Privacy detection method and device, and computer storable medium

Abstract

The present disclosure relates to a privacy detection method and device. The privacy detection method includes: performing static taint analysis on the application to be detected to obtain at least one static taint propagation path, each static taint propagation path includes a source interface identifier and a destination interface identifier; performing static analysis on the application to be detected based on permission-related information of at least one privacy interface, permission-related information of at least one third-party SDK and at least one static taint propagation path to obtain a static analysis result; performing dynamic behavior analysis on the application to be detected to obtain a dynamic behavior analysis result; obtaining communication flow data throughout the life cycle of the application to be detected, the communication flow data includes a communication URL and a communication data packet; determining the sensitive information and sensitive information category corresponding to each communication URL based on the communication data packet corresponding to each communication URL as a flow analysis result; fusing the static analysis result, the dynamic behavior analysis result and the flow analysis result to obtain a privacy detection result.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a privacy detection method and device, and a computer storable medium. Background Art

[0002] In recent years, with the gradual popularization of the Android operating system, Android applications have grown dramatically. While Android applications bring convenience to users, they also pose a threat to users' privacy data such as personal information.

[0003] In the related art, an Android application is statically analyzed based on permission information of a privacy interface or an Android application is executed and a dynamic behavior analysis is performed on the Android application. Summary of the invention

[0004] The inventors believe that: in the related art, static analysis lacks the ability to detect usage scenarios of permissions and privacy leaks in the Android application running environment, and the accuracy and comprehensiveness of privacy detection are poor. Dynamic behavior analysis is prone to interruption of application operation due to program pop-ups, affecting the accuracy and comprehensiveness of privacy detection.

[0005] In response to the above technical problems, the present disclosure proposes a solution that can improve the accuracy and comprehensiveness of privacy detection.

[0006] According to a first aspect of the present disclosure, a privacy detection method is provided, comprising: performing static taint analysis on an application to be detected to obtain at least one static taint propagation path, each static taint propagation path comprising a source interface identifier and a destination interface identifier; performing static analysis on the application to be detected based on permission-related information of at least one privacy interface, permission-related information of at least one third-party software development kit SDK, and the at least one static taint propagation path to obtain a static analysis result; performing dynamic behavior analysis on the application to be detected to obtain a dynamic behavior analysis result; acquiring communication traffic data throughout the life cycle of the application to be detected, the communication traffic data comprising a communication uniform resource locator URL and a communication data packet; determining, based on the communication data packet corresponding to each communication URL, sensitive information and a sensitive information category corresponding to the each communication URL as a traffic analysis result; and fusing the static analysis result, the dynamic behavior analysis result, and the traffic analysis result to obtain a privacy detection result.

[0007] In some embodiments, the application to be detected is statically analyzed to obtain a static analysis result, including: constructing static privacy context information of each static taint propagation path based on permission-related information of at least one privacy interface, permission-related information of at least one third-party SDK, and the at least one static taint propagation path; and using the static privacy context information of the at least one static taint propagation path to statically analyze the application to be detected to obtain a static analysis result.

[0008] In some embodiments, the permission-related information of each privacy interface includes a privacy interface identifier and other interface permission-related information, and the permission-related information of each third-party SDK includes an SDK identifier, at least one SDK privacy path where the third-party SDK is located, and other SDK permission-related information. Constructing the static privacy context information of each static taint propagation path includes: for each static taint propagation path, when the source interface identifier belongs to the privacy interface identifier in the permission-related information of the at least one privacy interface, obtaining other interface permission information corresponding to the source interface identifier; obtaining the path where the destination interface corresponds to the destination interface identifier of each static taint propagation path; when the path where the destination interface belongs to at least one SDK privacy path in the permission-related information of the at least one third-party SDK, obtaining other SDK permission information corresponding to the path where the destination interface is located; constructing the static privacy context information of each static taint propagation path according to the source interface identifier, other interface permission information corresponding to the source interface identifier, the destination interface identifier, the path where the destination interface is located, and other SDK permission information corresponding to the path where the destination interface is located.

[0009] In some embodiments, the static analysis includes privacy type determination, the other interface permission information includes actual permission information, the actual permission information is the permission information actually used when the privacy interface is called, and the static privacy context information of the at least one static taint propagation path is used to perform static analysis on the application to be detected, including: according to the correspondence between the privacy type and the actual permission information, and the actual permission information in the static privacy context information of each static taint propagation path, determining the privacy type of the static privacy context information of each static taint propagation path as part of the static analysis result.

[0010] In some embodiments, the static analysis includes redundant permission determination, the other interface permission information includes actual permission information, the actual permission information is the permission information actually used when the privacy interface is called, and the static privacy context information of the at least one static taint propagation path is used to perform static analysis on the application to be detected, including: obtaining at least one declared permission information of the application to be detected, the declared permission information represents the permission information that may be used by the application to be detected during its life cycle; for each piece of declared permission information, if there is no actual permission information in the static privacy context information of any static taint propagation path that is the declared permission information, determining that the declared permission information is a redundant permission as part of the static analysis result.

[0011] In some embodiments, using the static privacy context information of the at least one static taint propagation path, statically analyzing the application to be detected also includes: for each declared permission information, when there is actual permission information in the static privacy context information of at least one static taint propagation path that is the declared permission information, determining that the static privacy context information of the at least one static taint propagation path belongs to the usage scenario of the declared permission information corresponding to the actual permission information, as part of the static analysis result.

[0012] In some embodiments, the static analysis includes redundant path determination, and using the static privacy context information of the at least one static taint propagation path, the static analysis of the application to be detected includes: obtaining at least one declared permission information of the application to be detected, the declared permission information representing the permission information that may be used by the application to be detected during its life cycle; for the actual permission information in the static privacy context information of each static taint propagation path, if the actual permission information does not belong to the at least one declared permission information, determining that the static privacy context information of each static taint propagation path belongs to a redundant path as part of the static analysis result.

[0013] In some embodiments, performing static analysis on the application to be detected using the static privacy context information of the at least one static taint propagation path also includes: when the actual permission information belongs to the at least one declared permission information, determining whether the static privacy context information of each static taint propagation path belongs to the usage scenario of the declared permission information corresponding to the actual permission information, as part of the static analysis result.

[0014] In some embodiments, based on the communication data packets corresponding to each communication URL, determining the sensitive information and sensitive information category corresponding to each communication URL includes: detecting the communication data packets corresponding to each communication URL to obtain sensitive information that complies with preset rules as the sensitive information corresponding to each communication URL; and determining the sensitive information category corresponding to each communication URL based on the correspondence between the preset rules and the sensitive information category.

[0015] In some embodiments, dynamic behavior analysis is performed on the application to be detected to obtain dynamic behavior analysis results, including: during the running of the application to be detected, multiple preset privacy interface functions are monitored to obtain dynamic privacy context information corresponding to each privacy interface function as part of the dynamic behavior analysis results; during the running of the application to be detected, the screen state changes of the application to be detected are monitored; when the screen state changes, the current running interface is parsed to obtain attribute values ​​of multiple attributes of each control; for each control, the attribute value of at least one specified attribute is obtained from the attribute values ​​of the multiple attributes; for each control, when the attribute value of the at least one specified attribute satisfies a preset condition, a target operation corresponding to the preset condition satisfied by the attribute value is performed on each control.

[0016] In some embodiments, dynamic behavior analysis is performed on the application to be detected, and obtaining the dynamic behavior analysis result also includes: obtaining the identifier of at least one specific component of the application to be detected and the running order of the at least one specific component; starting the specific components corresponding to the identifier of each specific component in sequence according to the running order, and controlling each started specific component to run for a specified time; performing a screenshot operation on the running interface corresponding to each started specific component, and obtaining a screenshot of the running interface as part of the dynamic behavior analysis result.

[0017] According to a second aspect of the present disclosure, a privacy detection device is provided, comprising: a static taint analysis module, configured to perform static taint analysis on an application to be detected, and obtain at least one static taint propagation path, each static taint propagation path comprising a source interface identifier and a destination interface identifier; a static analysis module, configured to perform static analysis on the application to be detected according to permission-related information of at least one privacy interface, permission-related information of at least one third-party software development kit SDK, and the at least one static taint propagation path, and obtain a static analysis result; a dynamic behavior analysis module, configured to perform dynamic behavior analysis on the application to be detected, and obtain a dynamic behavior analysis result; an acquisition module, configured to obtain communication traffic data in the entire life cycle of the application to be detected, and the communication traffic data comprises a communication uniform resource locator URL and a communication data packet; a determination module, configured to determine, according to the communication data packet corresponding to each communication URL, the sensitive information and the sensitive information category corresponding to the communication URL as a traffic analysis result; and a fusion module, configured to fuse the static analysis result, the dynamic behavior analysis result, and the traffic analysis result to obtain a privacy detection result.

[0018] According to a third aspect of the present disclosure, a privacy detection device is provided, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute the privacy detection method described in any of the above embodiments based on instructions stored in the memory.

[0019] According to a fourth aspect of the present disclosure, a computer storable medium is provided, on which computer program instructions are stored, and when the instructions are executed by a processor, the privacy detection method described in any of the above embodiments is implemented.

[0020] In the above embodiments, the accuracy and comprehensiveness of privacy detection can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0022] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0023] Figure 1 is a flowchart illustrating a privacy detection method according to some embodiments of the present disclosure;

[0024] Figure 2 is a flow chart showing how to perform static analysis on the application to be detected to obtain a static analysis result according to some embodiments of the present disclosure;

[0025] Figure 3is a block diagram showing a privacy detection device according to some embodiments of the present disclosure;

[0026] Figure 4 is a block diagram showing a privacy detection device according to some other embodiments of the present disclosure;

[0027] Figure 5 is a block diagram illustrating a computer system for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0028] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless otherwise specifically stated.

[0029] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0030] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0031] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0032] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0033] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0034] Figure 1 is a flowchart illustrating a privacy detection method according to some embodiments of the present disclosure.

[0035] like Figure 1As shown, the privacy detection method includes: step S110, performing static taint analysis on the application to be detected to obtain at least one static taint propagation path; step S120, performing static analysis on the application to be detected to obtain static analysis results; step S130, performing dynamic behavior analysis on the application to be detected to obtain dynamic behavior analysis results; step S140, obtaining communication flow data in the entire life cycle of the application to be detected; step S150, determining the sensitive information and sensitive information category corresponding to each communication URL (Uniform Resource Locator) as the flow analysis result; and step S160, fusing the static analysis results, dynamic behavior analysis results and flow analysis results to obtain the privacy detection results. For example, the above steps S110-S160 can be performed by a privacy detection device.

[0036] In step S110, static taint analysis is performed on the application to be detected to obtain at least one static taint propagation path. Each static taint propagation path includes a source interface identifier and a destination interface identifier. In some embodiments, the interface identifier can be determined based on the interface name.

[0037] In some embodiments, the above step S110 may be implemented as follows.

[0038] First, the function call graph of the application to be detected is determined based on the calling relationship between functions in the application to be detected. The function call graph includes multiple nodes, each node represents an interface, and the nodes are connected by edges, each edge represents the calling relationship between nodes. For example, the Java analysis framework soot can be used to construct a function call graph. The interface is the application programming interface (API).

[0039] Then, according to the pre-configured source (taint source) function table and sink (taint sink) function table, the static analysis framework FlowDroid is used to perform static taint analysis on the function call graph determined above, and at least one reachable path privacyPaths from the source function to the sink function is obtained as the static taint propagation path. The source function table and sink function table can be configured according to business needs.

[0040] In step S120, based on permission-related information of at least one privacy interface, permission-related information of at least one third-party SDK (Software Development Kit) and at least one static taint propagation path, a static analysis is performed on the application to be detected to obtain a static analysis result.

[0041] In some embodiments, the permission-related information of each privacy interface includes a privacy interface identifier and other interface permission-related information. For example, other interface permission-related information may include at least one of permission level, interface name, interface privacy path, and interface function information.

[0042] In some embodiments, permission-related information of at least one privacy interface is stored in an interface permission mapping table.

[0043] For example, the interface permission mapping table is in JSON (JavaScript Object Notation) format:

[0044] "HIGH":{

[0045] 'getLatitude()':{

[0046] 'APIName':'android.location.Location:double getLatitude()'

[0047] 'Describe':'Get latitude'

[0048] 'Permission':'android.permission.ACESS_FINE_LOCATION'

[0049] },

[0050] 'getLongitude()':{

[0051] 'APIName':'android.location.Location:double getLongitude()'

[0052] 'Describe':'Get longitude'

[0053] 'Permission':'android.permission.ACESS_FINE_LOCATION'

[0054] },

[0055] …

[0056] }.

[0057] The interface permission mapping table includes multiple privacy interface identifiers (for example, getLatitude(), getLongitude()), the permission level corresponding to each privacy interface identifier (for example, HIGH high-risk permission, MIDDLE medium-risk permission, LOW low-risk permission), the name of the privacy interface (for example, the value corresponding to APIName: android.location.Location:doublegetLatitude(), android.location.Location:doublegetLongitude()), the function information of the privacy interface (for example, the value corresponding to Describe: get longitude, get latitude), and the actual permission information of the privacy interface (for example, the value corresponding to Permission android.permission.ACESS_FINE_LOCATION). A permission level can correspond to one or more privacy interfaces. The actual permission information of the privacy interface is the permission information actually used when the privacy interface is called.

[0058] The interface permission mapping table is based on the data provided by PScout. It also analyzes and extracts all the methods, fields, parameters, etc. in the Google Android developer documentation that require permissions to call, and supplements the privacy interfaces that PScout does not have based on the extracted privacy interfaces, forming a complete interface permission mapping table.

[0059] For example, for each interface in the developer document, if the interface has permission restrictions or the parameters and fields of the functions of the interface have permission restrictions, the interface is determined to be a privacy interface and the privacy interface is stored in the interface permission mapping table.

[0060] In some embodiments, the permission-related information of each third-party SDK includes the SDK identifier, at least one SDK privacy path where the third-party SDK is located, and other SDK permission-related information. For example, other SDK permission-related information includes SDK function information and actual permission information of the SDK. The SDK identifier is, for example, the SDK name. The actual permission information of the SDK is the permission information actually used when the SDK is called. The SDK privacy path is the program storage path of the third-party SDK obtained through third-party SDK identification technology, which can also be called a feature vector.

[0061] In some embodiments, permission-related information of at least one third-party SDK is stored in a third-party SDK permission mapping table.

[0062] For example, the third-party SDK permission mapping table can be stored in JSON format. An item in the third-party SDK permission mapping table is:

[0063]

[0064] weibo_login is the SDK identifier, description corresponds to the value "Weibo SDK" is the description information of the SDK, and features is the feature information of the SDK. The SDK feature information includes at least one SDK privacy path (com / sina / weibo, com / weibo corresponding to sdk_key), SDK function information (function corresponds to "Sina Weibo Open Platform SDK, which provides developers with an interface to access Weibo, providing user identity recognition, social relationship import, content sharing and dissemination, and aggregation and import of high-quality content") and the actual permission information of the SDK (android_permission_READ_PHONE_STATE corresponding to permission).

[0065] For example, by Figure 2 The above step S120 is implemented in the manner shown.

[0066] Figure 2 It is a flowchart showing how to perform static analysis on the application to be detected to obtain static analysis results according to some embodiments of the present disclosure.

[0067] like Figure 2 As shown, performing static analysis on the application to be detected to obtain a static analysis result includes steps S121 and S122.

[0068] In step S121, static privacy context information of each static taint propagation path is constructed according to permission-related information of at least one privacy interface, permission-related information of at least one third-party SDK, and at least one static taint propagation path.

[0069] For example, the above step S121 is implemented in the following manner.

[0070] First, for each static taint propagation path, when the source interface identifier belongs to the privacy interface identifier in the permission-related information of at least one privacy interface, obtain other interface permission information corresponding to the source interface identifier. In some embodiments, when the source interface identifier does not belong to the privacy interface identifier in the permission-related information of any privacy interface, directly process other static taint propagation paths.

[0071] Secondly, the destination interface path corresponding to the destination interface identifier of each static taint propagation path is obtained.

[0072] Then, when the path where the destination interface is located belongs to at least one SDK privacy path in the permission-related information of at least one third-party SDK, other SDK permission information corresponding to the path where the destination interface is located is obtained.

[0073] Finally, the static privacy context information of each static taint propagation path is constructed based on the source interface identifier, other interface permission information corresponding to the source interface identifier, the destination interface identifier, the path where the destination interface is located, and other SDK permission information corresponding to the path where the destination interface is located.

[0074] For example, the static privacy context information in this case can be formatted and stored:

[0075] PrivacyContextStatic1={SourceAPI, SourceAPiDescription, SourceAPiLocation, permission, DestinionAPI, DestinionAPIDescription, DestinionLocation, XXSDK},

[0076] SourceAPI represents the source interface identifier (corresponding to the privacy interface called to obtain private information), SourceAPiDescription represents the functional description information of the source interface identifier, SourceAPiLocation represents the interface privacy path of the source interface, Permission represents the permission required to obtain the above privacy information (the actual permission information of the privacy interface), DestinionAPI represents the caller of the privacy information (destination interface identifier), DestinionAPIDescription represents the functional information of the destination interface, DestinionLocation represents the location of the destination interface (SDK privacy path), XXSDK indicates that the subject that calls the destination interface to obtain the source interface is a third-party SDK, where XXSDK is the name of the specific third-party SDK.

[0077] In some embodiments, when the path where the destination interface is located does not belong to at least one SDK privacy path in the permission-related information of at least one third-party SDK, static privacy context information of each static taint propagation path is constructed based on the source interface identifier, other interface permission information corresponding to the source interface identifier, the destination interface identifier, and the path where the destination interface is located.

[0078] For example, the static privacy context information in this case can be formatted and stored:

[0079] PrivacyContextStatic2={SourceAPI, SourceAPiDescription, SourceAPiLocation, permission, DestinionAPI, DestinionAPIDescription, DestinionLocation, APP},

[0080] Different from the aforementioned static privacy context information PrivacyContextStatic1, PrivacyContextStatic2 replaces XXSDK in PrivacyContextStatic1 with APP, indicating that the subject that calls the destination interface to obtain the source interface is the application to be detected itself. The similarities between PrivacyContextStatic2 and PrivacyContextStatic1 are not repeated here.

[0081] In some embodiments, the permission level can also be stored in static privacy context information. From the static privacy context information, it can be determined at which location the source interface applied for what permission and obtained what personal information, which target interface obtained the obtained personal information, and whether the subject of the target interface is the SDK or the application to be tested. Privacy detection is more comprehensive.

[0082] In step S122, static analysis is performed on the application to be detected using the static privacy context information of at least one static taint propagation path to obtain a static analysis result.

[0083] In some embodiments, the static analysis may include privacy type determination. Using the static privacy context information of at least one static taint propagation path, the static analysis of the application to be detected includes: determining the privacy type of the static privacy context information of each static taint propagation path as part of the static analysis result based on the correspondence between the privacy type and the actual permission information and the actual permission information in the static privacy context information of each static taint propagation path.

[0084] For example, each actual permission information corresponds to a privacy type. Different actual permission information may correspond to the same privacy type. In some embodiments, the privacy types include phone privacy, location privacy, sensor privacy, camera privacy, calendar privacy, address book privacy, SMS privacy, storage privacy, microphone privacy, call log privacy, and other non-sensitive information.

[0085] For example, the actual permission information in the static privacy context information of each static taint propagation path can be matched with the actual permission information in multiple corresponding relationships to obtain the privacy type corresponding to the actual permission information in the static privacy context information of each static taint propagation path as the privacy type of the static privacy context information of each static taint propagation path. For example, after the above operation, if PrivacyContextStatic1 determines that the corresponding privacy type is phone privacy, the result can be saved as (PrivacyContextStatic1, phone privacy). This result can be used as part of the Jingtian analysis result.

[0086] In some embodiments, static analysis may also include redundant permission determination. Other interface permission information includes actual permission information. The actual permission information is the permission information actually used when the privacy interface is called.

[0087] Using the static privacy context information of at least one static taint propagation path, static analysis of the application to be detected includes: obtaining at least one declared permission information of the application to be detected, and for each declared permission information, if there is no actual permission information in the static privacy context information of any static taint propagation path that is the declared permission information, determining that the declared permission information is a redundant permission. The determination result can be used as part of the static analysis result. The declared permission information represents the permission information that may be used by the application to be detected during its life cycle.

[0088] In some embodiments, static analysis of the application to be detected using the static privacy context information of at least one static taint propagation path also includes: for each piece of declared permission information, when there is actual permission information in the static privacy context information of at least one static taint propagation path that is the declared permission information, determining that the static privacy context information of the at least one static taint propagation path belongs to the usage scenario of the declared permission information corresponding to the actual permission information, as part of the static analysis result.

[0089] For example, first obtain a set of at least one declared permission information Manifest-Permissions of the application to be detected, and perform a comparison (matching) operation on each declared permission information Manifest-Permission in the set and the actual permission information permission field in the static privacy context of each static taint propagation path.

[0090] In the case where the declared permission information does not match the actual permission information permission field in the static privacy context of any static taint propagation path, the declared permission information Manifest-Permission is a redundant permission. For example, the determination result can be stored as (Manifest-Permission, redundant permission) as part of the static analysis result.

[0091] In the case where the declared permission information matches the actual permission information permission field in the static privacy context information of at least one static taint propagation path, the static privacy context information of the at least one static taint propagation path is the usage scenario of the declared permission information corresponding to the matched actual permission information. For example, the determination result can be stored as (PrivacyContextStatic1, usage scenario of Manifest-Permission) as part of the static analysis result.

[0092] In some embodiments, static analysis may also include redundant path determination.

[0093] Using the static privacy context information of at least one static taint propagation path, static analysis of the application to be detected includes: obtaining at least one declared permission information of the application to be detected, and for the actual permission information in the static privacy context information of each static taint propagation path, if the actual permission information does not belong to the at least one declared permission information, determining that the static privacy context information of each static taint propagation path belongs to a redundant path as part of the static analysis result.

[0094] Taking the set Manifest-Permissions of at least one declared permission information of the application to be detected as an example, for the static privacy context information PrivacyContextStatic1, when the actual permission information permission field does not belong to any declared permission information in the set Manifest-Permissions, it can be determined that the static privacy context information PrivacyContextStatic1 belongs to a redundant path. For example, the determination result can be stored as (PrivacyContextStatic1, redundant path) as part of the static analysis result.

[0095] In some embodiments, using the static privacy context information of at least one static taint propagation path, static analysis of the application to be detected further includes: when the actual permission information belongs to the at least one declared permission information, determining that the static privacy context information of each static taint propagation path belongs to the usage scenario of the declared permission information corresponding to the actual permission information, as part of the static analysis result. The determination result can also be stored as (PrivacyContextStatic1, usage scenario of Manifest-Permission).

[0096] return Figure 1 In step S130, a dynamic behavior analysis is performed on the application to be detected to obtain a dynamic behavior analysis result.

[0097] In some embodiments, the above step S130 is implemented as follows.

[0098] First, in the process of running the application to be detected, multiple preset privacy interface functions are monitored to obtain dynamic privacy context information corresponding to each privacy interface function as part of the dynamic behavior analysis results. For example, the HOOK framework implemented by the Xposed framework can be used to monitor multiple privacy interface functions. For example, the dynamic privacy context information includes privacy-related interface identifiers, privacy types, actual permission information of privacy-related interfaces, call time, privacy type, parameter information, call return results, and call trigger stack information, etc.

[0099] For example, some information of privacy-related interfaces is configured in advance. Some of the configuration information is as follows:

[0100] "hookConfigs":{

[0101] {

[0102] "class_name":"android.provider.CalendarContract.Attendees",

[0103] "method": "query",

[0104] "thisObject": "false",

[0105] "type":"calendar",

[0106] "permission":"READ_CALENDAR",

[0107] },

[0108] ….

[0109] }.

[0110] hookConfigs represents a collection of configuration information. The class_name field is the privacy-related interface identifier. The method field is the name of the privacy-related function. thisObject is the type of the object. The false value indicates that the privacy-related interface is private. The type field is the privacy type. The permission field is the actual permission information of the privacy-related interface.

[0111] For example, the dynamic privacy context information is represented as PrivacyDynamicContext. PrivacyDynamicContext = {API, permission, type, timestamp, args, result, stacks}, where API represents the identifier of the privacy-related interface that is actually called (e.g., name), Permission represents the permission required to call the privacy-related interface (actual permission information), timestamp represents the time when the privacy-related interface is called (call time), type represents the privacy type, args represents the parameters of the privacy-related interface (if there are no parameters, the field is empty), result represents the return result of the call of the privacy-related interface (if there is no return result, the field is empty), and stacks represents the stack information triggered when the privacy-related interface is called.

[0112] Secondly, during the running of the application to be detected, monitor the screen status changes of the application to be detected. For example, you can use Android Accessibility technology to register a custom broadcast to listen for screen status change events. The custom broadcast can be named MyAcessibility.

[0113] Again, when the screen state changes, the current running interface is parsed to obtain the attribute values ​​of multiple attributes of each control. For example, the inspector function of the automated testing framework Appium can be used to perform tree structure parsing on the current running page to obtain an XPath tree including multiple control nodes, each of which includes multiple attributes.

[0114] Usually, the appearance of a pop-up window will cause the screen state to change, that is, the current running interface is, for example, a pop-up window interface. A pop-up window is a pop-up window that appears during the natural operation of the application to be tested. Pop-up window types include, but are not limited to, privacy confirmation pop-ups, permission grant pop-ups, and guidance to continue pop-ups. These pop-ups can be system pop-ups or application pop-ups. For example, a privacy confirmation pop-up window is an application pop-up window, and a permission grant pop-up window is a system pop-up window.

[0115] Then, for each control, at least one attribute value of a specified attribute is obtained from the attribute values ​​of multiple attributes. For example, the specified attribute includes but is not limited to the control text, control type, control click status, control identity document (ID), and the package to which the control belongs.

[0116] Finally, for each control, when the attribute value of at least one specified attribute satisfies the preset condition, a target operation corresponding to the preset condition satisfied by the attribute value is performed on each control. For example, the preset condition is that the attribute value belongs to the specified attribute value. In some embodiments, the specified attribute value is determined by performing tree structure parsing on a large number of pop-up pages using the inspector function of the automated testing framework appium, and analyzing the tree structure. For example, the target operation includes a click operation, a slide operation, an input operation, and a move operation.

[0117] For example, when the control text of a control is "Agree", the package (resource_id number) to which the control belongs is com.jingdong.app.mall / a4j, and the control click status is clickable, a single-click operation is performed on the control. This automated operation simulates the human behavior of clicking "Agree". Similarly, similar operations can be performed on controls with control texts such as "Start" and "Continue".

[0118] For another example, when the control identifier of the control is com.android.packageinstaller:id / permission_allow_button, the package to which the control belongs is com.samsuang.android.packageinstaller, the text of the control is allowed, the control type is android.widget.Button, and the click state of the control is clickable, a click operation is performed on the control. This process is an automated operation process that simulates a click operation on the authorization pop-up window.

[0119] For another example, the automated operation process can also simulate the user login process. When the control text of the control is "Login", find the control with the control text of "Personal Center" and click it. Then, find the space with the control text of "Account and Password Login", click it, switch to the account and password input mode, and then find the controls (input boxes) with the control text of "User Name" and "Password" in turn, and fill in the preset account and password respectively. Finally, find the login button and click it.

[0120] In the above embodiment, while performing dynamic behavior analysis on the application to be detected, the current running interface is parsed and whether to perform the target operation is determined based on the attribute value of the control, thereby achieving automatic operation of the application to be detected, avoiding operation interruptions of the application to be detected due to pop-ups during the dynamic behavior analysis process, and improving the analysis efficiency of the dynamic behavior analysis, thereby improving the detection efficiency of privacy detection.

[0121] In some embodiments, dynamic behavior analysis of the application to be detected may be performed to obtain dynamic behavior analysis results in the following manner.

[0122] First, obtain the identification of at least one specific component of the application to be detected and the running order of at least one specific component. For example, the specific component is an activity component. In some embodiments, the identification of the specific component and its running order are obtained by using androidguard (an open source static analysis tool).

[0123] Then, in accordance with the running order, the specific components corresponding to the identifiers of each specific component are started in sequence, and each started specific component is controlled to run for a specified time. For example, the command line adb-s IP:PORT shell am start-nPACKAGE / ACTIVITY is used to run each specific component. In some embodiments, the specified time is 6 seconds.

[0124] Finally, a screenshot operation is performed on the running interface corresponding to each specific component that is started, and the screenshot of the running interface obtained is used as part of the dynamic behavior analysis results. For example, the command line adb screencap-p / sdcard / screen.png is used to perform the screenshot operation. In some embodiments, all screenshots can be saved in a specific directory to provide important evidence support for privacy auditors when reviewing terms such as "whether the application provides an account cancellation function", "whether the application provides a feedback channel", and "whether the privacy terms of the application are clear and concise".

[0125] In step S140, the communication flow data of the entire life cycle of the application to be detected is obtained, and the communication flow data includes a communication URL and a communication data packet.

[0126] In step S150, based on the communication data packets corresponding to each communication URL, the sensitive information and sensitive information category corresponding to each communication URL are determined as the traffic analysis result.

[0127] In some embodiments, the communication data packets corresponding to each communication URL can be detected to obtain sensitive information that complies with preset rules as the sensitive information corresponding to each communication URL; based on the correspondence between the preset rules and the sensitive information categories, the sensitive information category corresponding to each communication URL is determined.

[0128] For example, the preset rules include regular matching rules for personal privacy data such as mobile phone number, ID number, email address, bank card number, MAC (Media Access Control Address, Media Access Control Address) address, device ID number, etc. For example, the regular matching rules for personal privacy data such as mobile phone number, ID number, email address, bank card number, MAC address, device ID number, etc. correspond to sensitive information categories such as phone, mail, card, BankCard, mac, deviceid, etc.

[0129] In some embodiments, the flow analysis results can be stored in the structured variable analysisFlows. analysisFlows = (Sensitive, Flag, url), where the Sensitive field represents sensitive information, and the value of Sensitive includes specific mobile phone numbers, ID card numbers and other sensitive information. Flag represents sensitive categories such as phone, mail, card, BankCard, mac, deviceid, etc. url represents the communication URL. This structured variable is part of the flow analysis.

[0130] For example, the mitproxy technology can be used to capture the traffic data (communication data packets) generated by the application to be detected during operation, and the rule matching engine method can be used to complete the detection of personal sensitive information transmitted and collected by the application to be detected.

[0131] Before using mitproxy technology to capture all communication traffic during the entire life cycle of the application to be detected, from installation to uninstallation, you must first configure the proxy IP (Internet Protocol) address and proxy port, and then use the command line Adb settings put global http_proxy ProxyIp:ProxyPort to achieve automatic proxy hanging. ProxyIp is the configured proxy IP, and ProxyPort is the configured proxy port.

[0132] In step S160, the static analysis results, dynamic behavior analysis results, and traffic analysis results are integrated to obtain privacy detection results. For example, the static analysis results, dynamic behavior analysis results, and traffic analysis results are stored in the same privacy detection report.

[0133] In the above embodiment, not only the permission-related information of the privacy interface is used, but also the permission-related information of the third-party SDK is combined, so that the static analysis results are more accurate and comprehensive. In addition, the above embodiment integrates static analysis, dynamic analysis and traffic analysis, further improving the accuracy and comprehensiveness of privacy detection.

[0134] Figure 3 is a block diagram showing a privacy detection device according to some embodiments of the present disclosure.

[0135] like Figure 3 As shown, the privacy detection device 3 includes a static stain analysis module 31 , a static analysis module 32 , a dynamic behavior analysis module 33 , an acquisition module 34 , a determination module 35 and a fusion module 36 .

[0136] The static taint analysis module 31 is configured to perform static taint analysis on the application to be detected to obtain at least one static taint propagation path, for example, Figure 1 Step S110 shown in FIG. 1 . Each static taint propagation path includes a source interface identifier and a destination interface identifier.

[0137] The static analysis module 32 is configured to perform static analysis on the application to be detected based on the permission-related information of at least one privacy interface, the permission-related information of at least one third-party SDK, and at least one static taint propagation path, and obtain a static analysis result, such as executing Figure 1 Step S120 is shown.

[0138] The dynamic behavior analysis module 33 is configured to perform dynamic behavior analysis on the application to be detected and obtain dynamic behavior analysis results, such as performing the following steps: Figure 1 Step S130 is shown.

[0139] The acquisition module 34 is configured to acquire the communication flow data of the entire life cycle of the application to be detected, for example, by executing Figure 1 The communication flow data includes a communication uniform resource locator URL and a communication data packet.

[0140] The determination module 35 is configured to determine the sensitive information and sensitive information category corresponding to each communication URL according to the communication data packet corresponding to each communication URL as the flow analysis result, for example, performing the following steps: Figure 1 Step S150 is shown.

[0141] The fusion module 36 is configured to fuse the static analysis results, the dynamic behavior analysis results and the traffic analysis results to obtain the privacy detection results, for example, Figure 1 Step S160 is shown.

[0142] Figure 4 is a block diagram showing a privacy detection device according to some other embodiments of the present disclosure.

[0143] like Figure 4 As shown, the privacy detection device 4 includes a memory 41; and a processor 42 coupled to the memory 41. The memory 41 is used to store instructions for executing the corresponding embodiments of the privacy detection method. The processor 42 is configured to execute the privacy detection method in any of the embodiments of the present disclosure based on the instructions stored in the memory 41.

[0144] Figure 5 is a block diagram illustrating a computer system for implementing some embodiments of the present disclosure.

[0145] like Figure 5 As shown, the computer system 50 may be embodied in the form of a general purpose computing device. The computer system 50 includes a memory 510, a processor 520, and a bus 500 that connects the various system components.

[0146] The memory 510 may include, for example, a system memory, a non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application, a boot loader, and other programs. The system memory may include a volatile storage medium, such as a random access memory (RAM) and / or a cache memory. The non-volatile storage medium may store, for example, instructions for executing at least one of the corresponding embodiments of the privacy detection method. The non-volatile storage medium includes, but is not limited to, a disk memory, an optical memory, a flash memory, etc.

[0147] The processor 520 can be implemented by a general processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistors, etc. Discrete hardware components. Accordingly, each module such as the judgment module and the determination module can be implemented by a central processing unit (CPU) running instructions in a memory that execute corresponding steps, or can be implemented by a dedicated circuit that executes corresponding steps.

[0148] The bus 500 may use any of a variety of bus architectures, including, but not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, and a Peripheral Component Interconnect (PCI) bus.

[0149] The computer system 50 may also include an input / output interface 530, a network interface 540, a storage interface 550, etc. These interfaces 530, 540, 550, the memory 510, and the processor 520 may be connected via a bus 500. The input / output interface 530 may provide a connection interface for input / output devices such as a display, a mouse, and a keyboard. The network interface 540 may provide a connection interface for various networked devices. The storage interface 550 may provide a connection interface for external storage devices such as a floppy disk, a USB flash drive, and an SD card.

[0150] Here, various aspects of the present disclosure are described with reference to flowcharts and / or block diagrams of methods, devices, and computer program products according to embodiments of the present disclosure. It should be understood that each frame of the flowchart and / or block diagram and the combination of frames can be implemented by computer-readable program instructions.

[0151] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable device to produce a machine, so that the processor executes the instructions to produce means for implementing the functions specified in one or more blocks in the flowchart and / or block diagram.

[0152] These computer-readable program instructions may also be stored in a computer-readable memory, which cause the computer to work in a specific manner to produce an article of manufacture, including instructions for implementing the functions specified in one or more blocks in the flowchart and / or block diagram.

[0153] The present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects.

[0154] The privacy detection method and device, and computer storable medium in the above embodiments can improve the accuracy and comprehensiveness of privacy detection.

[0155] So far, the privacy detection method and device, and computer storable medium according to the present disclosure have been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.

Claims

1. A privacy detection method, comprising: Perform static taint analysis on the application to be detected to obtain at least one static taint propagation path, each static taint propagation path including a source interface identifier and a destination interface identifier; According to the permission-related information of at least one privacy interface, the permission-related information of at least one third-party software development kit SDK, and the at least one static taint propagation path, static analysis is performed on the application to be detected to obtain a static analysis result; Performing dynamic behavior analysis on the application to be detected to obtain dynamic behavior analysis results, including: monitoring multiple preset privacy interface functions during the running of the application to be detected to obtain dynamic privacy context information corresponding to each privacy interface function as part of the dynamic behavior analysis results; monitoring the screen state changes of the application to be detected during the running of the application to be detected; in the case of changes in the screen state, parsing the current running interface to obtain attribute values ​​of multiple attributes of each control; for each control, obtaining the attribute value of at least one specified attribute from the attribute values ​​of the multiple attributes; for each control, when the attribute value of the at least one specified attribute satisfies a preset condition, performing a target operation corresponding to the preset condition satisfied by the attribute value on each control; Acquire communication flow data in the entire life cycle of the application to be detected, wherein the communication flow data includes a communication uniform resource locator URL and a communication data packet; Determine, according to the communication data packets corresponding to each communication URL, the sensitive information and the sensitive information category corresponding to each communication URL as the traffic analysis result; The static analysis result, the dynamic behavior analysis result and the traffic analysis result are integrated to obtain a privacy detection result.

2. The privacy detection method according to claim 1, wherein: Perform static analysis on the application to be detected, and obtain static analysis results including: Constructing static privacy context information of each static taint propagation path according to permission-related information of at least one privacy interface, permission-related information of at least one third-party SDK, and the at least one static taint propagation path; The static privacy context information of the at least one static taint propagation path is used to perform static analysis on the application to be detected to obtain a static analysis result.

3. The privacy detection method according to claim 2, wherein: The permission-related information of each privacy interface includes the privacy interface identifier and other interface permission-related information. The permission-related information of each third-party SDK includes the SDK identifier, at least one SDK privacy path where the third-party SDK is located, and other SDK permission-related information. The static privacy context information for constructing each static taint propagation path includes: For each static taint propagation path, when the source interface identifier belongs to the privacy interface identifier in the permission-related information of the at least one privacy interface, obtaining other interface permission information corresponding to the source interface identifier; Obtaining a path where a destination interface corresponds to a destination interface identifier of each static taint propagation path; In a case where the path where the destination interface is located belongs to at least one SDK privacy path in the permission-related information of the at least one third-party SDK, obtaining other SDK permission information corresponding to the path where the destination interface is located; Static privacy context information of each static taint propagation path is constructed based on the source interface identifier, other interface permission information corresponding to the source interface identifier, the destination interface identifier, the path where the destination interface is located, and other SDK permission information corresponding to the path where the destination interface is located.

4. The privacy detection method according to claim 3, wherein: The static analysis includes determining the privacy type, the other interface permission information includes actual permission information, and the actual permission information is permission information actually used when the privacy interface is called. Using the static privacy context information of the at least one static taint propagation path, the static analysis of the application to be detected includes: According to the correspondence between the privacy type and the actual permission information and the actual permission information in the static privacy context information of each static taint propagation path, the privacy type of the static privacy context information of each static taint propagation path is determined as part of the static analysis result.

5. The privacy detection method according to claim 3, wherein: The static analysis includes redundant permission determination, the other interface permission information includes actual permission information, and the actual permission information is permission information actually used when the privacy interface is called. Using the static privacy context information of the at least one static taint propagation path, the static analysis of the application to be detected includes: Acquire at least one piece of declared permission information of the application to be detected, where the declared permission information represents permission information that may be used by the application to be detected during its life cycle; For each piece of declared permission information, if the actual permission information in the static privacy context information of any static taint propagation path does not contain the declared permission information, it is determined that the declared permission information belongs to redundant permissions as part of the static analysis result.

6. The privacy detection method according to claim 5, wherein: Using the static privacy context information of the at least one static taint propagation path, statically analyzing the application to be detected further includes: For each piece of declared permission information, when there is at least one static taint propagation path whose actual permission information is the declared permission information, it is determined that the static privacy context information of the at least one static taint propagation path belongs to the usage scenario of the declared permission information corresponding to the actual permission information, as part of the static analysis result.

7. The privacy detection method according to claim 3, wherein: The static analysis includes redundant path determination, and using the static privacy context information of the at least one static taint propagation path, the static analysis of the application to be detected includes: Acquire at least one piece of declared permission information of the application to be detected, where the declared permission information represents permission information that may be used by the application to be detected during its life cycle; For the actual permission information in the static privacy context information of each static taint propagation path, when the actual permission information does not belong to the at least one declared permission information, it is determined that the static privacy context information of each static taint propagation path belongs to a redundant path, as part of the static analysis result.

8. The privacy detection method according to claim 7, wherein: Using the static privacy context information of the at least one static taint propagation path, statically analyzing the application to be detected further includes: In the case that the actual permission information belongs to the at least one declared permission information, it is determined that the static privacy context information of each static taint propagation path belongs to the usage scenario of the declared permission information corresponding to the actual permission information, as part of the static analysis result.

9. The privacy detection method according to claim 1, wherein: Determining, according to the communication data packet corresponding to each communication URL, the sensitive information and the sensitive information category corresponding to each communication URL includes: Detecting the communication data packets corresponding to each communication URL to obtain sensitive information that meets the preset rules as the sensitive information corresponding to each communication URL; According to the correspondence between the preset rules and the sensitive information categories, the sensitive information category corresponding to each communication URL is determined.

10. The privacy detection method according to claim 1, wherein: Performing dynamic behavior analysis on the application to be detected, and obtaining the dynamic behavior analysis result also includes: Obtaining an identifier of at least one specific component of the application to be detected and an operating order of the at least one specific component; Starting the specific components corresponding to the identifiers of each specific component in sequence according to the operation order, and controlling each started specific component to run for a specified time; A screenshot operation is performed on the running interface corresponding to each started specific component, and the screenshot of the running interface obtained is used as a part of the dynamic behavior analysis result.

11. A privacy detection device, comprising: A static taint analysis module is configured to perform static taint analysis on the application to be detected to obtain at least one static taint propagation path, each static taint propagation path including a source interface identifier and a destination interface identifier; A static analysis module is configured to perform static analysis on the application to be detected according to permission-related information of at least one privacy interface, permission-related information of at least one third-party software development kit SDK, and the at least one static taint propagation path to obtain a static analysis result; The dynamic behavior analysis module is configured to perform dynamic behavior analysis on the application to be detected and obtain dynamic behavior analysis results, including: during the operation of the application to be detected, monitoring multiple preset privacy interface functions to obtain dynamic privacy context information corresponding to each privacy interface function as part of the dynamic behavior analysis results; during the operation of the application to be detected, monitoring the screen state changes of the application to be detected; when the screen state changes, parsing the current running interface to obtain attribute values ​​of multiple attributes of each control; for each control, obtaining the attribute value of at least one specified attribute from the attribute values ​​of the multiple attributes; for each control, when the attribute value of the at least one specified attribute satisfies a preset condition, performing a target operation corresponding to the preset condition satisfied by the attribute value on each control; An acquisition module is configured to acquire communication flow data of the application to be detected in the entire life cycle, wherein the communication flow data includes a communication uniform resource locator URL and a communication data packet; A determination module is configured to determine, based on the communication data packets corresponding to each communication URL, the sensitive information and the sensitive information category corresponding to each communication URL as a traffic analysis result; The fusion module is configured to fuse the static analysis results, the dynamic behavior analysis results and the traffic analysis results to obtain a privacy detection result.

12. A privacy detection device, comprising: Memory; as well as A processor coupled to the memory, wherein the processor is configured to execute the privacy detection method according to any one of claims 1 to 10 based on instructions stored in the memory.

13. A computer storable medium having computer program instructions stored thereon, which, when executed by a processor, implement the privacy detection method according to any one of claims 1 to 10.

Images