An application vulnerability detection and analysis method based on code base security protocol in Android application

Abstract

The invention belongs to the technical field of program information security monitoring, and particularly relates to an Android application used application program vulnerability detection and analysis method based on code library security specifications. The method comprises the following steps: building a security specification model, i.e., describing the security specifications of the code library by using formalized rule languages; designing a static program analyzer for performing automatic verification based on the security specification model; applying the static program analyzer to two phases, i.e., compilation of application programs and examination of the application programs in an application market, and detecting security vulnerabilities. According to the detection and analysis method provided by the invention, the security risk in the program can be prevented.

Description

technical field [0001] The invention belongs to the technical field of program information security monitoring, and in particular relates to a method for detecting and analyzing security loopholes in Android applications. Background technique [0002] The security protocol is a code library security usage suggestion provided by the code library designer. For example, Google provides a detailed list of security tips for the built-in function library of the Android system. Among these hints, code base designers inform programmers that using the code base is correct and how using the code base introduces software security flaws. In form, codebase security tips are similar to other codebase usage guides: they don't have a uniform format, and most codebase security tips are written by codebase designers in their native language. Therefore, in actual use, developers may misunderstand the semantics of security specifications due to language issues. [0003] Among many mobile plat...

AI Technical Summary

Problems solved by technology

[0004] However, many Android applications, including some popular applications, contain a large number of security vulnerabilities, and one of the important reasons for these security vulnerabilities is that developers have not followed the corresponding security regulations when using the code base.

Many companies and organizations have proposed many security regulations for the correct use of their code bases. However, there are still many problems with the quality of these security regulations and their performance in actual development. Semantic misunderstandings caused by natural language attributes, scattered security regulations make it difficult to manage uniformly, and the impact of misleading code fragments, etc.

[0005] Because developers usually do not intentionally violate code base security regulations, in this case, it is impossible for developers to fix the security holes that may exist in the application

Images