Mobile application evaluation method and system
A technology for mobile applications and evaluation methods, applied in error detection/correction, software testing/debugging, instruments, etc., can solve the problems of long evaluation cycle, heavy workload, ignoring security risk threats and losses, etc., to achieve short evaluation cycle, Avoid inconsistencies and measure cheap performance
Active Publication Date: 2019-07-05
中国移动通信集团内蒙古有限公司
View PDF4 Cites 0 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
[0004] First, business is more important than security, and there is a lack of unified security specifications: application developers or operating units put more investment and attention on business development, ignoring the threats and losses that may be caused by security risks. In addition, there is a lack of unified, Standard safety regulations lead to a large gap in safety protection methods and safety defense capabilities;
[0005] Second, the security level of application developers varies from good to bad, and their security protection capabilities are limited: application developers or developers are better at and focus on business development, and lack the ability to continuously research and apply security technologies in specific fields, resulting in "disease release" of applications The phenomenon of the application is ubiquitous, and attackers can exploit the vulnerability of the application itself to discover security attacks;
[0006] Third, the smart terminal operating system and components themselves have certain vulnerability risks
This method firstly requires high personal ability of the security technicians participating in the evaluation, and requires deep technical accumulation and certain processing experience in mobile application security; The cycle is also relatively long, and it cannot ensure that all risk points are fully covered
[0009] Second, the tool scan results are single, lacking intelligent judgment and analysis
At this stage, some security tools can directly scan mobile applications for risks, but the output results are mostly process data or intermediate results, and the automatic analysis ability is insufficient, requiring manual analysis and confirmation one by one, which will consume a lot of time and require security technicians Very familiar with the use of tools and related attributes, it is difficult to adapt to the characteristics of rapid iterative release of mobile application versions
[0010] Third, lack of automation and continuous security risk update mechanism
Due to the ever-changing mobile application technology, various new vulnerabilities continue to emerge. Relying on manual analysis or traditional tools cannot synchronize with the latest risk vulnerabilities, which may lead to fatal risks after mobile application evaluation
[0011] Fourth, the evaluation cycle is long, the workload is large, and the implementation cost is high
[0012] When using manual methods to evaluate mobile application security risks, there are high requirements for personnel's own security knowledge and proficiency in tools. All test results require direct manual intervention, so a large workload is required. and longer period, the overall implementation cost is higher
[0013] Therefore, with the rapid development of the mobile Internet and the increasingly serious threat of security risks, simply adopting a method based on manual evaluation of mobile application security risks can no longer meet the requirements for mobile application security risk control. Only by seeking a new solution can we guarantee The interests of users and application providers promote the sustainable development of the industry chain
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0046] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are the Some, but not all, embodiments are invented. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.
[0047] figure 1 A flow chart of a mobile application evaluation method provided by an embodiment of the present invention, such as figure 1 As shown, the method includes: S1, unpacking the installation package of the mobile application to be evaluated to obtain the characteristic information of the mobile application to be evaluated; S2, combining the characteristic in...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
The embodiment of the invention provides a mobile application evaluation method and system, and the method comprises the steps: carrying out the unpacking of an installation package of a to-be-evaluated mobile application, and obtaining the feature information of the to-be-evaluated mobile application; respectively associating the feature information with baseline indexes corresponding to a plurality of risk categories to be evaluated of the mobile application to be evaluated in a preset baseline risk index library, detecting the feature information by using a baseline index corresponding to each risk category required to be evaluated to obtain a detection result corresponding to each risk category required to be evaluated; and according to the detection result, determining the risk levelof each risk category to be evaluated by the to-be-evaluated mobile application. The mobile application safety evaluation baseline index and the risk level calculation standard are unified, the professional skill level of evaluation personnel is not needed, the problems that the evaluation methods are inconsistent, the evaluation specifications are not unified, and the evaluation range is neglected are avoided, the evaluation period is short, and the evaluation cost is low.
Description
technical field [0001] Embodiments of the present invention relate to the field of mobile application security, and more specifically, to a mobile application evaluation method and system. Background technique [0002] With the rapid popularization of mobile Internet applications, security threats are becoming increasingly severe. Especially in recent years, my country's mobile payment business has developed rapidly, and the huge profit space has prompted black industry organizations to attack mobile applications through tampering, secondary packaging, loophole exploitation, malicious attacks, etc., to achieve the purpose of destroying or stealing illegal benefits. The interests of developers, operators and end users have been seriously violated. Mobile applications have become one of the main entrances of Internet business. Due to the widespread application of mobile payment, the "profit-driven" characteristics of mobile application security attacks are very obvious. Due to...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More Patent Type & AuthorityApplications(China)
IPC IPC(8): G06F11/36
CPCG06F11/3692G06F21/577
Inventor康雅萍赵永安高妍陈熠乔栋孙卫国
Owner中国移动通信集团内蒙古有限公司