Overall static analysis system for Android authority-escalated attack

Abstract

The present invention discloses an overall static analysis system for an Android authority-escalated attack, comprising the following units: a suspicion analysis unit configured to separate a program with suspicious characteristics from all programs, the suspicion analysis unit comprising: an authority detection module configured to extract an Android application program sensitive authority, a component detection module configured to identify an Android application program open component, an Intent operation detection module configured to identify Android application program Intent communication, wherein the Intent is an abstract description of an operation to be performed, a file detection module configured to identify Android application program file access, and an identify socket detection module configured to identify network communication between android application programs; and a leakage path analysis unit configured to extract an explicit capability leakage path in the suspicious program, wherein the leakage path analysis unit comprises a module configured to analyze sensitive behavior code, and a module configured to analyze sensitive data transmission code.

Description

technical field [0001] The invention provides a comprehensive static analysis system for Android (Android) privilege escalation attacks, in particular a system for detecting power leakage loopholes that may lead to privilege escalation attacks. Background technique [0002] In order to resist the potential abuse of private information, Android (Android) proposes a permission-based security model. Before each application is installed, it must explicitly request a series of required permissions from the user, which may reveal the malicious intent of the program. However, an emerging threat known as privilege escalation attacks can bypass this privilege authorization mechanism. This model targets grant lists that contain suspiciously sensitive permissions that could lead to malicious uses. By utilizing this threat model, private information acquisition and sending permissions will be distributed to different applications. Sensitive operation access can be similarly changed, ...

AI Technical Summary

Problems solved by technology

In the actual scenario, take the malware NickyBot as an example, it will put the audio files on the SD card (secure digital card), so that it may be obtained by its potential co-conspirators

Chan et al. use decompiled applications for analysis, which may be disturbed by bad decompilation results and potential obfuscation techniques

Images