of the package name information and signature information of the target application. The identity verification request is used to request identity verification of the target application;

The radio frequency unit 601 is used to receive the identity verification result sent by the cloud in response to the identity verification request;

The processor 610 is configured to obtain characteristic information when the identity verification result indicates that the identity verification is passed.

It should be understood that in the embodiment of the present application, the input unit 604 may include a graphics processor (Graphics Processing Unit, GPU) 6041 and a microphone 6042. The graphics processor 6041 is responsible for the image capture device (GPU) in the video capture mode or the image capture mode. Process the image data of still pictures or videos obtained by cameras (such as cameras). The display unit 606 may include a display panel 6061, which may be configured in the form of a liquid crystal display, an organic light emitting diode, or the like. The user input unit 607 includes a touch panel 6071 and at least one of other input devices 6072 . Touch panel 6071, also called touch screen. The touch panel 6071 may include two parts: a touch detection device and a touch controller. Other input devices 6072 may include but are not limited to physical keyboards, function keys (such as volume control keys, switch keys, etc.), trackballs, mice, and joysticks, which will not be described again here.

The memory 609 can be used to store software programs and various data. The memory 609 can mainly include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area can store an operating system and at least one function. required applications or commands (such as sound playback function, Image playback function, etc.) etc. Additionally, memory 609 may include volatile memory or non-volatile memory, or memory x09 may include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electrically removable memory. Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory. Volatile memory can be random access memory (Random Access Memory, RAM), static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDRSDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synch link DRAM) , SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DRRAM). Memory 609 in embodiments of the present application includes, but is not limited to, these and any other suitable types of memory.

Processor 610 may include one or more processing units; optionally including, but not limited to, application programs and operating systems. The processor 610 can integrate an application processor and a modem processor, where the application processor mainly processes the operating system, user interface, application programs, etc., and the modem processor mainly processes wireless communications. It can be understood that the above modem processor may not be integrated into the processor 610.

Embodiments of the present application also provide a readable storage medium. Programs or instructions are stored on the readable storage medium. When the program or instructions are executed by a processor, each process of the above embodiments of the fraud detection method can be implemented and the same can be achieved. To avoid repetition, the technical effects will not be repeated here.

Wherein, the processor is the processor in the electronic device in the above embodiment. Readable storage media includes computer-readable storage media, such as computer read-only memory ROM, random access memory RAM, magnetic disks or optical disks.

An embodiment of the present application also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The communication interface is used to transmit image data. The processor is used to run programs or instructions to implement the above embodiment of the fraud detection method. Each process, and can achieve the same technical effect, is To avoid repetition, we will not go into details here.

It should be understood that the chips mentioned in the embodiments of this application may also be called system-on-chip, system-on-a-chip, system-on-a-chip or system-on-chip, etc.

Embodiments of the present application provide a computer program product. The program product is stored in a storage medium. The program product is executed by at least one processor to implement each process of the above-mentioned fraud behavior detection method embodiment, and can achieve the same technology. The effect will not be described here to avoid repetition.

It should be noted that, in this document, the terms "comprising", "comprises" or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or device that includes a series of elements not only includes those elements, It also includes other elements not expressly listed or inherent in the process, method, article or apparatus. Without further limitation, an element defined by the statement "comprises a..." does not exclude the presence of additional identical elements in a process, method, article or apparatus that includes that element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, but may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved. Functions may be performed, for example, the methods described may be performed in an order different from that described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is better. implementation. Based on this understanding, the technical solution of the present application can be embodied in the form of a computer software product that is essentially or contributes to related technologies. The computer software product is stored in a storage medium (such as ROM/RAM, disk, CD), including several instructions to cause a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in various embodiments of this application.

The embodiments of the present application have been described above in conjunction with the accompanying drawings. However, the present application is not limited to the above-mentioned specific implementations. The above-mentioned specific implementations are only illustrative and not restrictive. Those of ordinary skill in the art will Inspired by this application, without departing from the purpose and claims of this application Within the scope of protection, many forms can be made, all of which fall within the protection of this application.

Claims

A fraud detection method, the method includes:

When the terminal receives the detection request sent by the target application on the rich execution environment REE side, it obtains the characteristic information associated with the target application and sends the characteristic information to the trusted execution environment TEE side of the terminal. The above detection request is used to request fraud detection;

If the terminal successfully performs authorization verification on the target application on the TEE side, the terminal compares the characteristic information with the fraud characteristic data in the fraud characteristic data set to determine the fraud detection result.
The method according to claim 1, wherein the characteristic information includes at least one of the following:

Application link information, the application link information is used to represent the calling sequence information for calling multiple applications including the target application;

The package name information of the application in the application link information;

The signature information of the application in the application link information;

Behavioral characteristics of the application in the application link information.
The method according to claim 1 or 2, wherein comparing the characteristic information with the fraud characteristic data in the fraud characteristic data set to determine the fraud detection result includes:

Compare the feature information with the fraud feature data in the fraud feature data set according to the target comparison strategy to determine the fraud behavior detection result;

Wherein, the target comparison strategy is obtained by the terminal from the cloud in advance, and the fraud characteristic data set is obtained by the terminal from the cloud in advance.
The method according to claim 3, wherein comparing the feature information with the fraud feature data in the fraud feature data set according to a target comparison strategy to determine the fraud detection result includes:

In the case where the application link information in the feature information matches the application calling sequence of multiple applications in the fraud feature data set, it is determined that the fraud detection result is that fraud exists; or

The application link information of multiple applications in the feature information matches the application calling sequence of multiple applications in the fraud feature data set, and the package name information in the feature information in the fraud feature data set matches, In the case where at least one of the signature information and the behavioral characteristics is used, it is determined that the fraudulent behavior detection result indicates that there is a fraudulent behavior.
The method of claim 1, wherein the detection request includes an authorization token, the method further comprising:

The terminal sends the authorization token to the TEE side on the REE side;

When the TEE side successfully verifies the authorization token, the terminal determines that the authorization verification for the target application is successful.
The method according to claim 1, wherein the detection request includes at least one of package name information and signature information of the target application;

The obtaining of characteristic information associated with the target application includes:

Send an identity verification request to the cloud, where the identity verification request includes at least one of package name information and signature information of the target application, where the identity verification request is used to request identity verification for the target application;

Receive an identity verification result sent by the cloud in response to the identity verification request;

When the identity verification result indicates that the identity verification is passed, the characteristic information is obtained.
A fraud detection device, the device includes:

An acquisition module configured to acquire, on the Rich Execution Environment REE side, the characteristic information associated with the target application upon receiving a detection request sent by the target application;

The first sending module is used to send the characteristic information to the trusted execution environment TEE side of the terminal, and the detection request is used to request fraud detection;

The first determination module is configured to compare the feature information with the fraud feature data in the fraud feature data set to determine the fraud behavior detection result when the TEE side successfully performs authorization verification on the target application.
The device according to claim 7, wherein the characteristic information includes at least one of the following:

Application link information, the application link information is used to indicate that the call includes the target application Call sequence information of multiple applications;

The package name information of the application in the application link information;

The signature information of the application in the application link information;

Behavioral characteristics of the application in the application link information.
The device according to claim 7 or 8, wherein the first determination module is configured to compare the feature information with the fraud feature data in the fraud feature data set according to a target comparison strategy, and determine the Fraud detection results;

Wherein, the target comparison strategy is obtained by the terminal from the cloud in advance, and the fraud characteristic data set is obtained by the terminal from the cloud in advance.
The device according to claim 9, wherein comparing the feature information with the fraud feature data in the fraud feature data set according to a target comparison strategy to determine the fraud behavior detection result includes:

In the case where the application link information of multiple applications in the feature information matches the application calling sequence of multiple applications in the fraud feature data set, it is determined that the fraudulent behavior detection result is that there is a fraudulent behavior; or

The application link information of multiple applications in the feature information matches the application calling sequence of multiple applications in the fraud feature data set, and the package name information in the feature information in the fraud feature data set matches, In the case where at least one of the signature information and the behavioral characteristics is used, it is determined that the fraudulent behavior detection result indicates that there is a fraudulent behavior.
The device of claim 7, wherein the detection request includes an authorization token, the device further comprising:

a second sending module, configured to send the authorization token to the TEE side on the REE side;

The second determination module is configured to determine that authorization verification of the target application is successful when the TEE side successfully verifies the authorization token.
The device according to claim 7, wherein the detection request includes at least one of package name information and signature information of the target application;

The acquisition module includes:

The third sending module is used to send an identity verification request to the cloud. The identity verification request includes at least one of the package name information and the signature information of the target application. The identity verification request is used to request a verification request for the target application. Application for authentication;

A first receiving module, configured to receive the identity verification result sent by the cloud in response to the identity verification request;

A feature information acquisition module is configured to acquire the feature information when the identity verification result indicates that the identity verification is passed.
An electronic device, including a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, any of claims 1-6 is implemented. A step of the fraud detection method.
A readable storage medium on which a program or instructions are stored, wherein when the program or instructions are executed by a processor, the steps of the fraud detection method according to any one of claims 1-6 are implemented. .
A computer program product, which is executed by at least one processor to implement the fraud detection method according to any one of claims 1 to 6.
A chip, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement fraud as claimed in any one of claims 1 to 6. Behavior detection methods.