Safety loophole mining method and device of application software under Android platform

Abstract

The invention discloses a safety loophole mining method and device of application software under an Android platform. The safety loophole mining method comprises the following steps of: S1, extracting a plurality of loophole rules of source codes of application software under the Android platform to form a loophole rule library; S2, establishing an ant script, and compiling the source codes to form a bytecode file; S3, analyzing the bytecode file by using a control flow analysis engine; S4, analyzing a transmission process of data in variables by using a data flow analysis engine to establish a data flow diagram so as to provide basis for reverse dynamic data tracing; S5, carrying out loophole detection according to the rules in the loophole rule library; and S6, generating a report from a safety loophole mining process and related data information. The invention also discloses a safety loophole mining device of application software under the Android platform. The safety loophole mining method and device disclosed by the invention are beneficial to discovering safety loopholes in software as soon as possible and is also beneficial to safe development of application software under the Android platform.

Description

technical field [0001] The invention relates to the field of source code detection, and more specifically, relates to a method and a device for mining security loopholes of application software under an Android platform. Background technique [0002] Android is a Linux-based open source operating system, mainly used in portable devices. At present, there is no unified Chinese name, and more people in mainland China use Android (unofficial) or Anzhi (official). The Android operating system was originally developed by Andy Rubin and initially primarily supported mobile phones. In 2005, it was acquired and injected by Google, and combined with a number of manufacturers to form the Open Handset Alliance to develop and improve, and gradually expanded to tablet PCs and other fields. According to data at the end of 2010, the Android operating system, which has been officially launched for only two years, has surpassed the Nokia Symbian system that has dominated for ten years, and...

AI Technical Summary

Problems solved by technology

[0004] Due to the limitation of the low hardware processing capacity of the mobile smart terminal, the applications on the mobile smart terminal have the characteristics of small size, fast upgrade, and specific functions. There is a big difference between the mobile smart terminal and the traditional terminal such as the PC. Security vulnerability mining technology cannot be directly applied to smart terminals

At present, the vulnerability discovery of application software under the Android platform is still a new field. Developers generally test programs under the Android platform based on the JUnit framework and the android.test namespace in the Android SDK, specifically for application software under the Android platform. Few automated tools for finding security vulnerabilities

Images