Implicit channel detection method between Android applications based on semantic graph of intent communication behavior

Abstract

The invention discloses a hidden channel detection method between Android applications based on the Intent communication behavior semantic graph, which includes the following content: screening suspicious candidate application sets from the target Android platform; obtaining Intent communication events by monitoring Intent related functions to establish candidate applications- Intent function call weight graph; perform relationship matching between sending broadcast message calling behavior and receiving broadcast message calling behavior, and establish sending application-receiving application association graph; decompose sending application-receiving application association graph into multiple Intent communication pairs, and extract Intent communication The semantic description vector of the behavior of the pair, and extract the sensitive permission flag vector of the two applications in the communication pair, combine the two vectors to form the collusion application feature vector, and perform supervised learning on the vector to realize the detection of hidden channels between applications. The invention uses communication features to describe the collusion stealing behavior of a pair of Android application programs, has good applicability, and is suitable for detecting Android collusion stealing applications under the situation of large differences in operating environments and insufficient training samples.

Description

technical field [0001] The invention belongs to the field of mobile platform information security, in particular to a hidden channel detection method between Android applications based on an Intent communication behavior semantic map. Background technique [0002] At present, the theft detection mechanism of various security protection tools on the Android platform is mainly aimed at a single application, especially for applications that have both sensitive information read and network connection permissions, and it is also the key target of various security protection tools. In order to achieve stronger concealment, some stealing behaviors have begun to use multiple software conspiracy methods to achieve collusion stealing. The functions of information acquisition and network transmission are decomposed into multiple applications, which makes the existing secret theft detection mechanism for a single application invalid. The corresponding price is that the implantation diff...

AI Technical Summary

Problems solved by technology

Collusion stealing applications implement complex and diverse means, but their salient feature is that there is a covert channel between them, which is realized by reading and writing jointly accessible resources or Intent mechanisms

At present, most of the stealth detection mechanisms of security protection tools on the Android platform are aimed at a single application.

Images