A method for validate and identifying unsafe sensitive input in Android system

Abstract

The invention belongs to the technical field of program security analysis vulnerability mining, in particular to an unsafe sensitive input verification identification method in an Android system. Themethod comprises the following steps: input validation identification, firstly, extracting interrupt branch in program code, analyzing code structure characteristics, finding out independent program branch containing interrupt instruction, and judging whether current program execution includes the intention of checking input; sensitive input validation identification, using natural language processing to cluster a large number of input parameters based on semantics, and then using machine learning to infer other unknown sensitive parameters by specifying a few known sensitive parameters; Finally, loophole identification, by checking whether these input validation with sensitive parameters meet the security rules to determine whether it is unsafe input validation. Through the identificationof this kind of input verification, we can determine the system-level security vulnerabilities, which is of great significance to enhance the security of mobile systems and prevent system-level attacks.

Description

technical field [0001] The invention belongs to the technical field of program security analysis and vulnerability mining, specifically relates to natural language processing, machine learning technology and static information flow analysis technology, and in particular to a method for identifying unsafe input verification in an Android system. Background technique [0002] More than 60% of mobile devices are using the Android system, which runs a large number of applications related to our daily life. To achieve various functions, the app can read and manipulate Android system resources, such as GPS devices and screen displays, and perform sensitive operations, such as sending and deleting SMS messages. In Android, these resources and sensitive operations are managed by more than 100 system services. Clearly, access control in these services plays an important role in the security of the overall system. [0003] In this invention, we conduct an empirical study of a specia...

AI Technical Summary

Problems solved by technology

(2) The definition is not clear

So it's not clear if the input needs to be validated and if it's done correctly

(3) Fragmentation

Secondly, system developers also ignore the problem of input validation when customizing the Android system

However, in these contexts, there is no way in Android to automatically identify sensitive input validation and the security holes it poses

Images