Security patch detection method for Android application upgrading

Abstract

The invention discloses a security patch detection method for Android application upgrading, and the method comprises the following steps: performing function matching between Android application programs before and after upgrading by restoring the structural hierarchy and disassembly code characteristic values of the Android application programs before and after upgrading, and performing data flow analysis on all call points of a function where an updating patch is located; establishing a control flow diagram of two version functions before and after upgrading where the update patch is located, extracting data dependence and control dependence related to the variable parameters from the control flow diagram, and obtaining a security detection result according to the dependence relationship. According to the method and the device, security-related patches existing in program analysis can be obtained by performing differential analysis on the android application of the version before and after upgrading, so that the goal of reducing analysis of security auditing personnel and the goal of learning a new vulnerability mode are achieved. And the purpose of safety worker analysis is greatly reduced. Common program confusion can be resisted, and the source code does not need to be intrusively changed. A security patch mode does not need to be defined depending on the experience of a security worker, and a more complex security patch can be positioned.

Description

technical field [0001] The invention relates to a technology in the field of information security, in particular to a security patch detection method for Android application upgrades. Background technique [0002] For the distinction between program security patches and functional updates, most of the existing solutions use specific pattern matching, or use detailed update information for analysis, but these solutions have many limitations in real scenarios: using pattern matching The method can only extract update patches of specific patterns, and cannot cope with code repairs introduced by complex real scenarios. The defined pattern needs to be based on the experience of security analysts; except for open source projects, the update description of Android applications is very simple, usually only "fixed Know the problem" prompt. Contents of the invention [0003] The present invention aims at the shortcomings of the prior art for application update patch analysis, and p...

AI Technical Summary

Problems solved by technology

[0002] For the distinction between program security patches and functional updates, most of the existing solutions use specific pattern matching, or use detailed update information for analysis, but these solutions have many limitations in real scenarios: using pattern matching The method can only extract update patches of specific patterns, and cannot cope with code repairs introduced by complex real scenarios. The defined pattern needs to be based on the experience of security analysts; except for open source projects, the update description of Android applications is very simple, usually only "fixed Know the problem" prompt

Images