CN104915600B - A kind of Android application securitys methods of risk assessment and device - Google Patents

Abstract

The present invention discloses a method and device for assessing security risks of Android applications, wherein the method includes: monitoring and counting all API events E called by application program A during operation, and recording all API events called by application program A during operation The total number is n; specify each called API event E _i in turn; calculate the probability L(E _i ) of application A calling the API event E _i as a malicious call; calculate the application A calling the API event E _i as malicious When the event is called, the impact I(E _i ) caused by the malicious call; the expected impact R(E _i ) of the application A calling the API event E _i , and continue to specify the next API event to be called; all API events E After being specified, sum the impact expectation R(E _i ) of each called API event E _i to obtain the overall risk level R A of application _A ; combine the overall risk level R A of application _A with the risk threshold R ₀ is compared to determine whether the security risk of application A is acceptable.

Description

An Android application security risk assessment method and device

technical field

The present invention relates to the technical field of mobile terminal software security, in particular, to a method and device for assessing security risks of Android application programs.

Background technique

Android is an open-source operating system based on the Linux platform, which can be used in mobile terminals such as smart phones and tablet computers, and has received extensive attention from mobile terminal equipment manufacturers and users. With the rapid popularization of Android mobile terminals, applications based on the Android operating system also emerge in endlessly.

However, due to the openness of the Android operating system, developers can freely develop applications on the Android platform and release them to the Android application market without any security risk checks. However, some applications have the behavior of accessing sensitive resources, such as stealing personal privacy data, consuming user charges, occupying network traffic, etc.; such applications have potential risks, and once they are maliciously used, they will cause losses to users.

In the prior art, software security risk research is all based on computer software. Because Android mobile terminals have characteristics different from computers, such as storing a large amount of private information, and the attack methods and effects of malicious applications on Android mobile terminals are also quite different from those on computers. For example, some malicious applications on Android mobile terminals maliciously occupy Network traffic, etc., so the computer-side software security measurement model is not very suitable for the application security risk assessment of Android mobile terminals.

There is no effective solution to the problem of the lack of methods for assessing threats and security risks of malicious application programs for Android applications in the prior art.

Contents of the invention

In view of the lack of methods for evaluating malicious application threats and security risks for Android applications in the prior art, the purpose of the present invention is to propose a method and device for evaluating Android application security risks, which can comprehensively and effectively evaluate Android applications. Security risk assessment, judging the size of the security loss that the application may bring, and providing a reference for formulating security policies.

Based on the above object, the technical scheme provided by the invention is as follows:

According to one aspect of the present invention, a kind of Android application security risk assessment method is provided, comprising:

In the Android system environment, call the Android application A to be evaluated, monitor and count all API events E called by the application A during operation, and record the total number of all API events called by the application A during operation as n;

Specify each called API event E _i in turn, where i=1,2,...,n;

For the currently specified API event E _i , calculate the probability L(E _i ) that the application program A invokes the API event E _i as a malicious call;

For the currently specified API event E _i , calculate the impact I(E _i ) caused by the malicious call when the application A invokes the API event E _i as a malicious call event;

According to the probability L(E _i ) of the malicious call and the impact I(E _i ) caused by the malicious call, calculate the impact expectation R(E _i ) of the API event E _i called by the application A, and continue to specify the next called API events;

After all API events E have been specified, the impact expectation R(E _i ) of each called API event E _i is summed to obtain the overall risk level R _A of the application program A, where R _A =∑ _i R( E _i )=∑ _i L(E _i )×I(E _i );

Compare the overall risk level R _A of application A with the risk threshold R ₀ to determine whether the security risk of application A is acceptable.

Among them, the probability L(E _i ) of calling the API event E _i by the application program A is a malicious call is calculated as:

Among them, P(E _i |A is a malicious application) is the probability that a malicious application calls a sensitive API bad event E _i occurs, and P(A is a malicious application) is an application in all statistical applications is the probability of a malicious application, P(E _i ) is the probability of all applications calling a sensitive API bad event E _i .

And, when the API event E _i called by application A is a malicious call event, the impact I(E _i ) caused by the malicious call is:

Calculate the subjective assessment impact I _S (E _i ) caused by malicious calls;

Calculate the objective evaluation impact I _O (E _i ) caused by the malicious call;

Calculate the weight H _i (E _i ) of the subjective assessment impact caused by the malicious call;

According to the subjective evaluation impact I _S (E _i ) caused by the malicious call, the objective evaluation impact I _O (E _i ) caused by the malicious call, and the weight H _i ⁽ E _i ) of the subjective evaluation impact caused by the malicious call, calculate the Impact I(E _i ):

I(E _i )＝H _i (E _i )×I _S (E _i )+W _i (E _i )×I _O (E _i )

Wherein, W _i (E _i )=1-H _i (E _i ).

And, calculate the subjective evaluation impact I _S (E _i ) caused by the malicious call as:

Establish subjective impact assessment scale set U, where U={1,2,3,4,5,6,7,8,9,10};

All m subjective evaluators are required to sequentially select the corresponding evaluation values from the elements of the subjective impact evaluation scale set U for all n calling API events according to subjective experience, and then score them;

Create a scoring matrix Score, and write the score into the scoring matrix Score as follows:

Among them, score _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th calling API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n;

According to the scoring matrix Score, the subjective evaluation impact I _S (E _i ) of the i-th API call event is calculated as:

At the same time, calculate the objective evaluation impact I _O (E _i ) caused by the malicious call as;

Establish objective impact assessment scale set V, where V={1,2,3,4,5,6,7,8,9,10};

Analyze a large number of application samples, and calculate the percentage of the number of calls to each API event when the malicious application is running;

Define the quantified adverse impact of each API event invoked by a malicious application;

According to the percentage of the number of times the malicious application calls each API event at runtime, and the quantified adverse impact of each API event called by the malicious application, the probability M(E _i );

The probability M(E _i ) that each API event is called by an application program is called by a malicious application program, and the objective impact assessment scale set V is used to quantify the objective assessment impact I _O (E _i ) caused by malicious calls.

At the same time, the weight H _j (E _i ) for calculating the subjective evaluation impact caused by malicious calls is:

The subjective evaluation impact I _S (E _i ) of the i-th API call event is normalized, and the normalized formula subjective evaluation factor p _ji is obtained:

Among them, i=1,2,...n;

Create a normalized scoring matrix Score':

Among them, score' _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th call API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n, and p _j1 +p _j2 +...p _jn = 1;

According to the normalized scoring matrix Score', the entropy method is used to calculate the weight H _i (E _i ) of subjective evaluation influence:

Wherein, 0≤H _i (E _i )≤1, i=1, 2,...n.

According to another aspect of the present invention, a kind of Android application security risk assessment device is provided, comprising:

Monitoring module, in the Android system environment, the monitoring module calls the Android application A to be evaluated, monitors and counts all API events E called by the application A during operation, and records the total number of all API events called by the application A during operation for n;

Call pointer, which specifies each called API event E _i in turn, where i=1,2,...,n;

Probability calculation module, the probability calculation module calculates the probability L(E _i ) that the application program A invokes the API event E _i as a malicious call for the currently specified API event E _i ;

Influence calculation module, for the currently specified API event E _i , the influence calculation module calculates the impact I(E _i ) caused by the malicious call when the API event E _i called by the application program A is a malicious call event;

The expectation assessment module, the expectation assessment module calculates the impact expectation R(E _i ) of the API event E _i called by the application program A according to the probability L(E _i ) of the malicious call and the impact I(E _i ) caused by the malicious call, and Continue to specify the next API event to be called;

The summation module, after all the API events E are specified, the summation module sums the impact expectation R(E _i ) of each called API event E _i to obtain the overall risk level R _A of the application program A, Where R _A =∑ _i R(E _i )=∑ _i L(E _i )×I(E _i );

A judging module. The judging module compares the overall risk level R _A of the application program A with the risk threshold R ₀ to judge whether the security risk of the application program A is acceptable.

Among them, the probability calculation module calculates the probability L(E _i ) that the application A calls the API event E _i is a malicious call as:

Among them, P(E _i |A is a malicious application) is the probability that a malicious application calls a sensitive API bad event E _i occurs, and P(A is a malicious application) is an application in all statistical applications is the probability of a malicious application, P(E _i ) is the probability of all applications calling a sensitive API bad event E _i .

Moreover, the impact calculation module also includes a subjective impact calculation module, an objective impact calculation module, and a subjective assessment _impact weight calculation module. (E _i ) is:

The subjective impact calculation module is used to calculate the subjective assessment impact I _S (E _i ) caused by malicious calls;

The objective impact calculation module is used to calculate the objective assessment impact I _O (E _i ) caused by the malicious call;

The subjective impact weight calculation module is used to calculate the weight H _i (E _i ) of the subjective assessment impact caused by the malicious call;

_{The impact calculation module calculates malicious} The impact I(E _i ) caused by the call:

I(E _i )＝H _i (E _i )×I _S (E _i )+W _i (E _i )×I _O (E _i )

Wherein, W _i (E _i )=1-H _i (E _i ).

Moreover, the subjective impact calculation module calculates the subjective assessment impact I _S (E _i ) caused by malicious calls as:

Establish subjective impact assessment scale set U, where U={1,2,3,4,5,6,7,8,9,10};

All m subjective evaluators are required to sequentially select the corresponding evaluation values from the elements of the subjective impact evaluation scale set U for all n calling API events according to subjective experience, and then score them;

Create a scoring matrix Score, and write the score into the scoring matrix Score as follows:

Among them, score _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th calling API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n;

According to the scoring matrix Score, the subjective evaluation impact I _S (E _i ) of the i-th API call event is calculated as:

At the same time, the objective impact calculation module calculates the objective evaluation impact I _O (E _i ) caused by the malicious call as;

Establish objective impact assessment scale set V, where V={1,2,3,4,5,6,7,8,9,10};

Analyze a large number of application samples, and calculate the percentage of the number of calls to each API event when the malicious application is running;

Define the quantified adverse impact of each API event invoked by a malicious application;

According to the percentage of the number of times the malicious application calls each API event at runtime, and the quantified adverse impact of each API event called by the malicious application, the probability M(E _i );

The probability M(E _i ) that each API event is called by an application program is called by a malicious application program, and the objective impact assessment scale set V is used to quantify the objective assessment impact I _O (E _i ) caused by malicious calls.

At the same time, the subjective impact weight calculation module calculates the weight H _j (E _i ) of the subjective assessment impact caused by malicious calls as:

The subjective evaluation impact I _S (E _i ) of the i-th API call event is normalized, and the normalized formula subjective evaluation factor p _ji is obtained:

Among them, i=1,2,...n;

Create a normalized scoring matrix Score':

Among them, score' _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th call API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n, and p _j1 +p _j2 +...p _jn = 1;

According to the normalized scoring matrix Score', the entropy method is used to calculate the weight H _i (E _i ) of subjective evaluation influence:

Wherein, 0≤H _i (E _i )≤1, i=1, 2,...n.

From the above, it can be seen that the technical solution provided by the present invention calculates the impact of malicious software in a subjective and objective way, and combines it with the probability of malicious software to evaluate the risk loss of the application program, filling the current gap There is a vacancy in the field of Android application security assessment; at the same time, the information entropy theory is used to assess the security risk of the application, avoiding the one-sidedness and limitations caused by a single subjective and objective method.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the accompanying drawings required in the embodiments. Obviously, the accompanying drawings in the following description are only some of the present invention. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

Fig. 1 is the flow chart of a kind of Android application security risk assessment method according to the embodiment of the present invention;

Fig. 2 is a structural diagram of an Android application security risk assessment device according to an embodiment of the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be further clearly, completely and detailedly described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described The embodiments are only some of the embodiments of the present invention, not all of them. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments of the present invention belong to the protection scope of the present invention.

According to one embodiment of the present invention, a method for evaluating security risks of Android application programs is provided.

As shown in Figure 1, the Android application security risk assessment method provided according to the embodiment of the present invention includes:

Step S101, in the Android system environment, call the Android application A to be evaluated, monitor and count all API events E called by the application A during operation, and record the total number of all API events called by the application A during operation as n ;

Step S103, sequentially designate each called API event E _i , where i=1, 2,...,n;

Step S105, for the currently specified API event E _i , calculate the probability L(E _i ) that the application program A calling the API event E _i is a malicious call;

Step S107, for the currently specified API event E _i , calculate the impact I(E _i ) caused by the malicious call when the application program A invokes the API event E _i as a malicious call event;

Step S109, according to the probability L(E _i ) of the malicious call and the impact I(E _i ) caused by the malicious call, calculate the impact expectation R(E _i ) of the API event E _i invoked by the application program A, and continue to specify the next The API event being called;

Step S111, after all API events E have been specified, sum the expected impact R(E _i ) of each called API event E _i to obtain the overall risk level R _A of application A, where R _A =∑ _i R(E _i )＝∑ _i L(E _i )×I(E _i );

Step S113 , comparing the overall risk level R _A of the application program A with the risk threshold R ₀ to determine whether the security risk of the application program A is acceptable.

The technical solution adopted by the present invention for Android application security risk assessment is: take the API directly interacting between the application program and the Android system as the analysis center, calculate the risk loss of each API adverse event, and then calculate the risk loss of the entire application program. risk loss.

When the application program runs in the system, it will call the corresponding API to complete the predetermined function. An API with some sensitive functions is called an adverse event E _i , for example, an API for sending a short message, an API for obtaining a mobile phone number, and the like. An application has multiple adverse events, and each adverse event is considered to occur independently. Therefore, by calculating the impact expectation R(E _i ) of each adverse event, and then weighting it, the overall risk level R _A of the entire application can be obtained.

Among them, the probability L(E _i ) of calling the API event E _i by the application program A is a malicious call is calculated as:

Among them, P(E _i |A is a malicious application) is the probability that a malicious application calls a sensitive API bad event E _i occurs, and P(A is a malicious application) is an application in all statistical applications is the probability of a malicious application, P(E _i ) is the probability of all applications calling a sensitive API bad event E _i .

The Bayesian formulation of the deformation of the above formula. For application A, it is either malicious or normal, and these two events are mutually exclusive. For the case where a sensitive API is called by an application, it is always called by a malicious application or by a normal application. The obtained L(E _i ) represents the probability that the application A is a malicious application under the condition that the sensitive API call event E _i occurs, which fully meets the conditions of the Bayesian formula.

And, when the API event E _i called by application A is a malicious call event, the impact I(E _i ) caused by the malicious call is:

Calculate the subjective assessment impact I _S (E _i ) caused by malicious calls;

Calculate the objective evaluation impact I _O (E _i ) caused by the malicious call;

Calculate the weight H _i (E _i ) of the subjective assessment impact caused by the malicious call;

According to the subjective assessment impact I _S (E _i ) caused by the malicious call, the objective assessment impact I _O (E _i ) caused by the malicious call, and the weight H _i (E _i ) of the subjective assessment impact caused by the malicious call, calculate the Impact I(E _i ):

I(E _i )＝H _i (E _i )×I _S (E _i )+W _i (E _i )×I _O (E _i )

Wherein, W _i (E _i )=1−H _i (E _i ).

The impact expectation R(E _i ) of an adverse event is jointly determined by the probability L(E _i ) of an adverse event and the impact I(E _i ) of an adverse event. The probability L(E _i ) of an adverse event was calculated using the Bayesian formula. The impact of adverse events I (E _i ) consists of two parts: the impact of subjectively assessed adverse events and the impact of objectively assessed adverse events. The impact of subjectively assessed adverse events is judged subjectively by experts based on experience, and the impact of objectively assessed adverse events is obtained from actual data in the real world according to the assessment rules; and the information entropy theory is used to calculate the impact of subjectively assessed adverse events and the objective The weight of the impact of the assessed adverse event in the impact of the adverse event I (E _i ).

And, calculate the subjective evaluation impact I _S (E _i ) caused by the malicious call as:

Establish subjective impact assessment scale set U, where U={1,2,3,4,5,6,7,8,9,10};

All m subjective evaluators are required to sequentially select the corresponding evaluation values from the elements of the subjective impact evaluation scale set U for all n calling API events according to subjective experience, and then score them;

Create a scoring matrix Score, and write the score into the scoring matrix Score as follows:

Among them, score _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th calling API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n;

According to the scoring matrix Score, the subjective evaluation impact I _S (E _i ) of the i-th API call event is calculated as:

The impact _IS of subjectively assessed adverse events is a method to determine the impact value of adverse events based on experts' understanding of the importance of the event. Among the subjective evaluation methods of current research, the AHP is commonly used. This method needs to divide the problem into many indicators. For these indicators, experts or analysts make pairwise comparisons and use a scale of 1-9 to construct a comparative judgment matrix. The 1-9 scaling method is often not suitable for selecting too many indicators, but the number of sensitive API adverse events is relatively large, and the previous 1-9 scaling method is not very suitable for the subjective evaluation of experts in the present invention . Therefore, we will learn from and improve the scale of 1-9 by experts in AHP.

For the impact of subjectively assessed adverse events, we use the expert scoring mechanism to calculate. In order to unify, the impact value range of expert scoring is changed from 1 to 9 to 1 to 10. And because the number of sensitive API adverse events is the majority, and the risk impact caused by some sensitive API adverse events is the same, so when assigning subjective values to all sensitive APIs in this paper, the impact value scores given by experts are based entirely on experience. Reasonable, multiple identical ratings are allowed. For example, assuming that there are m sensitive APIs, and experts believe that the risk impact of m ₁ (m ₁ <m) APIs is consistent, then experts can give the same risk impact value for these m ₁ sensitive APIs.

U={1, 2, 3, 4, 5, 6, 7, 8, 9, 10} is a collection of expert scores in this embodiment. Experts evaluate the size of the possible losses caused by adverse events being invoked by malicious programs based on experience , assign a value from 1 to 10, respectively.

At the same time, calculate the objective evaluation impact I _O (E _i ) caused by the malicious call as;

Establish objective impact assessment scale set V, where V={1,2,3,4,5,6,7,8,9,10};

Analyze a large number of application samples, and calculate the percentage of the number of calls to each API event when the malicious application is running;

Define the quantified adverse impact of each API event invoked by a malicious application;

According to the percentage of the number of times the malicious application calls each API event at runtime, and the quantified adverse impact of each API event called by the malicious application, the probability M(E _i );

The probability M(E _i ) that each API event is called by an application program is called by a malicious application program, and the objective impact assessment scale set V is used to quantify the objective assessment impact I _O (E _i ) caused by malicious calls.

The determination of the impact I _O (E _i ) of an objectively assessed adverse event is entirely derived from objective reality, and is a method of determining the impact value based on information obtained in the real world. Malicious behaviors of malicious applications are often driven by profit, so generally speaking, the APIs that can make the most profit for malicious application authors and are most frequently called often have the greatest risk impact and loss on users. Based on this, the objective risk impact value of sensitive API adverse events can be obtained by analyzing the API calls of Android malicious applications. The advantage of determining the objective risk impact value is that it relies entirely on observational data to judge, without interference from human factors, and can make an objective and fair evaluation.

It is possible to analyze the percentage of API calls by a large number of malicious application samples, and then formulate some rules to define the objective impact of each API bad event. The specific rules are as follows, where M represents the percentage of API calls by malicious applications:

(1) If M≥90%, then define the objective risk impact value I _O (E _i )=10;

(2) If 90%>M≥80%, then define the objective risk impact value I _O (E _i )=9;

(3) If 80%>M≥70%, then define the objective risk impact value I _O (E _i )=8;

(4) If 70%>M≥60%, then define the objective risk impact value I _O (E _i )=7;

(5) If 60%>M≥50%, define the objective risk impact value I _O (E _i )=6;

(6) If 50%>M≥40%, define the objective risk impact value I _O (E _i )=5;

(7) If 40%>M≥30%, then define the objective risk impact value I _O (E _i )=4;

(8) If 30%>M≥20%, define the objective risk impact value I _O (E _i )=3;

(9) If 20%>M≥10%, then define the objective risk impact value I _O (E _i )=2;

(10) If 10%>M≥0, then define the objective risk impact value I _O (E _i )=1;

In this embodiment, the objective impact assessment scale set V of API adverse events is set to be the same as the subjective impact assessment scale set U for one-to-one correspondence. For a certain API, by counting its percentage called by malicious applications and checking the rules to see which range the percentage falls in, its I _O (E _i ) is determined as the value of the corresponding range.

At the same time, the weight H _j (E _i ) for calculating the subjective evaluation impact caused by malicious calls is:

The subjective evaluation impact I _S (E _i ) of the i-th API call event is normalized, and the normalized formula subjective evaluation factor p _ji is obtained:

Among them, i=1,2,...n;

Create a normalized scoring matrix Score':

Among them, score' _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th call API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n, and p _j1 +p _j2 +...p _jn = 1;

According to the normalized scoring matrix Score', the entropy method is used to calculate the weight H _i (E _i ) of subjective evaluation influence:

Wherein, 0≤H _i (E _i )≤1, i=1, 2,...n.

The determination of objective risk impact value has both advantages and disadvantages. The disadvantage is that it is easily affected by the difference of sample data, resulting in errors in objective value assignment. The disadvantage of experts' subjective determination of risk impact value is that it is easily affected by subjective factors. Evaluators often determine the importance according to their own subjective wishes, which is easily affected by personal factors.

In order to reduce the interference of subjective factors and the error of objective factors, this paper proposes a combination of subjective and objective methods to determine the risk impact value of application behavior, that is, the risk impact value of sensitive APIs. Firstly, the subjective value of risk impact and the objective value of risk impact are calculated using the method described above, and then according to the expert scoring matrix, the information entropy is used to adjust the proportion of the subjective value of risk impact and the objective value of risk impact to obtain an optimized comprehensive risk impact value .

For the scoring matrix Score of experts, the elements score _ji of the matrix are all between 1 and 10. When the score _ji data is normalized, the subjective evaluation factor p _ji of the normalization formula is obtained, obviously p _j1 +p _j2 +...p _jn =1, where i=1,2,...n.

Each column of the processed Score' also represents the evaluation of the influence value of an API by m experts, which actually reflects the probability of an API being maliciously called. For the above Score', if there is a large difference in the risk impact value assignments of the API by experts, that is, p _j1 + p _j2 +...p _jn = 1, it means that the experts have inconsistent views on the value of the API, and the subjective assignment of the experts It is not very convincing, and the proportion of experts’ subjective assignments in the comprehensive risk impact value should be weakened; on the contrary, if the difference in assignments is small, it means that experts have more consistent views on the value of API, and the data provided by experts has a higher Persuasiveness should play a key role in the comprehensive evaluation. Therefore, this paper uses the entropy method to evaluate the relative importance of the subjective risk impact value set by experts in the comprehensive risk impact value.

The larger the H _i (E _i ), the greater the expert's contribution to the evaluation of the risk impact value of the i-th API; on the contrary, the smaller the H _i (E _i ), the greater the expert's contribution to the evaluation of the i-th API risk impact value. small. Therefore, the weight of the risk impact value obtained by the expert's subjective assignment in the comprehensive risk impact value is H _i (E _i ), relatively speaking, the weight of the risk impact value obtained by objective data is:

W _i (E _i )＝1-H _i (E _i )

A large W _i (E _i ) indicates that the risk loss value obtained from objective data is relatively important and contributes a lot.

According to another embodiment of the present invention, an Android application security risk assessment device is provided.

As shown in Figure 2, the Android application security risk assessment device provided according to the embodiment of the present invention includes:

Monitoring module 21, the monitoring module 21 calls the Android application program A to be evaluated under the Android system environment, monitors and counts all API events E called by the application program A in operation, and records all API events called by the application program A in operation The total number of is n;

Call pointer 22, which in turn specifies each called API event E _i , where i=1, 2,...,n;

Probability calculation module 23, the probability calculation module 23 calculates the probability L(E _i ) that the application program A invokes the API event E _i as a malicious call for the currently specified API event E _i ;

Influence calculation module 24, influence calculation module 24 For the currently specified API event E _i , when the calculation application program A invokes the API event E _i as a malicious call event, the impact I(E _i ) caused by the malicious call;

The expectation evaluation module 25, the expectation evaluation module 25 calculates the impact expectation R(E _i ) of the API event E _i invoked by the application program A according to the probability L(E _i ) of the malicious call and the impact I(E _i ) caused by the malicious call , and continue to specify the next API event to be called;

The summation module 26, after all the API events E are specified, the summation module 26 sums the impact expectation R(E _i ) of each called API event E _i to obtain the overall risk level R of the application program A _A , where R _A =∑ _i R(E _i )=∑ _i L(E _i )×I(E _i );

A judging module 27. The judging module 27 compares the overall risk level R _A of the application program A with the risk threshold R ₀ to judge whether the security risk of the application program A is acceptable.

Among them, the probability calculation module calculates the probability L(E _i ) that the application A calls the API event E _i is a malicious call as:

Among them, P(E _i |A is a malicious application) is the probability that a malicious application calls a sensitive API bad event E _i occurs, and P(A is a malicious application) is an application in all statistical applications is the probability of a malicious application, P(E _i ) is the probability of all applications calling a sensitive API bad event E _i .

Moreover, the impact calculation module also includes a subjective impact calculation module, an objective impact calculation module, and a subjective assessment _impact weight calculation module. (E _i ) is:

The subjective impact calculation module is used to calculate the subjective assessment impact I _S (E _i ) caused by malicious calls;

The objective impact calculation module is used to calculate the objective assessment impact I _O (E _i ) caused by the malicious call;

The subjective impact weight calculation module is used to calculate the weight H _i (E _i ) of the subjective assessment impact caused by the malicious call;

_{The impact calculation module calculates malicious} The impact I(E _i ) caused by the call:

I(E _i )＝H _i (E _i )×I _S (E _i )+W _i (E _i )×I _O (E _i )

Wherein, W _i (E _i )=1−H _i (E _i ).

Moreover, the subjective impact calculation module calculates the subjective assessment impact I _S (E _i ) caused by malicious calls as:

Establish subjective impact assessment scale set U, where U={1,2,3,4,5,6,7,8,9,10};

All m subjective evaluators are required to sequentially select the corresponding evaluation values from the elements of the subjective impact evaluation scale set U for all n calling API events according to subjective experience, and then score them;

Create a scoring matrix Score, and write the score into the scoring matrix Score as follows:

Among them, score _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th calling API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n;

According to the scoring matrix Score, the subjective evaluation impact I _S (E _i ) of the i-th API call event is calculated as:

At the same time, the objective impact calculation module calculates the objective evaluation impact I _O (E _i ) caused by the malicious call as;

Establish objective impact assessment scale set V, where V={1,2,3,4,5,6,7,8,9,10};

Analyze a large number of application samples, and calculate the percentage of the number of calls to each API event when the malicious application is running;

Define the quantified adverse impact of each API event invoked by a malicious application;

According to the percentage of the number of times the malicious application calls each API event at runtime, and the quantified adverse impact of each API event called by the malicious application, the probability M(E _i );

The probability M(E _i ) that each API event is called by an application program is called by a malicious application program, and the objective impact assessment scale set V is used to quantify the objective assessment impact I _O (E _i ) caused by malicious calls.

At the same time, the subjective impact weight calculation module calculates the weight H _j (E _i ) of the subjective assessment impact caused by malicious calls as:

The subjective evaluation impact I _S (E _i ) of the i-th API call event is normalized, and the normalized formula subjective evaluation factor p _ji is obtained:

Among them, i=1,2,...n;

Create a normalized scoring matrix Score':

Among them, score' _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th call API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n, and p _j1 +p _j2 +...p _jn = 1;

According to the normalized scoring matrix Score', the entropy method is used to calculate the weight H _i (E _i ) of subjective evaluation influence:

Wherein, 0≤H _i (E _i )≤1, i=1, 2,...n.

In summary, with the help of the above-mentioned technical solution of the present invention, the impact of malicious software is calculated by combining subjective and objective methods, and combined with the probability of malicious software to evaluate the risk loss of the application program, filling the current gap There is a vacancy in the field of Android application security assessment; at the same time, the information entropy theory is used to assess the security risk of the application, avoiding the one-sidedness and limitations caused by a single subjective and objective method.

Claims (8)

1. An Android application security risk assessment method, characterized in that, comprising: Under the Android system environment, call the Android application A to be evaluated, monitor and count all API events E called by the application A in operation, so that the total number of all API events called by the application A in operation is n; Specify each called API event E _i in turn, where i=1,2,...,n; For the currently specified API event E _i , calculate the probability L(E _i ) that the application program A invokes the API event E _i as a malicious call; For the currently specified API event E _i , calculate the impact I(E _i ) caused by the malicious call when the application program A invokes the API event E _i as a malicious call event; According to the probability L(E _i ) of the malicious call and the impact I(E _i ) caused by the malicious call, calculate the impact expectation R(E _i ) of the API event E _i called by the application program A, and continue Specify the next API event to be called; After all the API events E have been specified, sum the expected impact R(E _i ) of each called API event E _i to obtain the overall risk level R _A of the application program A, where R _A =∑ _i R(E _i )＝∑ _i L(E) _i ×I(E) _i ; Comparing the overall risk level RA of the application program _A with the risk threshold R ₀ to determine whether the security risk of the application program A is acceptable; Wherein, the calculation of the probability L(E _i ) that the application program A calls the API event E _i is a malicious call is: Among them, P(E _i |A is a malicious application) is the probability that a malicious application calls a sensitive API bad event E _i occurs, and P(A is a malicious application) is an application in all statistical applications is the probability of a malicious application, P(E _i ) is the probability of all applications calling a sensitive API bad event E _i . 2. a kind of Android application security risk assessment method according to claim 1, is characterized in that, when calculating described application program A to call this API event E _i is a malicious call event, the influence I( E _i ) is: Calculating the subjective evaluation impact I _S (E _i ) caused by the malicious call; Calculating the objective assessment impact I _O (E _i ) caused by the malicious call; Calculating the weight H _i (E _i ) of the subjective evaluation impact caused by the malicious call; According to the subjective evaluation impact I _S (E _i ) caused by the malicious call, the objective evaluation impact I _O (E _i ) caused by the malicious call, and the weight H _i (E _i ) of the subjective evaluation impact caused by the malicious call , calculate the impact I(E _i ) caused by the malicious call: I(E _i )＝H _i (E _i )×I _S (E _i )+W _i (E _i )×I _O (E _i ) Wherein, said W _i (E _i )=1-H _i (E _i ). 3. a kind of Android application program security risk assessment method according to claim 2, is characterized in that, calculates the subjective evaluation influence _IS (E _i ) that described malicious call causes is: Establish subjective impact assessment scale set U, where U={1,2,3,4,5,6,7,8,9,10}; All m subjective evaluators are required to sequentially select corresponding evaluation values from the elements of the subjective impact evaluation scale set U for all n call API events according to subjective experience, and perform scoring; Establish scoring matrix Score, and write described scoring in described scoring matrix Score as follows: Among them, score _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th calling API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n; According to the scoring matrix Score, the subjective evaluation impact I _S (E _i ) of the i-th calling API event is calculated as: <mrow><msub><mi>I</mi><mi>S</mi></msub><mrow><mo>(</mo><msub><mi>E</mi><mi>i</mi></msub><mo>)</mo></mrow><mo>=</mo><mfrac><mrow><msub><mi>score</mi><mrow><mn>1</mn><mi>i</mi></mrow></msub><mo>+</mo><msub><mi>score</mi><mrow><mn>2</mn><mi>i</mi></mrow></msub><mo>+</mo><mo>...</mo><msub><mi>score</mi><mrow><mi>m</mi><mi>i</mi></mrow></msub></mrow><mi>m</mi></mfrac></mrow> At the same time, the objective evaluation impact I _O (E _i ) caused by the malicious call is calculated as: Establish objective impact assessment scale set V, where V={1,2,3,4,5,6,7,8,9,10}; Analyze a large number of application samples, and calculate the percentage of the number of calls to each API event when the malicious application is running; Define the quantified adverse impact produced by each API event invoked by the malicious application; According to the percentage of the number of times that the malicious application calls each API event during operation, and the quantified adverse effect produced by the malicious application calling each API event, it is calculated that each API event is called by the malicious application as being called by the malicious application. The probability of calling M(E _i ); The probability M(E _i ) that each API event is called by the application program is called by the malicious application program, and the objective impact assessment scale set V is applied to quantify the objective assessment impact I _O (E _{i )} caused by the malicious call. ). 4. a kind of Android application program security risk assessment method according to claim 3, is characterized in that, calculates the weight H _j (E _i ) of the subjective evaluation influence that described malicious call causes: Perform normalization processing on the subjective evaluation impact I _S (E _i ) of the i-th calling API event, and obtain the normalization formula subjective evaluation factor p _ji : <mrow><msub><mi>p</mi><mrow><mi>j</mi><mi>i</mi></mrow></msub><mo>=</mo><mfrac><mrow><msub><mi>score</mi><mrow><mi>j</mi><mi>i</mi></mrow></msub></mrow><mrow><msub><mi>score</mi><mrow><mi>j</mi><mn>1</mn></mrow></msub><mo>+</mo><msub><mi>score</mi><mrow><mi>j</mi><mn>2</mn></mrow></msub><mo>+</mo><mn>...</mn><msub><mi>score</mi><mrow><mi>j</mi><mi>n</mi></mrow></msub></mrow></mfrac></mn>mrow> Among them, i=1,2,...n; Create a normalized scoring matrix Score': Among them, score' _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th call API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n, and p _j1 +p _j2 +...p _jn = 1; According to the normalized scoring matrix Score', the entropy method is used to calculate the weight H _i (E _i ) influenced by the subjective assessment: <mrow><msub><mi>H</mi><mi>i</mi></msub><mrow><mo>(</mo><msub><mi>E</mi><mi>i</mi></msub><mo>)</mo></mrow><mo>=</mo><mo>-</mo><mfrac><mn>1</mn><mrow><mi>ln</mi><mi></mi><mi>m</mi></mrow></mfrac><munderover><mo>&amp;Sigma;</mo><mrow><mi>j</mi><mo>=</mo><mn>1</mn></mrow><mi>m</mi></munderover><msub><mi>p</mi><mrow><mi>j</mi><mi>i</mi></mrow></msub><mi>ln</mi><mi></mi><msub><mi>p</mi><mrow><mi>j</mi><mi>i</mi></mrow></msub></mrow> Wherein, 0≤H _i (E _i )≤1, i=1, 2,...n. 5. An Android application security risk assessment device, characterized in that it comprises: The monitoring module, the monitoring module calls the Android application program A to be evaluated under the Android system environment, monitors and counts all API events E called by the application program A in operation, and makes the application program A call in operation The total number of all API events for is n; A call pointer, the call pointer specifies each called API event E _i in turn, where i=1, 2,...,n; A probability calculation module, the probability calculation module calculates the probability L(E _i ) that the application program A invokes the API event E _i as a malicious call for the currently specified API event E _i ; An impact calculation module, for the currently specified API event E _i , calculate the impact I(E _i ) caused by the malicious call when the API event E _i called by the application program A is a malicious call event ; Expectation assessment module, the expectation assessment module calculates the impact of the API event E _i called by the application program A according to the probability L(E _i ) of the malicious call and the impact I(E _i ) caused by the malicious call Expect R(E _i ), and continue to specify the next API event to be called; A summation module, after all API events E are specified, the summation module sums the impact expectation R(E _i ) of each called API event E _i to obtain the overall risk of the application program A Level R _A , where R _A =∑ _i R(E _i )=∑ _i L(E _i )×I(E _i ); A judging module, the judging module compares the overall risk level RA of the application program _A with the risk threshold _R0 , and judges whether the security risk of the application program A is acceptable; Wherein, the probability calculation module calculates the probability L(E _i ) that the application program A invokes the API event E _i as a malicious call as: Among them, P(E _i |A is a malicious application) is the probability that a malicious application calls a sensitive API bad event E _i occurs, and P(A is a malicious application) is an application in all statistical applications is the probability of a malicious application, P(E _i ) is the probability of all applications calling a sensitive API bad event E _i . 6. A kind of Android application program security risk evaluation device according to claim 5, it is characterized in that, described influence calculation module also comprises subjective influence calculation module, objective influence calculation module, and subjective evaluation influence weight calculation module, the When the impact calculation module calculates that the API event E _i called by the application program A is a malicious call event, the impact I(E _i ) caused by the malicious call is: The subjective impact calculation module is used to calculate the subjective assessment impact I _S (E _i ) caused by the malicious call; The objective impact calculation module is used to calculate the objective assessment impact I _O (E _i ) caused by the malicious call; The subjective impact weight calculation module is used to calculate the weight H _i (E _i ) of the subjective assessment impact caused by the malicious call; The impact calculation module is based on the subjective evaluation impact I _S (E _i ) caused by the malicious call, the objective evaluation impact I _O (E _i ) caused by the malicious call, and the weight H of the subjective evaluation impact caused by the malicious call. _i (E _i ), calculate the impact I(E _i ) caused by the malicious call: I(E _i )＝H _i (E _i )×I _S (E _i )+W _i (E _i )×I _O (E _i ) Wherein, said W _i (E _i )=1-H _i (E _i ). 7. A kind of Android application program security risk assessment device according to claim 6, is characterized in that, described subjective impact calculation module calculates the subjective evaluation impact _IS (E _i ) that described malicious call causes is: Establish subjective impact assessment scale set U, where U={1,2,3,4,5,6,7,8,9,10}; All m subjective evaluators are required to sequentially select corresponding evaluation values from the elements of the subjective impact evaluation scale set U for all n call API events according to subjective experience, and perform scoring; Establish scoring matrix Score, and write described scoring in described scoring matrix Score as follows: Among them, score _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th calling API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n; According to the scoring matrix Score, the subjective evaluation impact I _S (E _i ) of the i-th calling API event is calculated as: <mrow><msub><mi>I</mi><mi>S</mi></msub><mrow><mo>(</mo><msub><mi>E</mi><mi>i</mi></msub><mo>)</mo></mrow><mo>=</mo><mfrac><mrow><msub><mi>score</mi><mrow><mn>1</mn><mi>i</mi></mrow></msub><mo>+</mo><msub><mi>score</mi><mrow><mn>2</mn><mi>i</mi></mrow></msub><mo>+</mo><mo>...</mo><msub><mi>score</mi><mrow><mi>m</mi><mi>i</mi></mrow></msub></mrow><mi>m</mi></mfrac></mrow> Simultaneously, the objective evaluation impact I _O (E _i ) caused by the malicious call is calculated by the objective impact calculation module as: Establish objective impact assessment scale set V, where V={1,2,3,4,5,6,7,8,9,10}; Analyze a large number of application samples, and calculate the percentage of the number of calls to each API event when the malicious application is running; Define the quantified adverse impact produced by each API event invoked by the malicious application; According to the percentage of the number of times that the malicious application calls each API event during operation, and the quantified adverse effect produced by the malicious application calling each API event, it is calculated that each API event is called by the malicious application as being called by the malicious application. The probability of calling M(E _i ); The probability M(E _i ) that each API event is called by the application program is called by the malicious application program, and the objective impact assessment scale set V is applied to quantify the objective assessment impact I _O (E _{i )} caused by the malicious call. ). 8. A kind of Android application program security risk evaluation device according to claim 7, is characterized in that, the weight H _j (E _i ) of the subjective assessment influence that described malicious call is calculated by described subjective impact weight calculation module is: Perform normalization processing on the subjective evaluation impact I _S (E _i ) of the i-th calling API event, and obtain the normalization formula subjective evaluation factor p _ji : <mrow><msub><mi>p</mi><mrow><mi>j</mi><mi>i</mi></mrow></msub><mo>=</mo><mfrac><mrow><msub><mi>score</mi><mrow><mi>j</mi><mi>i</mi></mrow></msub></mrow><mrow><msub><mi>score</mi><mrow><mi>j</mi><mn>1</mn></mrow></msub><mo>+</mo><msub><mi>score</mi><mrow><mi>j</mi><mn>2</mn></mrow></msub><mo>+</mo><mo>...</mo><msub><mi>score</mi><mrow><mi>j</mi><mi>n</mi></mrow></msub></mrow></mfrac></mrow> Among them, i=1,2,...n; Create a normalized scoring matrix Score': Among them, score' _ji represents the subjective experience evaluation value of the j-th subjective evaluator on the i-th call API event, among which, 1≤score _ji ≤10, 1≤j≤m, 1≤i≤n, and p _j1 +p _j2 +...p _jn = 1; According to the normalized scoring matrix Score', the entropy method is used to calculate the weight H _i (E _i ) influenced by the subjective assessment: <mrow><msub><mi>H</mi><mi>i</mi></msub><mrow><mo>(</mo><msub><mi>E</mi><mi>i</mi></msub><mo>)</mo></mrow><mo>=</mo><mo>-</mo><mfrac><mn>1</mn><mrow><mi>ln</mi><mi></mi><mi>m</mi></mrow></mfrac><munderover><mo>&amp;Sigma;</mo><mrow><mi>j</mi><mo>=</mo><mn>1</mn></mrow><mi>m</mi></munderover><msub><mi>p</mi><mrow><mi>j</mi><mi>i</mi></mrow></msub><mi>ln</mi><mi></mi><msub><mi>p</mi><mrow><mi>j</mi><mi>i</mi></mrow></msub></mrow> Wherein, 0≤H _i (E _i )≤1, i=1, 2,...n.