WO2015067170A1 - Method and system for analyzing android application program - Google Patents

Abstract

Disclosed are a method and device for analyzing an Android application program. The method comprises the following step: performing static analysis before operation, and the step comprises: extracting a binary file relating to a logical flow in an application program file; conducting de-compilation on the binary file to obtain a de-compilation code; and conducting privacy disclosure analysis on the de-compilation code, and recognizing an instruction possibly relating to privacy disclosure.

Description

Method and system for analyzing Android application Technical field

The present invention relates to information security and, more particularly, to methods and systems for analyzing Android applications.

Background technique

In the prior art, the identification of privacy breaches is usually performed after a privacy breach has occurred. For example, after a privacy leak occurs on a device running the Android platform, the application on the Android platform is analyzed and detected (for example, analyzing and detecting the resources used by the application, and the data received and received) to ascertain the privacy leakage.

The existing technical solution deals with privacy leakage in a remedial form according to the result data of the application running, coping with time lag and failing to prevent privacy leakage. Therefore, there is a need for a technical solution that can prevent privacy breaches.

Summary of the invention

According to one aspect of the present invention, a method of analyzing an Android application is disclosed, including the following steps:

Static analysis before running, this step includes:

Extract the binary files involved in the logic flow in the application file,

Decompiling the binary to get the decompiled code.

Perform a privacy disclosure analysis of the decompiled code to identify instructions that may involve privacy breaches.

Preferably, the above privacy leakage analysis step comprises:

Find key instructions in the decompiled code that involve private data.

Determining whether a key instruction and other instructions related to the key instruction perform an operation of exchanging data with the outside world,

An instruction in a key instruction and other instructions related to the key instruction that performs an operation of exchanging data with the outside world is marked as an instruction that may involve a privacy leak.

Preferably, the method further comprises the steps of:

Dynamic analysis in operation, this step includes:

Record the dynamic data of the application at runtime,

Analyze the behavior of dynamic data and identify behaviors that involve privacy breaches.

Preferably, the step of analyzing the behavior of the dynamic data comprises:

Analyze the parts of the dynamic data that are related to instructions that may be involved in privacy breaches identified by static analysis,

The behavior involving privacy leakage is identified according to a predetermined analysis algorithm.

Preferably, the foregoing privacy leakage analysis step further comprises:

Generate a static analysis report.

Preferably, the step of dynamic analysis in operation further comprises:

Generate a privacy disclosure security analysis report.

According to one aspect of the present invention, a system for analyzing an Android application is disclosed, including:

A pre-run static analysis device comprising:

An extracting unit for extracting a binary file related to a logic flow in an application file,

a decompilation unit for decompiling the binary file to obtain decompiled code,

The first analysis unit is configured to perform a privacy leak analysis on the decompiled code to identify an instruction that may involve a privacy leak.

Preferably, the first analysis unit is configured to:

Find key instructions in the decompiled code that involve private data.

Determining whether a key instruction and other instructions related to the key instruction perform an operation of exchanging data with the outside world,

An instruction in a key instruction and other instructions related to the key instruction that performs an operation of exchanging data with the outside world is marked as an instruction that may involve a privacy leak.

Preferably, the system further comprises:

A dynamic analysis device in operation, the device comprising:

A monitoring unit for recording dynamic data of an application at runtime,

The second analysis unit is configured to analyze the behavior of the dynamic data and identify behaviors involving privacy leakage.

Preferably, the second analysis unit is configured to:

Analyze the parts of the dynamic data that are related to instructions that may be involved in privacy breaches identified by static analysis,

The behavior involving privacy leakage is identified according to a predetermined analysis algorithm.

Preferably, the first analysis unit is further configured to:

Generate a static analysis report.

Preferably, the second analysis unit is further configured to:

Generate a privacy disclosure security analysis report.

One advantage of the present invention is the ability to perform pre-run static analysis and runtime dynamic analysis to detect privacy breaches. An advantage of the present invention is that it can comprehensively use the dynamic analysis of the behavior of the application that triggers the application during the static analysis and the running process, and analyzes the relevant instructions related to the privacy leakage and the operation of the statistical application according to the predetermined algorithm to determine whether the privacy is stored. Give way. One advantage of the present invention is that a privacy breach analysis report is generated. One advantage of the present invention is that it can detect the leakage of private data at the layer of the application without modifying the underlying layer of the Android system, and does not impose an additional burden on the Android system.

DRAWINGS

Various aspects of the present invention will become apparent to those skilled in the <RTIgt; It should be understood by those skilled in the art that these drawings are only used to illustrate the technical solutions of the present invention, and are not intended to limit the scope of the present invention.

1 is a schematic diagram of the steps of a method of analyzing an Android application, in accordance with one embodiment of the present invention.

2 is a schematic diagram of the steps of a method of analyzing an Android application, in accordance with one embodiment of the present invention.

3 is a schematic diagram of the steps of a method of analyzing an Android application, in accordance with one embodiment of the present invention.

4 is a schematic structural diagram of a system for analyzing an Android application according to an embodiment of the present invention.

detailed description

Specific embodiments of the present invention will be further described in detail below with reference to the drawings. In the following description, numerous specific details are set forth However, it will be apparent to those skilled in the art that one or more aspects of the various embodiments can be The following description is therefore not to be taken in a limiting

1 is a schematic diagram of the steps of a method of analyzing an Android application, in accordance with one embodiment of the present invention. As shown, the method includes the following steps:

Step 101: Extract a binary file related to the logic flow in the application file,

Step 102: Decompile the binary file to obtain decompiled code.

Step 103: Perform a privacy disclosure analysis on the decompiled code to identify an instruction that may involve a privacy breach.

The above three steps are the pre-run static analysis of the application. Here, privacy disclosure refers to the disclosure of sensitive information about Android devices and users to third parties.

2 is a schematic diagram showing the steps of a method of analyzing an Android application according to another embodiment of the present invention. Figure 2 further describes the situation with respect to step 103 of Figure 1. As shown, the privacy breach analysis steps include:

Step 1031: Find key instructions related to private data in the decompiled code,

Step 1032: Determine whether the key instruction and other instructions related to the key instruction perform an operation of exchanging data with the outside world.

Step 1033: Mark the instruction of the key instruction and other instructions related to the key instruction to perform an operation of exchanging data with the outside world as an instruction that may involve a privacy leak.

Here, data exchange with the outside world refers to the exchange of private data with a third party. In one example, a static analysis report can be generated.

3 is a schematic diagram showing the steps of a method of analyzing an Android application according to another embodiment of the present invention. In the In the method, describe the running dynamic analysis of the application. As shown in FIG. 3, the method includes the following steps:

Step 201: Record dynamic data of the application at runtime,

Step 202: Analyze the behavior of the dynamic data to identify behaviors involving privacy breaches.

Here, the behavior of dynamic data refers to operations related to the dynamic data. By analyzing dynamic data, it is possible to monitor and judge all operations in the running of the application to identify whether the application has leaked private data during operation.

In one example, the behavior of the application can be actively triggered to record the dynamic data of the runtime as completely as possible.

In one example, information such as Class, Method, Opcode, String, etc. of the running application may be obtained from the dynamic data, and the behavior of the leaking private data that may exist may be identified therefrom. For example, you can configure policies to perform different types of behavioral analysis.

In one embodiment, the pre-run static analysis and the in-run dynamic analysis described above are combined. At this time, for step 202 in the above embodiment, the step of analyzing the behavior of the dynamic data may include: analyzing, in the dynamic data, a portion related to the instruction that may be involved in the privacy leakage identified by the static analysis, and according to the predetermined analysis. The algorithm identifies behaviors involving privacy breaches.

This embodiment improves the efficiency of identifying privacy leaks through comprehensive analysis. In one example, a privacy breach security analysis report is also generated.

4 is a schematic structural diagram of a system for analyzing an Android application according to an embodiment of the present invention. As shown, the system includes a pre-run static analysis device, the device comprising: an extracting unit for extracting a binary file related to a logic flow in an application file, and a decompilation unit for decompiling the binary file The decompiled code, the first analysis unit, is configured to perform a privacy leak analysis on the decompiled code to identify an instruction that may involve a privacy leak.

In one embodiment, the first analysis unit is configured to:

Find key instructions in the decompiled code that involve private data.

Determining whether a key instruction and other instructions related to the key instruction perform an operation of exchanging data with the outside world,

An instruction in a key instruction and other instructions related to the key instruction that performs an operation of exchanging data with the outside world is marked as an instruction that may involve a privacy leak.

As further shown, the system can also include an in-service dynamic analysis device, the device comprising:

A monitoring unit for recording dynamic data of an application at runtime,

The second analysis unit is configured to analyze the behavior of the dynamic data and identify behaviors involving privacy leakage.

Here, the monitoring unit can be deployed at the bottom of the Android system to avoid overloading the system. The monitoring unit loaded into the Android system sends the recorded dynamic data to the second analysis unit for further analysis.

In one embodiment, the second analysis unit is configured to:

Analyze the parts of the dynamic data that are related to instructions that may be involved in privacy breaches identified by static analysis,

The behavior involving privacy leakage is identified according to a predetermined analysis algorithm.

Here, the second analysis unit also receives an instruction from the first analysis unit that may involve a privacy leak.

Various changes and substitutions of the specific embodiments of the present invention can be made by those of ordinary skill in the art. Such changes and substitutions are intended to fall within the scope of the appended claims.

Claims (12)

A method for analyzing an Android application, comprising the steps of: Static analysis before running, this step includes: Extract the binary files involved in the logic flow in the application file, Decompiling the binary to get the decompiled code. Perform a privacy disclosure analysis of the decompiled code to identify instructions that may involve privacy breaches. The method of claim 1 wherein The above privacy breach analysis steps include: Find key instructions in the decompiled code that involve private data. Determining whether a key instruction and other instructions related to the key instruction perform an operation of exchanging data with the outside world, An instruction in a key instruction and other instructions related to the key instruction that performs an operation of exchanging data with the outside world is marked as an instruction that may involve a privacy leak. The method of claim 1 or 2, further comprising the steps of: Dynamic analysis in operation, this step includes: Record the dynamic data of the application at runtime, Analyze the behavior of dynamic data and identify behaviors that involve privacy breaches. The method of claim 3 wherein: The steps to analyze the behavior of dynamic data include: Analyze the parts of the dynamic data that are related to instructions that may be involved in privacy breaches identified by static analysis, The behavior involving privacy leakage is identified according to a predetermined analysis algorithm. The method of claim 4 wherein: The above privacy leakage analysis steps also include: Generate a static analysis report. The method of claim 5 wherein: The steps of dynamic analysis in operation also include: Generate a privacy disclosure security analysis report. A system for analyzing an Android application, comprising: A pre-run static analysis device comprising: An extracting unit for extracting a binary file related to a logic flow in an application file, a decompilation unit for decompiling the binary file to obtain decompiled code, The first analysis unit is configured to perform a privacy leak analysis on the decompiled code to identify an instruction that may involve a privacy leak. The system of claim 1 wherein: The first analysis unit is configured to: Find key instructions in the decompiled code that involve private data. Determining whether a key instruction and other instructions related to the key instruction perform an operation of exchanging data with the outside world, An instruction in a key instruction and other instructions related to the key instruction that performs an operation of exchanging data with the outside world is marked as an instruction that may involve a privacy leak. The system of claim 7 or 8, wherein the system further comprises: A dynamic analysis device in operation, the device comprising: A monitoring unit for recording dynamic data of an application at runtime, The second analysis unit is configured to analyze the behavior of the dynamic data and identify behaviors involving privacy leakage. The system of claim 9 wherein: The second analysis unit is configured to: Analyze the parts of the dynamic data that are related to instructions that may be involved in privacy breaches identified by static analysis, The behavior involving privacy leakage is identified according to a predetermined analysis algorithm. The system of claim 10 wherein: The first analysis unit is further configured to: Generate a static analysis report. The system of claim 11 wherein: The second analysis unit is further configured to: Generate a privacy disclosure security analysis report.

Images