Vulnerability detection system and method for android hybrid application code injection

Abstract

The invention discloses a loophole detection system and method for Android mixed application code injection. The system includes an authority feature extraction module, a data channel feature extraction module and a vulnerability detection module. The authority feature extraction module is used to extract the mixed application code to be detected The sensitive permission application set of the hybrid application; the data channel feature extraction module is used to extract the source point set and the receiving point set of the data channel from the mixed application code to be detected; the first input terminal of the vulnerability detection module is the same as the output of the permission feature extraction module The second input terminal is connected to the output terminal of the data channel feature extraction module, which is used to determine whether there is vulnerability code injection in the mixed application to be detected by using the vulnerability detection model according to the sensitive authority and the source point set and the receiving point set of the data channel . Compared with the traditional detection method based on control flow and program call graph, it has higher efficiency, high classification accuracy and good usability.

Description

Technical field[0001]The invention belongs to the field of mobile security and vulnerability detection, and more specifically relates to a vulnerability detection system and method for Android mixed application code injection.Background technique[0002]With the development of Internet technology and the portability of mobile terminals, smart phones are becoming more and more popular. At the same time, in order to ensure the daily life and entertainment needs of users, developers are also developing more and more applications. The application market led by GooglePlay provides people with various applications, such as social networking, shopping, games, and photography. And news. However, the security problems brought by smart phones have become more and more serious, and the user's private data (geographical location, address book, account password) will also be exposed in the phone and become the target of malicious users. Market research results show that as of the fourth quarter of...

AI Technical Summary

Problems solved by technology

[0005] In view of the above defects, the present invention provides a vulnerability detection system and method for Android mixed application code injection, aiming to solve the problem that the existing vulnerability detection system finds the vulnerability attack path by constructing a function call graph to realize the vulnerability detection, which leads to the existing vulnerability detection method complex technical issues

Images