Virus protection method and device

Patent metadata

Field	Value
Publication number	US-2016267267-A1
Application number	US-201415036921-A
Country	US
Kind code	A1
Filing date	Aug 26, 2014
Priority date	Nov 15, 2013
Publication date	Sep 15, 2016
Grant date	—

Abstract

The present invention discloses a virus protection method and device. The virus protection method comprises: when an Android operating system needs to install an application, transmitting identification information of the application that needs to be installed from a framework layer to an application layer; at the application layer, activating a virus scanner application on the basis of the identification information of the application to allow the virus scanner application to run a virus scan on the application; acquiring a scan result of the virus scan, issuing a notification to the framework layer of whether or not to execute an installation operation for the application on the basis of the scan result; and at the framework layer, either executing the installation operation for the application or rejecting to execute the installation operation for the application on the basis of the notification.

First claim

1 . A virus protection method comprising:
transmitting, when an Android operating system needs to install an application, identification information of the application that needs to be installed from a framework layer to an application layer; at the application layer, activating a virus scanner application on the basis of the identification information of the application, to allow the virus scanner application to run virus scan on the application; acquiring a scan result of the virus scan, and issuing a notification to the framework layer of whether or not to execute an installation operation for the application on the basis of the scan result; and at the framework layer, either executing the installation operation for the application or rejecting the installation operation for the application on the basis of the notification.

2 . The method according to claim 1 , wherein an application installation listening interface function is provided in the application layer and a pre-installation package detection interface function of a security service is provided in the framework layer; and
the transmitting, when the Android operating system needs to install the application, identification information of the application that needs to be installed from the framework layer to the application layer includes: in the case that an application installation interface function in a package management service of the Android operating system is called, transmitting, by the application installation interface function, the identification information of the application that needs to be installed to the application installation listening interface function through the pre-installation package detection interface function, saving, by the pre-installation package detection interface function, live data for application installation, and stopping, by the application installation interface function, the installation operation.

3 . The method according to claim 2 , wherein the pre-installation package detection interface function is provided at the starting position of the application installation interface function, and the transmitting, by the application installation interface function, the identification information of the application that needs to be installed to the application installation listening interface function through the pre-installation package detection interface function includes:
when the application installation interface function is called, calling, by the application installation interface function, the pre-installation package detection interface function; acquiring, by the pre-installation package detection interface function, names of all callback functions from an application installation listener set, and the name of the application installation listening interface function being included in the application installation listener set; transmitting, by the pre-installation package detection interface function, the identification information of the application that needs to be installed to all the callback functions on the basis of the names of the callback functions.

4 . The method according to claim 3 , wherein the method further comprises:
setting the name of the application installation listening interface function in the application installation listener set of the framework layer.

5 . The method according to claim 1 , wherein the identification information of the application includes a URI of the application.

6 . The method according to claim 1 , wherein the issuing the notification to the framework layer of whether or not to execute the installation operation for the application on the basis of the scan result includes:
calling an application installation resuming class function or an application installation terminating class function provided by the service of the framework layer on the basis of the scan result by using an application installation resuming class function or an application installation terminating class function in the application layer, to issue the notification to the framework layer of whether or not to execute the installation operation for the application.

7 . The method according to claim 1 , wherein the issuing the notification to the framework layer of whether or not to execute the installation operation for the application on the basis of the scan result includes:
issuing the notification directly to the framework layer of whether or not to execute the installation operation for the application on the basis of the virus scan result; or presenting the virus scan result to a user, and issuing the notification to the framework layer of whether or not to execute the installation operation for the application on the basis of instruction information input by the user, in the case that the virus scan result is that the application is carrying a virus.

8 . The method according to claim 1 , wherein the method further includes:
deleting the application directly in the case that the virus scan result is that the application is carrying a virus; or presenting to a user information as to whether or not delete the application, and deleting/not deleting the application on the basis of instruction information input by the user, in the case that the virus scan result is that the application is carrying a virus.

9 . A virus protection device, comprising one or more non-transitory computer readable medium configured to store computer-executable instruction and at least one processor to execute the instructions to cause:
when an Android operating system needs to install an application, transmitting identification information of the application that needs to be installed from a framework layer to an application layer; at the application layer, activating a virus scanner application on the basis of the identification information of the application, to allow the virus scanner application to run virus scan on the application; acquiring a scan result of the virus scan, and issuing a notification to the framework layer of whether or not to execute an installation operation for the application on the basis of the scan result; and at the framework layer, either executing the installation operation for the application or rejecting the installation operation for the application on the basis of the notification.

10 . The device according to claim 9 , wherein an application installation listening interface function is provided in the application layer, and an application installation interface function in a package management service and a pre-installation package detection interface function of a security service are provided; and
the transmitting, when the Android operating system needs to install the application, identification information of the application that needs to be installed from the framework layer to the application layer includes: in the case that an application installation interface function in a package management service of the Android operating system is called, transmitting, by the application installation interface function, the identification information of the application that needs to be installed to the application installation listening interface function through the pre-installation package detection interface function, saving, by the pre-installation package detection interface function, live data for application installation, and stopping, by the application installation interface function, the installation operation.

11 . The device according to claim 10 , wherein the pre-installation package detection interface function is provided at the starting position of the application installation interface function, and the transmitting, by the applic

Assignees

• Beijing Qihoo Technology Co
• Qizhi Soetware (Beijing) Company Ltd

Inventors

• Hu Zhong
• Wang Xin

Classifications

• G06F21/554

  involving event detection and direct action · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F21/562

  Static detection · CPC title

• H04W88/02

  Terminal devices · CPC title