Application privacy leakage detection method and system, terminal and medium

Abstract

The invention provides an application privacy leakage detection method and system. The method comprises the following steps: acquiring a to-be-detected APK for a GDPR; establishing a dynamic detection system, automatically installing and operating the APK, and collecting data information required by dynamic detection; during the automatic installation and operation period of the APK, establishing static detection channels in parallel, and collecting data information needed by static detection and matched with the data information needed by dynamic detection; and through combination of the data information required by dynamic detection and static detection and by means of association analysis and data flow information matching, screening out required information and privacy so as to complete detection of privacy disclosure of the application program. Meanwhile, the invention provides a corresponding terminal and a medium. According to the invention, the problem of privacy leakage in application programs can be automatically, efficiently and accurately detected in a short time without manually setting rules; and the privacy leakage of the application programs can be quickly, simply, conveniently and flexibly detected, and the requirements of the industry are met.

Description

technical field [0001] The present invention relates to the technical field of privacy protection, and specifically relates to a method, system, terminal and medium for detecting privacy leakage of applications for GDPR (General Data Protection Regulation) using a combination of dynamic detection and static detection. Background technique [0002] With the popularization and generalization of network and mobile phone technology, the protection of privacy has attracted the attention of various countries. my country has fully implemented the "Network Security Law of the People's Republic of China" since June 1, 2017, which clearly strengthens the protection of personal privacy, and requires network products and services to have the function of collecting user information, and its provider shall clearly indicate to the user and Obtain consent; network operators must not disclose, tamper with, or damage the personal information they collect; any individual or organization must no...

AI Technical Summary

Problems solved by technology

[0009] In traffic analysis, since there is no way to detect some leaks whose names are intentionally changed but hidden in plaintext traffic, it will also cause static analysis to conduct indiscriminate branch search, thereby greatly increasing the number of static search branches, resulting in search Time increases; at the same time, due to the need for individual customization and root operating system for a single or a class of application package files in traditional dynamic detection, large-scale detection cannot be achieved; dynamic taint tracking needs to be performed according to preset functions Marking of taints, so that privacy leaks caused by calling third-party APIs cannot be detected, resulting in false negatives, and the spread of taints in the process of taint tracking will cause false positives

[0010] At present, there is no description or report of the similar technology of the present invention, and no similar data at home and abroad have been collected yet.

Images