Android encryption communication detection device and method based on dynamic linking library injection

Abstract

The invention discloses an Android encryption communication detection device and method based on dynamic linking library injection. The detection device is provided with a dynamic linking library injection module, a monitoring point implantation module and a data packet analysis module. The detection device and method are used for detecting and analyzing terminal encryption communication on the conditions that the system ROM is not changed and the system is not in the debugging state. The detection method comprises the steps that the dynamic linking library injection mode is adopted, a shellcode is injected into the set process space of an intelligent terminal, the shellcode is searched for an API used by system encryption communication, the API is used as a monitoring point set and implanted at the Android system encryption communication position, unencrypted communication data packets sent and received by an Android intelligent terminal are captured and recorded, and the unencrypted communication data packets are detected and analyzed based on an Android platform, so that the safety problem caused by encryption communication for stealing user or enterprise privacy information and spreading illegal information is solved. The Android encryption communication detection device and method based on dynamic linking library injection have the advantages that the applicability is good, the monitoring point is extensible and comprehensive, data packet analysis and analysis cost are small, and therefore the Android encryption communication detection device and method have good application and popularization prospects.

Description

technical field [0001] The invention relates to an encrypted communication detection device for a mobile Android platform, more precisely, to an Android encrypted communication detection device and method based on dynamic link library injection, and belongs to the technical field of network security in information security. Background technique [0002] At present, there are many research literatures on the detection and analysis technology of PC-side software encrypted communication. However, the research on the detection and analysis technology of mobile Android platform encrypted communication is still in its infancy, so mature detection tools have not yet been formed. Like the PC side, its detection is usually based on software reverse analysis technology. Therefore, commonly used encrypted communication detection tools and auxiliary tools include: Gdbserver, Andbug, Taintdroid and IDA Pro, etc. Here is an introduction to these tools: [0003] Gdbserver, as a powerful ...

AI Technical Summary

Problems solved by technology

However, due to the Android application of encrypted communication, most of the monitored data is in an unrecognizable data format, and the above-mentioned traditional methods have been difficult to analyze, let alone obtain correct results

Images