An android-based covert channel attack audit and detection method

Abstract

The invention discloses an Android-based covert channel attack audit and detection method, belonging to the technical field of computer system security. The present invention comprises the following steps: (1) customizing the target covert channel according to the form of "shared resource-operating primitive"; (2) parsing the defined covert channel into relevant java layer api hook functions and kernel layer audit rules; (3) According to the application permissions for accessing shared resources, and according to the information delivered by the kernel audit module and the java layer hook function at runtime, dynamically audit the operating characteristics of the target shared resources between applications; (4) when the audit value exceeds When the threshold is reached, the shared resource state interference module is invoked to imitate the operating characteristics of the shared resource by a high-privilege application to change the related state of the shared resource and interfere with the covert data transmission based on the shared resource. The invention dynamically audits the existence of the covert channel attack when the system is running, disrupts the data content transmitted by the covert channel, and prevents the leakage of sensitive data.

Description

technical field [0001] The invention belongs to the technical field of computer system security, and more specifically relates to an Android-based covert channel attack auditing and detection method. Background technique [0002] With the popularization and improvement of functions of smart phones, more and more sensitive data information, such as account information and contact information, are stored inside the smart phone. In the face of frequent sensitive data theft methods targeting smartphones, the security of these data is becoming more and more important, requiring continuous research on targeted countermeasures. [0003] Among all kinds of privacy data theft methods, covert channel attacks are extremely concealed. Through the collusion of high-privilege and low-privilege applications, with the help of the observable and changeable state of system shared resources, it bypasses the permission-based security mechanism of the operating system, so that applications that...

AI Technical Summary

Problems solved by technology

However, such solutions limit the use of system shared resources, damage the availability of shared resources, and cause unnecessary negative effects on the normal operation of applications.

Images