CN105550584A - RBAC based malicious program interception and processing method in Android platform - Google Patents

Abstract

The invention discloses an RBAC based malicious program interception and processing method in an Android platform, and belongs to the technical field of mobile security. For the technical field of existing mobile security, privacy data of a user have a leakage risk and a current malicious program detection method has problems to be solved, so that an RBAC based malicious program interception method is proposed. When an application accesses to the privacy data of the user, whether related operations are permitted or not is determined according to a role that the application belongs to and permission information corresponding to the application by querying an RBAC policy library, so that the privacy security of the user is ensured.

Description

A malicious program interception and disposal method based on RBAC under the Android platform

technical field

The invention belongs to the technical field of mobile security, and in particular relates to an RBAC-based malicious program interception and processing method under an Android platform.

Background technique

With the rapid development of the Android system and smart phones, Android applications show explosive growth. Followed by the security problems of the Android system, malicious attacks on mobile terminals by malicious applications, and the theft of user privacy information are becoming more and more serious. Due to the lax supervision of the Android third-party application market, many normal applications are embedded with malicious codes that steal user privacy and are repackaged and uploaded to the Android market. In many cases, antivirus software cannot intercept malicious requests from similar applications. The current mainstream malicious program detection methods are divided into static detection and dynamic detection. Static detection is highly dependent on the malicious code base. When a new type of malicious program appears, it is often unable to accurately identify malicious behavior. The rate needs to be improved; dynamic detection methods include MonkeyRunner, DroidBox, TaintDroid, Hips, etc., which are characterized by a small dependence on the code feature library, and judge whether it is malware by capturing real malicious behavior during operation, and there are malicious programs at the same time Risk of bypassing system detection. For example, for the traditional HIPS program detection method, APIHOOK is implemented by injecting .so and .jar files in the user state. If a malicious application implements APIHOOK in this way, it will bypass the detection of the HIPS system and give users privacy to a certain extent. Security poses a threat.

In view of the above problems, the present invention proposes a malicious program interception and disposal method based on RBAC under the Android platform. By dynamically inserting the LinuxHook kernel module, the monitoring of malicious behaviors such as reading user privacy by the application program at the kernel layer is realized. Because the application program It is impossible to modify the AndroidLinux kernel source code, thus avoiding malicious applications from bypassing system detection. At the same time, the present invention is aimed at monitoring specific malicious behaviors of application programs, avoids dependence on malicious program code bases, and improves detection efficiency and accuracy. When an application program accesses user privacy data, the present invention provides user-related system prompts by defining RBAC access control policies, and users can choose independently based on the system prompts, thereby protecting user privacy and security.

Contents of the invention

The present invention proposes a malicious program interception and disposal method based on RBAC under the Android platform, which is characterized in that it includes a malicious behavior detection module, a kernel message feedback module, an interception prompt module and an RBAC-based interception module, and the steps are as follows:

Step 1: The malicious behavior detection module realizes the kernel layer monitoring of the behavior of reading user privacy data by the application program by dynamically inserting the kernel module used for Hook in the AndroidLinux system, and provides a message source for the kernel message feedback module;

Step 2: The kernel message feedback module realizes the message communication between the kernel layer and the user layer through netlinksocket. Netlinksocket adopts a full-duplex and asynchronous communication mode, so that when the Hook function in the kernel state intercepts the information of the malicious program, it is sent to the program in the user state To process, and send the processing result to the kernel mode, the Linux kernel decides whether to allow the relevant operation of the program according to the information; through the kernel message feedback module, the application program behavior record collected by the malicious behavior detection module is passed to the interception prompt module;

Step 3: The interception prompt module is used to give the user fine-grained prompts according to the feedback result of the RBAC-based interception module after receiving the message from the kernel layer;

Step 4: The RBAC-based interception module obtains the role of the current application and its corresponding permission information by querying the RBAC policy library, and feeds back the query result to the interception prompt module, and the interception module gives the user fine-grained prompts based on the result; According to the query results of the RBAC policy library; users can choose independently. If the user does not choose, the system will determine whether to allow the corresponding request of the application according to the query results of the RBAC policy library by default.

Furthermore, the RBAC policy library can also be dynamically updated, specifically: when the application is installed and running for the first time, a corresponding role is assigned to it based on its basic functions. This role only has the minimum permission set to complete the basic functions of the application. When the application requests For permissions other than the minimum permission set, the interception prompt module will give the user relevant security prompts. When the user explicitly chooses to grant this permission to the application, adjust the RBAC policy library by setting a new role, that is, setting the new role to have the user permission permissions other than the minimum permissions.

By dynamically inserting the LinuxHook kernel module, the real-time monitoring of malicious behaviors such as reading user privacy by the application program at the kernel layer is realized; the malicious behavior of the application program captured by the kernel layer in the Android architecture is fed back to the application layer by using netlinksocket technology, and the inserted kernel module Send malicious behavior information and receive feedback from the application layer through the socket, because it is deployed at the kernel layer to protect the process from the interference of malicious applications; in the application layer of the Android architecture, the idea of RBAC is introduced, by setting the RBAC policy library , and assign corresponding permissions to the application according to the role it belongs to, which can realize the minimum authorization for malicious applications. At the same time, users are allowed to make corresponding choices about the behavior of the application to read user privacy data according to the prompts of the RBAC policy library, instead of allowing or prohibiting all behaviors of the application, which balances the user experience while protecting user privacy and security. .

The present invention can avoid the problem that the traditional application program will obtain all the permissions applied for after it is installed. After the user clicks to agree to give the application program the application permission, it will monitor through the kernel state, and when the application actually runs specific permissions, through Setting the RBAC policy to intercept the permission application of the application for the second time can truly achieve the purpose of protecting user privacy. In addition, when constructing the RBAC policy library, the present invention further constrains and regulates the roles, permissions, assignment relationships, and mutually exclusive roles in the Android application scenario according to the characteristics of the current Android application. The setting of the RBAC policy fully reflects the Three security principles of minimal authorization, separation of duties, and data abstraction.

Compared with the prior art, the present invention has the following advantages:

At present, mainstream malicious program detection methods are divided into static detection and dynamic monitoring. The main methods of static detection include: analysis of application signature information, reverse analysis of APK source code, and malicious code library matching. Static detection relies heavily on malicious code libraries, and the detection rate and accuracy of malicious programs need to be improved. Dynamic detection is expected to trigger the malicious behavior in the application program by actually running it, so as to achieve the purpose of malicious program detection. The mainstream dynamic detection methods include: MonkeyRunner, DroidBox, TaintDroid, HIPS, etc., which are characterized by a small dependence on the code feature library, and judge whether it is malware by capturing real malicious behavior during operation, and there are malicious programs to bypass Risk of system detection. For example, HIPS does not need to modify the AndroidLinux kernel. It implements the Hook of the target API by injecting .so and Jar files in the user mode, thereby intercepting the related operations of the application. Since it implements APIhook by injecting so files, the application itself can also implement APIhook in this way. Therefore, if the developer of the malicious program implements APIHook, it will bypass the system detection of HIPS, which poses a threat to the user's privacy and security to a certain extent.

This method adopts LinuxHook technology, has realized the malicious behavior of monitoring application program at the kernel layer by dynamically inserting the kernel module, because this method detects the malicious behavior of the application program at the kernel layer, and the application program cannot modify the kernel layer function call, so Avoiding the risk of malicious programs bypassing traditional HIPS system detection; at the same time, this method assigns corresponding roles to applications based on RBAC access control technology, and at the same time assigns corresponding roles the minimum permission combination that can complete their own tasks. According to RBAC strategy library to give user relevant hints. For example, when a map application reads the user's location information, the system pops up a warning box to prompt the user, and the behavior is allowed by default if the user has no choice; when an audio-visual entertainment application reads the user's address book information, the system pops up a warning box And this behavior is blocked by default, so as to better meet the needs of users on the basis of allowing users to choose independently, and at the same time protect the privacy and security of users. The method proposed by the present invention can avoid the problem that all the permissions applied for by the traditional APP will be obtained after the installation. After the user clicks to agree to grant the permissions applied for by the APP, by monitoring the application when it is running, the actual use of the application will be specific. Before permission, set the RBAC policy to do a second interception of APP permission application, which can truly achieve the purpose of protecting user privacy.

The method proposed by the invention monitors the operation of application programs at the kernel layer of Android Linux, which can reduce the risk of malicious application programs bypassing system detection, avoid the detection mechanism of the traditional HIPS method being bypassed, and have better security and reliability.

When the method proposed by the present invention constructs the RBAC policy library, according to the characteristics of the current Android application program, further constraints and specifications are made on the roles, permissions, assignment relationships, and mutually exclusive roles in the Android application scene, and the setting of the RBAC policy is fully reflected. The three security principles of minimum authorization, separation of duties, and data abstraction are established, and the dynamic adjustment of the RBAC policy library is supported, and the balance between user privacy security and user experience is supported.

Description of drawings

Fig. 1 Architecture design of malicious program interception based on RBAC;

Figure 2 RBAC-based malicious program interception process;

Figure 3 RBAC-based malicious program interception accuracy;

detailed description

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

FIG. 1 is an architecture diagram of the RBAC-based malicious program interception described in the present invention. According to the Android system architecture, the Android system is divided into two parts, the user space and the kernel space. This figure describes how the kernel layer and the application layer implement malicious behaviors against the application program after the application program is installed on the Android mobile device when the application program is executed. Specifically, RBAC-based malicious program interception includes the following four modules: malicious behavior detection module, kernel message feedback module, interception prompt module, and RBAC-based interception module.

Among them, the malicious behavior detection module is deployed in the AndroidLinux kernel layer. It realizes the monitoring of the malicious behavior of the application through the inserted LinuxHook module. to the intercept prompt module. The kernel message feedback module is deployed between the application layer and the kernel layer, and is a communication bridge between the two. This module is responsible for transferring the information collected by the malicious behavior detection module to the interception prompt module for further processing.

The interception prompt module is deployed at the JNI layer. When it receives a message from the kernel message feedback module, it will be presented in front of the user in the form of a dialog box. With the help of the query result of the RBAC-based interception module, relevant prompts will be given to the user. Based on the RBAC interception module, by analyzing the security permissions that are easy to leak user privacy and the three famous security principles of RBAC, the RBAC policy library is formulated, and the roles and corresponding permission information of Android applications are strictly limited. When the application accesses user-related privacy data, it will feed back the query results of the RBAC policy library to the interception prompt module.

Figure 2 is a flowchart of malicious program interception based on RBAC, including the following steps:

Step 1: Install the application program to be tested on the Android system into which the kernel module for Hook has been inserted, and run the application program.

Step 2: During the running of the application, the behavior of accessing the user's private data will be involved, such as reading the user's address book and other behaviors.

Step 3: According to step 2, query the system RBAC policy library to obtain the role information of the current application.

Step 4: Determine the permission information of the corresponding role of the application program. For example, if an application program requests to access the user's address book, the role that the application program belongs to is a communication role, and the access permission of the role corresponding to the address book is "1" (" 1" means it has the corresponding authority, "0" means it does not have the corresponding authority), and the query result is fed back to the next step.

Step 5: According to the query result, a prompt dialog box will pop up to give relevant prompts to the user.

Step 6: The user makes a choice according to the system prompts, and decides whether to allow the relevant operations of the application according to the user's choice. If the user does not choose, it will decide whether to allow the relevant operations of the application according to the query results of the RBAC policy library by default.

Step 7: Feedback the user's selection result to the Android kernel layer, and decide whether to allow the application program to request the corresponding resource.

Figure 3 is a comparison chart of the interception accuracy of malicious programs based on RBAC. The horizontal axis in the figure represents the permission information corresponding to the Android system, A-G represents location information access, communication record access, address book reading, SMS record reading, sending text messages, email information reading, and connecting to the network in turn, and the vertical axis represents the system’s application The number of interception times when the program accesses the user's privacy behavior. The present invention is compared with the traditional HIPS, and experiments show that when a malicious application program accesses a user's privacy record, the present method has a higher system interception rate.

The method proposed by the present invention consists of four modules: malicious behavior detection, kernel message feedback, interception prompt and RBAC-based interception, as shown in FIG. 1 .

Among them, the malicious behavior detection module is deployed at the AndroidLinux kernel layer, which is used to monitor the malicious behavior of the application program reading user privacy data at the kernel layer, and provides a message source for the kernel message feedback module. The kernel message feedback module uses the netlinksocket technology to realize the communication between the malicious behavior detection module and the interception prompt module. This module can transfer the malicious behavior of the application program discovered by the malicious behavior detection module to the interception prompt module for further processing. The interception prompt module is deployed in the user space. When the malicious behavior of the detected application is received from the malicious behavior detection module, it will give the user relevant prompts in the form of a dialog box based on the feedback result of the RBAC-based interception module. The RBAC-based interception module queries the RBAC policy library. When an application requests access to the user's private data, it will decide whether to allow the relevant operations of the application according to the role to which the application belongs and its corresponding permission information. At the same time, it will query The result is returned to the interception prompt module.

The malicious behavior detection module is responsible for monitoring and recording the malicious behavior of reading user privacy data by the monitoring application program at the kernel layer, and at the same time providing the message source for the kernel message feedback module. The steps are as follows:

1. The application program at the application layer requests access to the user's private data, and calls related functions to initiate a system call request;

2. The system function executes the int0x80 soft interrupt instruction. The execution of this instruction will cause the system to jump to a preset kernel control address, so that the program enters the kernel state of the operating system;

3. revise the pointer address in the system call table, make it point to the self-defined function of the present invention, for example revise sys_call_table[__NR_open], make it point to our_sys_open () function;

4. Find the specified function according to sys_call_table[__NR_open]. At this time, the system will first call the our_sys_open() function defined by the present invention, which will record information such as the process id of the application program and the type of file read, thereby recording the application program to steal the user Malicious privacy behavior, after recording, turn to the original system call function of sys_call_table[__NR_open];

5. Call the sys_open() function, and return the call result to the system call, and finally return the relevant information to the user-level application.

The kernel message feedback module is responsible for passing the malicious behavior of the application program found by the malicious behavior detection module to the interception prompt module for further processing, and realizes the message communication between the kernel layer and the application layer through netlinksocket. The specific steps are as follows:

1. The kernel mode program initializes the netlinksocket connection through the function netlink_kernel_create();

2. The user mode program creates a user mode socket through the socket() function, and specifies the address domain and protocol type of the user mode socket. In order to establish a communication connection with the kernel state program, the present invention specifies that the kernel state program and the user state program use the same protocol type;

3. The user state program realizes the correlation between the source socket address and the open socket address through the bind() function. Among its parameters, s_nladdr represents the address structure of netlink, and nl_pid represents the PID of the current process of netlinksocket, which is used as the local address of the current netlinksocket. Invented to obtain the current process id value through the getpid() function;

4. The user mode program sends a message from the user mode to the kernel mode through the function sendmsg(fd,&msg,0), sends its own address, process ID and other fields to the kernel mode program, and informs the kernel mode program of its own process ID;

5. The kernel mode program will monitor the malicious behavior of the application program to read the user's privacy record, and send a message to the designated location according to the process id and address sent from the user mode;

6. The user state program receives the message from the kernel through the function recvmsg(fd,&msg,0), and transmits the application program behavior record collected by the malicious behavior detection module to the interception prompt module for further operation.

The interception prompt module is responsible for giving relevant prompts for user applications to read user privacy data in the form of a graphical interface. It obtains relevant behavior information of application programs based on the kernel message feedback module. The specific steps are as follows:

1. Use the JAVAH command to generate the corresponding header file for the method callHelloFromJava() modified with the native keyword in the JAVA program. This method is declared in the JAVA program and implemented in the C program. It is used to initialize the netlinksocket communication of the user layer and receive the kernel Application malicious behavior information sent by the layer;

2. Save the generated com_example_testjni_MainActivity.h header file in the jni directory of the project, and use it in the Hello.c program to implement the callHelloFromJava() method declared in the Java class;

3. Introduce the com_example_testjni_MainActivity.h header file, and implement the Java_com_exaple_testjni_MainActivity_callHelloFromJava(JNIEnv*env, jobjectobj) method in the Hello.c file. This method is used to initialize the netlinksocket connection in the user mode, and is responsible for establishing a communication connection with the socket in the kernel mode. Information such as process ID and communication protocol type is sent to the kernel mode process;

4. When the user state socket receives a message from the kernel state socket, it will call the popWindow(Stringparam) method, which is used to pop up a prompt dialog box, and present the malicious behavior of the application program reading the user's private information in front of the user in real time ;

5. According to the user's choice, through the socket connection of the user state, the message is fed back to the socket of the kernel state for further processing.

The RBAC-based interception module is responsible for deciding whether to allow the application to perform relevant operations according to the role of the application and its assigned permissions, and returns the query result to the interception prompt module, as follows:

The present invention classifies common application programs in the Android market, defines roles by category, and records the role set R={R ₁ , R ₂ ,...,R _n }. For example, six roles R ₁ , R ₂ , R ₃ , R ₄ , R ₅ , and R ₆ can be defined according to the daily functions of existing Android applications, where R ₁ represents audio-visual, R ₂ represents map, and R ₃ represents Communication category, R ₄ stands for payment category, R ₅ stands for shopping category, R ₆ stands for game category. In addition, by analyzing common malicious application samples in the Android market, we can obtain the combination of permissions that are easy to leak user privacy. For example, if the two permissions of INTERNET and READ_CONTACTS are combined by malicious applications, the privacy information of the user's address book will be leaked. In the present invention, the set of permissions that may leak privacy after combination is P={P ₁ , P ₂ ,...,P _n }, based on the analysis of the existing combination of permissions, P ₁ =ACCESS_COARSE_LOCATION, P ₂ =ACCESS_FINE_LOCATION, _P3 = _{WRITE_SMS} , P4 = WRITE_OWNER_DATA, _P5 = WRITE_CONTACTS, P6 = _{SEND_SMS} , P7 = RECORD_AUDIO, _P8 = RECEIVE_SMS, P9 = _{RECEIVE_MMS} , P10 = _{READ_PHONE_SMS} , _PCT11 = _{READ_OWNER_DATA} = _{AD_S} , P1 _P13 = PROCESS_OUTGOING_CALLS, P14 = INTERNET, P15 = _{CHANGE_WIFI_STATE} , P16 = _{CHANGE_NETWORK_STATE} , P17 = _{CALL_PHONE} , _P18 = BROADCAST_SMS, _P19 = _{ACCESS_WIFI_STATE} , _P20 = ACCESS_NETWORK_STATE.

The present invention uses the predicate G(R _m , P _n ) to represent the assignment relationship between the role R _m and the authority P _n , wherein G(R _m , P _n )=1 means that the role R _m has the authority P _n ; G(R _m ,P _n )=0 means that role R _m does not have permission P _n . In order to protect the user's privacy, the present invention assigns the minimum set of permissions required by the corresponding role to realize basic functions. For example, the basic functions of communication applications are to add contacts, send instant messages, send short messages, etc., so the minimum permission set for basic functions is {SEND_SMS, RECEIVE_SMS, READ_PHONE_SMS, READ_CONTACTS, INTERNET, CALL_PHONE}. Specifically, for the above 6 types of common Android applications and 20 permissions that may leak privacy after combination, the role permission assignment relationship is shown in Table 1:

Table 1 Role and authority assignment relationship table

In order to realize the separation of duties, the present invention uses the predicate W(R _i , R _j ) to represent the mutually exclusive role relationship, wherein an application cannot be assigned two mutually exclusive roles at the same time, for example, W(R _i , R _j )=1 means Roles R _i and R _j are not mutually exclusive roles, the application can have the permissions assigned by roles R _i and R _j at the same time, W(R _i , R _j )=0 means that roles R _i and R _j are two mutually exclusive roles , the application cannot have the assigned permissions of roles R _i and R _j at the same time. Specifically, for the above 6 roles, the role mutual exclusion relationship can be shown in Table 2. For example, the communication role includes permissions {SEND_SMS, RECEIVE_SMS, READ_PHONE_SMS, READ_CONTACTS, INTERNET, CALL_PHONE}, and the payment role includes permissions {INTERNET, ACCESS_WIFI_STATE }, when an application belonging to a payment role is assigned a communication role, it has the ability to access the user's address book and upload it to the server, which poses a threat to the privacy of the user. Therefore, the present invention combines communication roles and payment Class roles are defined as mutually exclusive roles, that is, when an application has a payment class role, it cannot be assigned a communication class role.

Table 2 Mutually exclusive role relationship definition table

In order to balance user experience, the present invention supports dynamic updating of the RBAC policy library. When the application is installed and running for the first time, it is assigned a corresponding role based on its basic functions, and this role only has the minimum set of permissions to complete the basic functions of the application, as shown in Table 1. When an application program requests permissions other than its minimum permission set, the interception prompt module proposed by the present invention will give a user-related security prompt, and when the user explicitly chooses to grant this permission to the application program, the RBAC policy library is adjusted by setting a new role , that is, to set the new role to have other permissions than the minimum permissions allowed by the user. In this way, when the same application program requests the permission again during operation, the RBAC-based interception module proposed by the present invention judges whether to allow or deny the relevant operations of the application program according to the adjusted RBAC policy library, so as to avoid repeatedly popping up dialog boxes and affecting the user experience .

Claims (2)

1. a malicious program interception and disposal method based on RBAC under an Android platform, is characterized in that, comprises malicious behavior detection module, kernel message feedback module, interception prompt module and interception module based on RBAC, and step is as follows: Step 1: The malicious behavior detection module realizes the kernel layer monitoring of the behavior of reading user privacy data by the application program by dynamically inserting the kernel module used for Hook in the AndroidLinux system, and provides a message source for the kernel message feedback module; Step 2: The kernel message feedback module realizes the message communication between the kernel layer and the user layer through netlinksocket. Netlinksocket adopts a full-duplex and asynchronous communication mode, so that when the Hook function in the kernel state intercepts the information of the malicious program, it is sent to the program in the user state To process, and send the processing result to the kernel mode, the Linux kernel decides whether to allow the relevant operation of the program according to the information; through the kernel message feedback module, the application program behavior record collected by the malicious behavior detection module is passed to the interception prompt module; Step 3: The interception prompt module is used to give the user fine-grained prompts according to the feedback result of the RBAC-based interception module after receiving the message from the kernel layer; Step 4: The RBAC-based interception module obtains the role of the current application and its corresponding permission information by querying the RBAC policy library, and feeds back the query result to the interception prompt module, and the interception module gives the user fine-grained prompts based on the result; According to the query results of the RBAC policy library; users can choose independently. If the user does not choose, the system will determine whether to allow the corresponding request of the application according to the query results of the RBAC policy library by default. 2. The method according to claim 1, characterized in that the RBAC policy library can also be dynamically updated, specifically: when the application is installed and running for the first time, a corresponding role is assigned to it based on its basic functions, and the role only has the ability to complete the application. The minimum permission set for the basic functions of the program. When the application requests permissions other than its minimum permission set, the interception prompt module will give the user relevant security prompts. When the user explicitly chooses to grant the application this permission, by setting a new role Adjust the RBAC policy library, that is, set the new role to have other permissions than the minimum permissions allowed by the user.