Detection method for collusion behavior among Android third-party libraries

Abstract

The invention discloses a detection method for a collusion behavior among Android third-party libraries. The method comprises the following steps that: obtaining an analysis pattern and a library fileused for storing an Android third-party library to be detected, and preprocessing the library file to obtain the basic information of the third-party library; according to the analysis pattern and the basic information, constructing a pseudo main function; according to the pseudo main function, constructing a calling flow graph, and analyzing the calling flow graph; according to the pseudo main function, constructing a data flow graph, and analyzing the data flow graph; and according to information obtained by analyzing the calling flow graph and information obtained by analyzing the data flow graph, carrying out matching analysis to obtain a detection result for the collusion behavior among Android third-party libraries. By use of the method, the detection of the collusion behavior amongAndroid third-party libraries and the data flow analysis of the Android third-party libraries can be realized, in addition, according to requirements, quickly analysis detection and deep analysis detection can be realized, detection speed is high, and library files of different formats can be detected.

Description

Technical field [0001] The invention belongs to the field of mobile security, and more specifically, relates to a method for detecting collusion behavior between Android third-party libraries. Background technique [0002] The openness and modular development of the Android ecosystem have led to the widespread use of third-party libraries in applications. This third-party library can reduce development time and provide applications with diverse functions to improve developer efficiency. However, since the main program and the third-party library may belong to different interest groups, while the third-party library brings benefits, it also brings certain security risks to users. [0003] A collusion attack is an attack that separates a combination of sensitive permissions and malicious behaviors into different applications. From the perspective of a single application, the applications participating in the collusion are usually regular applications, but they will be triggered after...

AI Technical Summary

Problems solved by technology

Not only that, if there is collusion in third-party libraries, when these libraries are used by a large number of applications, it will have a more serious impact

[0004] In addition, since most of the analysis objects are paired applications when analyzing application collusion, the time complexity of detecting applications in pairs is O(n 2 ), the detection speed is slow

[0005] In general, there is no research on the detection of collusion between third-party libraries of Android applications. The existing research is more on the research and detection of application collusion. Risks already exist in the application, but these have been Existing technology cannot solve the collusion problem in Android third-party libraries, nor can it detect risks before they are introduced into the application. At the same time, there is still the problem of slow detection speed

Images