Summary of the invention
It is an object of the invention to fill up at present to the blank of Android application program API Calls normalization detection, one is proposed
Code quality automatic Evaluation and Optimization of the kind based on Android API operating specification, this method can effectively help Android application program
Developer detects and optimizes the use of API, reduces the misuse of API, promotes Android application program code quality, and then improve peace
The security level of tall and erect application program.
To achieve the above object, the present invention adopts the following technical scheme:
A kind of automatic Evaluation and Optimization of code quality based on Android API operating specification, step include:
1) document structuring specifically dedicated resolver is summarized for the API in Android source code, the resolver is achievable all
API corresponds to the extraction and association of packet name, class name, method name and parameter information;
2) API removed API points based on Android API operating specification, recommend API, hiding tetra- class of API and normal API,
And establish API feature database;
3) automatically scanning evaluation engine is established, the type distribution that Android application program to be measured calls API is counted, positioning removes
API, the calling station for not recommending API and hiding API are based on API operating specification situation and API safety in utilization, propose code
Quality classification method assesses code quality;
4) the code quality optimisation strategy of automation is provided, code quality assessment report is generated, is opened for Android application program
Hair personnel reference.
Further, it when step 2) establishes API feature database, for removing API, not recommending API and hiding API, needs to search
Security breaches can be caused with the presence or absence of such as information leak (deriving from American National vulnerability scan) in API annotation
Keyword identification, think that the API will affect code security if finding, in feature database be its add security implication mark
Will prompts user to pay special attention to.
Further, when establishing API feature database, for removing API, its shifting need to be differentiated according to the version that API summarizes document
Except starting version number.
Further, when establishing API feature database, for not recommending API, it need to further extract in source code annotation and not recommend
Reason and Optimizing Suggestions are not recommended by starting version number.
Further, each API record in API feature database includes following information: packet name, class name, method name, parameter
Information, it is whether normal, whether remove, whether do not recommend, whether hiding, whether safety, remove starting version number, do not recommend to originate
Reason and Optimizing Suggestions are not recommended by version number.
Further, step 3) carries out dis-assembling to Android application program to be measured using static disassembly analytical technology, from
Dynamic scanning show that it calls the distribution of the type of API;Step 3) the static disassembly analytical technology uses one in following tool
Kind or a variety of pairs of Android application programs carry out dis-assemblings: apktool, dex2jar, Android Multitool and QARK etc..
Further, step 3) the code quality ranking method comprehensively considers abnormal API and (removes API, do not recommend
API, API is hidden) proportion and weight, code quality score is calculated, between 0.0-10.0, numerical value is bigger, says
Bright code quality is poorer, and 0.0-3.5 is set as low danger rank, and 3.6-7.0 is set as middle danger rank, and 7.1-10.0 is set as high-risk grade
Not.
Further, the content of step 4) the code quality assessment report includes: the type of 1) routine call API to be measured
Distribution;2) Android application program code quality rating result to be measured;3) every API for belonging to removal API of routine call to be measured
Packet name, class name, method name, remove starting version number and specific calling station;4) belonging to for routine call to be measured does not recommend API
The packet name of every API, class name, method name, do not recommend to originate version number, Optimizing Suggestions and specific calling station;5) to ranging
Packet name, class name, method name and the specific calling station for every API for belonging to hiding API that sequence is called.
The present invention proposes a kind of automatic Evaluation and Optimization of code quality based on Android API operating specification.Pass through parsing
Android official website API operating specification, classifies to API, establishes API feature database;On this basis, program tune to be measured is scanned
With the distribution of API, assesses application code quality and propose prioritization scheme.The present invention is to investigate Android application program to call
The standardized degree of API establishes complete automatic detection evaluation system, and the code quality optimisation strategy for providing automation supplies
Android application program developer reference can effectively reduce the improper use and misuse of API, and then it is whole to promote Android application program
The code quality of body.
Specific embodiment
With reference to the accompanying drawing, by embodiment, the present invention is further illustrated.
The automatic Evaluation and Optimization of code quality based on Android API operating specification of the present embodiment, overall procedure is such as
Shown in Fig. 1, each processing module is as shown in Fig. 2, this method mainly comprises the steps that
1) document structuring specifically dedicated resolver is summarized for the API in Android source code, establishes syntactic analysis tree, passes through
PID Packet Identifier, class identifier and method identifier can be with packet name, class name and the method names of each API of effective position, and then position
The number of parameters and type of method complete extraction and association that all API correspond to packet name, class name, method name and parameter information.
2) Android sound code file is searched according to parsing result, positions the realization position of each API, and to its comment section into
Row text mining, extraction are related to the keyword of API operating specification.By API point to remove API, do not recommend API, hide API and just
Tetra- class of normal API, establishes API feature database.For removing API, not recommending API and hiding API, need to further judge in source code annotation
The keyword for whether containing the code safety that has an impact adds security implication mark for the API in feature database if containing to mention
Show that user pays special attention to.
Specifically, classified based on Android API operating specification to API, establish step process such as Fig. 3 of API feature database
It is shown, it is described as follows:
Document parsing result 2a) is summarized according to the API in 1), the specific implementation position of position location API in Android source code is drawn
Divide the realization of its function body and code annotation part, go to 2b).
Text mining 2b) is carried out to comment section, keyword relevant to API operating specification is extracted, goes to 2c).
2c) according to key characteristics, by API points to remove API, not recommending API, hiding tetra- class of API and normal API, turn
To 2d)
2d) judge whether each API is normal API, if so, going to 2j), directly item is created for it in the database
Mesh;If it is not, then going to 2e).
It 2e) is categorized further, as improper API to remove API, do not recommend API and hiding API, and mark in the database
Know, go to 2f).
Each 2f) is searched to remove API, do not recommend in the source code of API and hiding API annotation with the presence or absence of such as
Information leak (deriving from American National vulnerability scan) etc. can cause the keyword identification of security breaches, if it exists
Then think that the API will lead to application code there are potential safety problem, go to 2g);If nothing goes to 2h).
Security implication mark 2g) is added for the API, reminds user to add to pay close attention to, goes to 2h).
2h) judge whether the API is not recommend API, if so, going to 2i), further extract relevant information;If it is not, then
Go to 2j).
It 2i) is extracted in API source code annotation and does not recommend not recommending to originate version number, reason and optimization not being recommended to build for API
View etc., goes to 2j).
2j) the information sorted out according to above-mentioned steps creates API feature database.Each API record in API feature database
Including following information: packet name, class name, method name, parameter information, it is whether normal, whether remove, whether do not recommend, whether hiding,
Whether safe, removal starting version number does not recommend to originate version number, does not recommend reason and Optimizing Suggestions.
3) automatically scanning evaluation engine is established, the code quality of Android application program to be measured is assessed.Use static analysis skill
Art carries out dis-assembling to Android application program to be measured, and automatically scanning show that it calls the distribution of the type of API, and positions and wherein remove
API, the specific calling station for not recommending API propose code quality ranking method, assess code quality;
Specifically, automatically scanning evaluation engine assesses the step process of program code quality to be measured as shown in figure 4, specific
It is described as follows:
3a) tools such as apktool, dex2jar, Android Multitool and QARK to Android application program to be measured into
Row dis-assembling obtains .dex file, goes to 3b).
.dex file 3b) is parsed, Study document head obtains the deviant of each class, and then navigates to class block, and analysis is each
The each method and its calling station and physical storage address that class includes, go to 3c).
The type of all API called in Android application program to be measured 3c) is analyzed, statistics removes API, do not recommend API, is hidden
API and normal API percentage are hidden, 3d is gone to).
3d) judge whether to contain in all API of Android application program calling to be measured and removes API, do not recommend API and hide
API, if so, then going to 3e);If nothing goes to 3f).
It 3e) scans the removal API of Android application program calling to be measured, recommend the specific invocation bit of API and hiding API
It sets, facilitates Android application program developer to position, go to 3f).
The API type distribution that Android application program to be measured is called 3f) is counted, the removal API of calling is checked, does not recommend API
Whether there is safety issue with hiding API, be based on API operating specification situation and API safety in utilization, proposes that code quality is commented
Grade method, assesses code quality.
Code quality ranking method proposed by the present invention comprehensively considers abnormal API proportion and weight, is calculated
Code quality score, between 0.0-10.0, numerical value is bigger, illustrates that code quality is poorer, and 0.0-3.5 is set as low danger grade
Not, 3.6-7.0 is set as middle danger rank, and 7.1-10.0 is set as high-risk rank.Circular is as follows: by Android application journey to be measured
The API type distribution that sequence is called, it is known that the normal API number of calling is L, and removing API number is M, and not recommending API number is N,
Hiding API number is O.According to abnormal API to the risk setting ratio value of program, normal API: removes API: not recommending
API: API=1:4:3:2 is hidden.The then calculation formula of code quality Q are as follows:
Wherein, in order to highlight potential danger brought by safety-related abnormal API, it is abnormal to promote every one kind
The weight of safety-related API is 2 in API.Assuming that removing security-related having in API, A is a, and unrelated with safety has B, then
M in above formula is replaced withSimilarly, API is not recommended to do similar replacement with hiding API yet.
4) Optimizing Suggestions are extracted from API feature database, the code quality optimisation strategy of automation is provided and generates code matter
Assessment report is measured, is referred to for Android application program developer.Code quality assessment report content includes:
4a) Android application program to be measured calls the type distribution of API.
4b) Android application program code quality rating result to be measured.
What 4c) Android application program to be measured was called belongs to packet name, class name, the method name, removal for removing every API of API
Originate version number and specific calling station.
The packet name for not recommending every API of API that 4d) Android application program to be measured was called belong to, class name, method name, no
Recommend starting version number, Optimizing Suggestions and specific calling station.
4e) the packet name for every API for belonging to hiding API that Android application program to be measured is called, class name, method name and specific
Calling station.
A specific application example is provided below, implementation step includes:
1) API in the specific dedicated resolver parsing Android source code of construction summarizes document.For
Android.app.Activity Manager.setWatchHeapLimit (long) method, obtained syntactic analysis tree is as schemed
Shown in 5.It can be in packet name, class name and the method for each API of effective position by PID Packet Identifier, class identifier and method identifier
Name, and then the number of parameters and type of localization method, and it is associated with correspondence.
2) API feature database is established, is classified based on Android API operating specification to API.Table 1 is android.app.Act
IvityManager.getRunningTasks (int) method and android.database.sqlite.SQLiteProgram
.native_bind_long Logic Structure Design of (int long) method in API feature database.Whether whether " normal " " move
Except ", the flag bit of " whether not recommending " and " whether hiding " embody API classification." whether safe " flag bit shows if 0
The API may will affect code safety.
Table 1.API feature database Logic Structure Design
One section of English in upper table, which is translated into Chinese, is: from LOLLIPOP version, because this method may let out personal information
Reveal to called side, the unusable this method of third-party application.For back compatible, this method returns to called side itself mission bit stream,
With other insensitive mission bit streams.
3) automatically scanning evaluation engine is established, the code quality of program to be measured is assessed.Assuming that in Android application program to be measured
The all types of API called are as shown in table 2.Data are illustrative only in table.
The all types of API numbers called in the Android application program to be measured of table 2
According to code quality ranking method proposed by the present invention, the code quality of the Android application program to be measured is calculated
Rating score Q are as follows:
Belong to middle danger rank.
Further positioning removes API, does not recommend the calling station of API and hiding API in the application, if do not recommended AP
I:android.app.ActivityManager.getRunningTasks (int), specific calling station are as follows:
Lcom/wbtech/ums/common/CommonUtil;->getPackageName(Landroid/
content/Context;)Ljava/lang/String;
Lcom/fengjr/mobile/act/Base;->getActivityCountInTask()I
Lcom/fengjr/mobile/util/d;->e()Z
Lcom/wbtech/ums/common/CommonUtil;->getActivityName(Landroid/
content/Context;)Ljava/lang/String;
Lcom/fengjr/mobile/receiver/MipushMessageReceiver;->
isAppRunningForeground(Landroid/content/Context;)Z
Lcom/fengjr/mobile/receiver/JPushReceiver;->a(Landroid/content/
Context;)Z
Lcom/fengjr/mobile/act/Base;->isAppRunningForeground(Landroid/
content/Context;)Z
4) the code quality optimisation strategy of automation is provided.Such as not being recommended to use API:Landroid/net/
Connecti vityManager;-> getNetworkInfo (I), the optimisation strategy provided are as follows:
This method was deprecated in API level 23.This method does not
support multiple connected networks of the same type.Use getAllNetworks()and
getNetworkInfo(android.ne t.Network)instead.
Chinese corresponding to one section of English above are as follows: this method is classified as not being recommended to use API in API Quality 23.The party
Method does not support the network connection of multiple same types, please use getAllNetworks () and getNetworkInfo
(android.net.Net work) substitution.
For not being recommended to use API:Landroid/speech/tts/TextToSpeech;->getFeatures
(Ljava/util/Locale;), following Optimizing Suggestions are provided:
This method was deprecated in API level 21.As of API level 21,please
use voices.In order to query features of the voice,call getVoices()to
retrieve the list of available vo ices and getFeatures()to retrieve the set
of features.
Chinese corresponding to one section of English above are as follows: this method is classified as not being recommended to use API in API Quality 21, asks
Use voices.Sound characteristic to be inquired please call getVoices () to retrieve available sounds list, and call
GetFeatures () retrieves sound characteristic set.
Generate code quality assessment report.Content includes the type distribution of routine call API to be measured, removes API, do not recommend
The relevant information of A PI and hiding API, specific calling station and Optimizing Suggestions etc., for Android application program developer reference
And carry out follow-up decision processing.
The above examples are only used to illustrate the technical scheme of the present invention and are not intended to limit it, the ordinary skill of this field
Personnel can be with modification or equivalent replacement of the technical solution of the present invention are made, without departing from the spirit and scope of the present invention, this
The protection scope of invention should subject to the claims.