An Android application concurrency vulnerability detection system

A vulnerability detection and Android technology, applied in computer security devices, instruments, computing, etc., can solve the problems of high false positive detection results and undetectable concurrent vulnerabilities

CN106529304BActive Publication Date: 2019-06-14NANJING UNIV
2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Publication Date
2019-06-14

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention discloses an Android application concurrent vulnerability detection system. The system comprises a concurrent vulnerability analysis module, an application plug-in mounting module and an application performance module. The concurrent vulnerability analysis module is used for analyzing potential concurrent vulnerabilities in an application and transmitting the potential concurrent vulnerabilities to the application instrumentation module. The application instrumentation module carries out instrumentation on a statement capable of changing thread scheduling at a position of suspected data race code according to a detection result of the concurrent vulnerability analysis module, carries out instrumentation on control code capable of blocking thread operation at the position of a background thread entrance method and carries out instrumentation on background service for obtaining application operation moment state information. The application performance module operates the instrumented application, generates paired suspected events and sends the events to the application, thereby triggering potential concurrent vulnerabilities. According to the system, the detection result is accurate and efficient, and a whole process is automated without extra participation of a user.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention relates to a loophole detection system, in particular to an Android application concurrent loophole detection system. Background technique

[0002] Because the Android mobile operating system is an open source platform, it has attracted many application developers, making the Android system occupy a huge share in the mobile device market in recent years. Concurrency is a very critical feature for Android applications, and when the application is processing background tasks, it should also be able to respond quickly to incoming events. However, concurrent programs are becoming increasingly difficult to develop, test, and debug. For this reason, Android officials provide a series of constraints to avoid concurrency vulnerabilities, such as UI operations must be completed in the main thread. Unfortunately, as applications become more and more complex, developers cannot properly understand the application's behavior, resulting in a large nu...

Examples

Embodiment Construction

[0025] In order to describe the invention more clearly, first, some terms are explained.

[0026] An Android application refers to an application that can be installed and run on an Android mobile device, and specifically refers to the resource file and bytecode file of the application when it is clearly operated.

[0027] A Java application refers to an application written in the Java language that can run on a computer equipped with a JVM.

[0028] The bytecode of an Android application is the essence of an Android application. It consists of several class files, and each of these classes contains several methods. The methods in these classes cooperate to achieve specific functions.

[0029] The Android virtual machine refers to the executor of the Android application runtime. It is a special JVM that is specially used to interpret and execute the bytecode instructions of the Android application.

[0030] The Android application GUI component refers to the part that can be ...