Virus protection method and device

Patent metadata

Field	Value
Publication number	US-10216925-B2
Application number	US-201415036921-A
Country	US
Kind code	B2
Filing date	Aug 26, 2014
Priority date	Nov 15, 2013
Publication date	Feb 26, 2019
Grant date	Feb 26, 2019

Abstract

The present invention discloses a virus protection method and device. The virus protection method comprises: when an Android operating system needs to install an application, transmitting identification information of the application that needs to be installed from a framework layer to an application layer; at the application layer, activating a virus scanner application on the basis of the identification information of the application to allow the virus scanner application to run a virus scan on the application; acquiring a scan result of the virus scan, issuing a notification to the framework layer of whether or not to execute an installation operation for the application on the basis of the scan result; and at the framework layer, either executing the installation operation for the application or rejecting to execute the installation operation for the application on the basis of the notification.

First claim

The invention claimed is:

1. A virus protection method comprising:
providing an application installation listening interface function in an application layer and providing a pre-installation package detection interface function of a security service in a framework layer, wherein the pre-installation package detection interface function is provided at the starting position of an application installation interface function;
determining that an Android operating system needs to install an application when the application installation interface function in a package management service of the Android operating system is called;
transmitting, in response to determining that the Android operating system needs to install the application, identification information of the application that needs to be installed from the framework layer to the application layer, wherein the transmitting includes: in the case that the application installation interface function in a package management service of the Android operating system is called, transmitting, by the application installation interface function, the identification information of the application that needs to be installed to the application installation listening interface function through the pre-installation package detection interface function;
activating, at the application layer, a virus scanner application on the basis of the identification information of the application, to allow the virus scanner application to run virus scan on the application;
acquiring a scan result of the virus scan, and issuing a notification to the framework layer of whether or not to execute an installation operation for the application on the basis of the scan result;
determining, at the framework layer, whether to execute the installation operation for the application or reject the installation operation for the application on the basis of the notification, wherein issuing the notification includes:
issuing the notification directly to the framework layer of whether or not to execute the installation operation for the application on the basis of the virus scan result; or
presenting the virus scan result to a user, and issuing the notification to the framework layer of whether or not to execute the installation operation for the application on the basis of instruction information input by the user, in the case that the virus scan result is that the application is carrying a virus.

2. The method according to claim 1 , wherein, saving, by the pre-installation package detection interface function, live data for application installation, and stopping, by the application installation interface function, the installation operation.

3. The method according to claim 2 , wherein the transmitting, by the application installation interface function, the identification information of the application that needs to be installed to the application installation listening interface function through the pre-installation package detection interface function includes:
when the application installation interface function is called, calling, by the application installation interface function, the pre-installation package detection interface function;
acquiring, by the pre-installation package detection interface function, names of all callback functions from an application installation listener set, and the name of the application installation listening interface function being included in the application installation listener set;
transmitting, by the pre-installation package detection interface function, the identification information of the application that needs to be installed to all the callback functions on the basis of the names of the callback functions.

4. The method according to claim 3 , wherein the method further comprises:
setting the name of the application installation listening interface function in the application installation listener set of the framework layer.

5. The method according to claim 1 , wherein the identification information of the application includes a URI of the application.

6. The method according to claim 1 , wherein the issuing the notification to the framework layer of whether or not to execute the installation operation for the application on the basis of the scan result includes:
calling an application installation resuming class function or an application installation terminating class function provided by the service of the framework layer on the basis of the scan result by using an application installation resuming class function or an application installation terminating class function in the application layer, to issue the notification to the framework layer of whether or not to execute the installation operation for the application.

7. The method according to claim 1 , wherein the method further includes:
deleting the application directly in the case that the virus scan result is that the application is carrying a virus; or
presenting to a user information as to whether or not delete the application, and deleting/not deleting the application on the basis of instruction information input by the user, in the case that the virus scan result is that the application is carrying a virus.

8. A virus protection device, comprising one or more non-transitory computer readable medium configured to store computer-executable instruction and at least one processor to execute the instructions to cause:
provide an application installation listening interface function in an application layer and provide a pre-installation package detection interface function of a security service in a framework layer, wherein the pre-installation package detection interface function is provided at the starting position of an application installation interface function;
determine that an Android operating system needs to install an application when the application installation interface function in a package management service of the Android operating system is called;
transmit, in response to determining that the Android operating system needs to install the application, identification information of the application that needs to be installed from the framework layer to the application layer, wherein the transmitting includes: in the case that the application installation interface function in a package management service of the Android operating system is called, transmit, by the application installation interface function, the identification information of the application that needs to be installed to the application installation listening interface function through the pre-installation package detection interface function;
activate, at the application layer, a virus scanner application on the basis of the identification information of the application, to allow the virus scanner application to run virus scan on the application;
acquire a scan result of the virus scan, and issue a notification to the framework layer of whether or not to execute an installation operation for the application on the basis of the scan result;
determine, at the framework layer, whether to execute the installation operation for the application or reject the installation operation for the application on the basis of the notification, wherein issuing the notification includes:
issue the notification directly to the framework layer of whether or not to execute the installation operation for the application on the basis of the virus scan result; or
present the virus scan result to a user, and issue the notification to the framework layer of whether or not to execute the installation operation for the application on the basis of instruction information input by the user, in the case that the virus scan result is that the application is carrying a virus.

Assignees

• Beijing Qihoo Technology Co
• Qizhi Software Beijing Co Ltd

Inventors

• Hu Zhong
• Wang Xin

Classifications

• H04W88/02

  Terminal devices · CPC title

• G06F2221/033

  Test or assess software · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F21/562

  Static detection · CPC title