A method, device and system for tracking information flow paths based on push-down automata

Abstract

The embodiments of the present application provide a method, device and system for information flow path tracking based on a push-down automaton. The method is applied to a server in an information flow path tracking system based on a push-down automaton. The method includes: receiving a first Android application installation package APK and a custom information flow strategy sent by a client; searching for an information flow path set from the first APK using a static taint analysis algorithm STA according to the custom information flow strategy; obtaining sensitive information flow paths from the information flow path set according to the custom information flow strategy; inserting a preset monitoring code into the sensitive information flow path in the first APK using a static insertion algorithm to obtain a second APK, and sending the second APK to the client; monitoring the status of the sensitive information flow path through the monitoring code, thereby achieving lightweight, low-loss, and fine-grained information flow path tracking, thereby solving the problem of excessive performance overhead of the dynamic taint analysis algorithm.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device and system for tracing an information flow path based on a push-down automaton. Background Art

[0002] As terminal devices become more and more popular, various applications that rely on terminal devices to run emerge in an endless stream. Due to commercial interests or untrusted third-party components, some popular applications, such as instant messaging, camera and navigation software, not only use sensitive information to complete normal functions, but also spread sensitive information without notifying users. When sensitive information is spread, there will be great security risks.

[0003] Currently, dynamic taint analysis (DTA) is used to control dynamic context information in order to find out which sensitive information is leaked at the release point. Although DTA has been proven to be effective in various security applications, the current DTA system has too much performance overhead and low efficiency, which seriously affects the application of DTA in production systems, especially on Android systems with limited computing and storage resources. At the same time, DTA's low code coverage will lead to a high false negative rate. Therefore, it is necessary to solve the problem of DTA's excessive performance overhead. Summary of the invention

[0004] In view of this, the purpose of this application is to provide a method, device and system for information flow path tracing based on push-down automata to achieve lightweight, low-loss, fine-grained information flow path tracing, thereby solving the problem of excessive performance overhead of dynamic taint analysis algorithm. The specific technical solution is as follows:

[0005] In a first aspect, the present application provides a method for information flow path tracking based on a push-down automaton, the method being applied to a server in an information flow path tracking system based on a push-down automaton, the information flow path tracking system based on a push-down automaton comprising the server and a client, the method comprising:

[0006] Receive a first Android application installation package APK and a custom information flow policy sent by the client, where the custom information flow policy is an information flow policy customized by a user for the application;

[0007] According to the custom information flow strategy, a static taint analysis algorithm STA is used to search for an information flow path set from the first APK;

[0008] According to the custom information flow strategy, obtaining a sensitive information flow path from the information flow path set;

[0009] Using a static instrumentation algorithm, inserting a preset monitoring code into the sensitive information flow path in the first APK to obtain a second APK, and sending the second APK to the client, so that the client runs the second APK after receiving the second APK;

[0010] The status of the sensitive information flow path is monitored by the monitoring code.

[0011] In a possible implementation, searching for an information flow path set from the first APK using a static taint analysis algorithm STA according to the custom information flow strategy includes:

[0012] Reading a source statement set in the custom information flow strategy;

[0013] The STA is used to search the first APK for a set of information flow paths starting from a source sentence in the source sentence set.

[0014] In a possible implementation, acquiring the sensitive information flow path from the information flow path set according to the custom information flow policy includes:

[0015] Reading a release point set in the custom information flow strategy;

[0016] In the information flow path set starting from a source sentence in the source sentence set, a sensitive information path ending at a release point in the release point set is obtained.

[0017] In a possible implementation, before inserting the monitoring code into the sensitive information flow path using a static instrumentation algorithm, the method further includes:

[0018] The sensitive information flow path is hierarchically managed through a multi-level hash mapping table.

[0019] In a possible implementation, after searching for an information flow path set from the first APK using a static taint analysis algorithm STA, the method further includes:

[0020] The key node information of all the information flow paths in the information flow path set is recorded in a string array.

[0021] In a second aspect, the present application further provides an information flow path tracking device based on a push-down automaton, the device being applied to a server in an information flow path tracking system based on a push-down automaton, the information flow path tracking system based on a push-down automaton comprising the server and a client, the device comprising:

[0022] A receiving module, used for receiving a first Android application installation package APK and a custom information flow policy sent by the client, wherein the custom information flow policy is an information flow policy customized by a user for the application;

[0023] A search module, configured to search for an information flow path set from the first APK using a static taint analysis algorithm STA according to the custom information flow strategy;

[0024] An acquisition module, configured to acquire a sensitive information flow path from the information flow path set according to the custom information flow strategy;

[0025] An instrumentation module, configured to insert a preset monitoring code into the sensitive information flow path in the first APK by using a static instrumentation algorithm to obtain a second APK, and send the second APK to the client, so that the client runs the second APK after receiving the second APK;

[0026] A monitoring module is used to monitor the status of the sensitive information flow path through the monitoring code.

[0027] In a possible implementation, the search module is specifically used to:

[0028] Reading a source statement set in the custom information flow strategy;

[0029] The STA is used to search the first APK for a set of information flow paths starting from a source sentence in the source sentence set.

[0030] In a possible implementation, the acquisition module is specifically used to:

[0031] Reading a release point set in the custom information flow strategy;

[0032] In the information flow path set starting from a source sentence in the source sentence set, a sensitive information path ending at a release point in the release point set is obtained.

[0033] In a possible implementation manner, the device further includes:

[0034] A management module is used to perform hierarchical management on the sensitive information flow path through a multi-level hash mapping table.

[0035] In a possible implementation manner, the device further includes:

[0036] The recording module is used to record the key node information of all information flow paths in the information flow path set in a string array.

[0037] In a third aspect, the present application also provides an information flow path tracking system based on a push-down automaton, comprising: a server and a client;

[0038] The server is used to execute the method described in the first aspect or any one of the first aspects;

[0039] The client is used to:

[0040] Sending a first Android application installation package APK and a custom information flow policy to the server, where the custom information flow policy is an information flow policy customized by a user for the application;

[0041] Receive a second APK sent by the server and run the second APK.

[0042] The information flow path tracking method based on push-down automaton provided in the embodiment of the present application receives the first Android application installation package APK and the custom information flow strategy sent by the client, and the custom information flow strategy is the information flow strategy customized by the user for the application; according to the custom information flow strategy, the static taint analysis algorithm STA is used to search for the information flow path set from the first APK; according to the custom information flow strategy, the sensitive information flow path is obtained from the information flow path set; the static plugging algorithm is used to insert the preset monitoring code into the sensitive information flow path in the first APK to obtain the second APK, and the second APK is sent to the client, so that the client runs the second APK after receiving the second APK; the state of the sensitive information flow path is monitored by the monitoring code. The solution only uses lightweight monitoring code for the target application, and does not involve microscopic and cumbersome variable-level taint tracking, thereby achieving fast and low-loss runtime information flow tracking analysis. In addition, STA is used to comprehensively search for sensitive information flow paths, which makes it easier to find implicit flow paths than the traditional DTA algorithm. By verifying paths that do not appear when the program is running, higher accuracy than DTA can be achieved, thereby enabling lightweight, low-loss, and fine-grained information flow path tracking, solving the problem of excessive performance overhead of the DTA algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 A flowchart of an embodiment of an information flow path tracking method based on a push-down automaton provided by the present application is shown;

[0045] Figure 2 A path control automaton model provided by the present application is shown;

[0046] Figure 3 A schematic diagram of the structure of an information flow path tracking device based on a push-down automaton provided by the present application is shown;

[0047] Figure 4 A structural schematic diagram of an information flow path tracking system based on a push-down automaton provided by the present application is shown. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] First, some terms that may appear in the embodiments of the present application are explained.

[0050] Dynamic taint analysis algorithm (DTA) detects whether data can be propagated from the taint source to the taint sink by monitoring the propagation of the taint data of the program in the system program in real time during program execution.

[0051] Static taint analysis (STA) detects whether data can be propagated from a taint source to a taint sink by analyzing the data dependencies between program variables without running or modifying the code.

[0052] Finite State Automata (FSA) is a computational model abstracted for studying computational processes with limited memory and certain language classes.

[0053] In order to overcome the bottleneck of information flow tracking technology performance overhead, current related research is committed to decoupling taint tracking logic from program execution. Based on this research direction, this application proposes an information flow path tracking system FSAFlow based on push-down automata, which can ensure good privacy protection while significantly reducing the DTA algorithm overhead. In the FSAFlow provided by this application, the path tracking logic is further separated from the corresponding taint tracking logic, achieving a more optimized control of the information flow path.

[0054] FSAFlow includes a server and a client. The workflow of FSAFlow is shown below.

[0055] Users can use the client to customize information flow policies for any application on the phone. By managing the information flow path from the source statement to the release point, users can obtain customized privacy policies, such as whether location information can be sent over the network or written to local files. The client then uploads the customized information flow policy to the server together with the corresponding Android application installation package (AndroidPackage, APK) to be processed.

[0056] On the server, FSAFlow performs static taint analysis and static instrumentation based on the custom information flow policy uploaded by the client. In the static taint analysis phase, all information flow paths are mined and sensitive information flow paths that violate privacy policies are marked. At the same time, key node information of all information flow paths is recorded in this phase. In the static instrumentation processing phase, important nodes of sensitive information flow paths that need to be monitored are instrumented to achieve effective path state management. Then, the instrumented code is repackaged to generate a new APK file and sent back to the client.

[0057] Based on the above process, the security-enhanced application will be reinstalled on the user's mobile phone to run efficiently and be under monitoring.

[0058] See also Figure 1 , shows a flowchart of an information flow path detection method based on a push-down automaton provided in an embodiment of the present application, the method is executed by a server, and the embodiment of the present application at least includes the following steps:

[0059] S110, receiving a first Android application installation package APK and a custom information flow strategy sent by the client.

[0060] In an embodiment of the present application, a user uses a client to customize an information flow policy for any application on a mobile phone. Then, the client uploads the customized information flow policy to the server together with the corresponding APK to be processed (i.e., the first APK). The server receives the first APK and the customized information flow policy sent by the client, so that the server monitors the application corresponding to the first APK according to the customized information flow policy. Among them, the customized information flow policy is the information flow policy customized by the user for any application on the mobile phone.

[0061] S120: According to the custom information flow strategy, a static taint analysis algorithm STA is used to search for an information flow path set from the first APK.

[0062] In an embodiment of the present application, the server searches for an information flow path set from the first APK using the STA algorithm based on the received custom information flow strategy.

[0063] According to the custom information flow strategy, one implementation method of using the static taint analysis algorithm STA to search for a set of information flow paths from the first APK may be to read the source statement set in the custom information flow strategy, and use STA to search for a set of information flow paths starting from the source statement in the source statement set from the first APK.

[0064] S130: Acquire a sensitive information flow path from the information flow path set according to the custom information flow policy.

[0065] In an embodiment of the present application, after obtaining the information flow path set in the first APK, the server obtains the sensitive information flow path from the information flow path set according to the custom information flow strategy.

[0066] According to the custom information flow strategy, one implementation method of obtaining a sensitive information flow path from an information flow path set may be to read a release point set in the custom information flow strategy, and obtain a sensitive information path with a release point in the release point set as an end point in the information flow path set starting from a source statement in the source statement set.

[0067] The STA algorithm is designed to efficiently search the entire program and mark potential sensitive information flow paths. In the embodiment of the present application, the STA algorithm is implemented by modifying the classic IFDS (Interprocedural Finite Distributive Subset) framework and FlowDroid tool. Many static analysis problems, including taint analysis, pointer analysis, active variables and constant propagation, etc., can be solved by IFDS using a special graph reachability algorithm.

[0068] IFDS consists of (G # , D, F, M, Π) represents, where G # =(N # , E # ) is called the Interprocess Control Flow Graph (ICFG), which provides a directed hypergraph representation of the program. Each n corresponds to a statement in the program, n∈N # , (n1, n2)∈E # Indicates that statement n2 is the direct successor of statement n1. D is a finite set of information flow facts, representing the contaminated variables. is a set of information flow functions. A flow function defines the effect of a statement on a set of flow facts. For example, a statement s:x=y is associated with a flow function that maps a set of facts {y} (i.e., y is tainted) to a set of facts {x, y} (i.e., both x and y are tainted), which can be expressed as {x, y}=f s ({y}). M:E # →F is from G # The mapping of edges to flow functions satisfies the taint analysis Π operation.

[0069] G # It consists of a set of flow graphs {G1, G2, ...}, one for each function. function From the unique starting node s function , the only ending node e function and the remaining nodes representing the statements and predicates in function. # In the example, statement m that calls function h is represented by two nodes, one of which is the call node c. m , and the other is to return node r m At this point, there are three edges connecting m and h: m to r m The call-to-return edge, from c m to h The call-to-start edge, from e h to r m The exit-to-return edge.

[0070] In order to transform the static analysis problem into a graph reachability problem, G # Expanded to a hypergraph G * =(N * , E * ),in, E * ={<u,d x >→<v,d y >|(u,v)∈E # , d y ∈f u (d x )}. For example, if y is contaminated before n1, then (n1:x=y→n2:z=x)∈E # It can be expanded to {(<n1,y>→<n2,y>,<n1,x>→<n2,y>)}∈E * It should be noted that The empty set representing a set of facts.

[0071] Based on the definition of the stream function, IFDS performs a breadth-first traversal of the ICFG from the source statement. * Search for sensitive information flow paths ending at the release point in G. * There are slave nodes in If there is a path to the node <nfinal:sink(x),z>, the sequence of statements corresponding to the nodes on the path constitutes the sensitive information flow path from the source statement to the release point.

[0072] Since branch jumps are key nodes that distinguish different paths, it is necessary to record the context of branch nodes on the path. Monitoring points are mainly installed on branches. In addition, the context of function calls and returns will be recorded as auxiliary information to locate the function body of the branch during the detection phase.

[0073] FSAFlow continues to * Expand to G ^ =(N ^ , E ^ ), where N^=N * × string, E^={<u,d x , P FSA >→<v,d y , P FSA >|(u,v)∈E * , d y ∈f u (d x )}. String array P FSA Record the key node information used to identify all information flow paths in the information flow path set so far, including the context of branch statements and call / return statements, etc. In the embodiment of the present application, searching for paths and recording paths are performed simultaneously. The specific static taint analysis algorithm is shown in Table 1.

[0074] Table 1 Static taint analysis algorithm

[0075]

[0076]

[0077] In the STA algorithm, the source statement set Sourcelist and the release point set Sinklist are obtained by reading the custom information flow strategy. # First, search for G #To find the source statement set. Then, take each source statement as the starting point, traverse E^, and search for the information flow path with the release point as the end point. The searched paths are recorded in the list pathedge, and these searched paths will not be searched again (such as lines 12-13 of Table 1). The worklist Worklist records the set of paths that still need to be searched, and the newly found paths are added to the Worklist (such as lines 7, 23, 27 of Table 1, etc.), and the searched paths will be deleted from the Worklist (such as line 11 of Table 1).

[0078] String array P FSA Store the key node information of each information flow path in order. FSA In the example, different node information is separated by a special separator. FSAFlow extracts different key information for different statement types.

[0079] (1) The statement type is release point sink (such as lines 16-18 in Table 1), indicating that the sensitive information flow path has been found. At this time, the path extension is terminated and P is output. FSA .

[0080] (2) The statement type is function call (see lines 19-27 in Table 1). If this node is encountered for the first time, the call node information about the caller and the callee is appended to P FSA , and extend the path to the callee. Otherwise, a new extended path fragment Part about the callee can be extracted from the summary hash table Summaryhash FSA , and then perform a search on the returned node. The Summaryhash stores the path fragments of the information flow path when it flows through the function.

[0081] (3) The statement type is function return (as shown in lines 28-33 of Table 1). The summary function is added to Summaryhash so that when the summary function appears again in the future, the summary of the summary function can be directly reused. Then, the algorithm returns to the call node and continues to expand the next statement.

[0082] (4) The statement type is assignment (see lines 34-38 of Table 1). FSA will not be updated. Assignment statements are not critical information for FSAFlow, but aliasing issues need to be considered in this case. FSAFlow performs on-demand alias analysis. When a variable is tainted, FSAFlow searches backwards for aliases of the tainted variable and then taints those aliases. The result variable output by the alias analysis function, the current statement, and P FSATogether they form a new node in N^. This new node is used to continue the forward data flow analysis.

[0083] (5) The statement type is branch (see lines 39-47 of Table 1). The first statement m in the branch path s Information p Attached to P as a node FSA Node m p By tuple<sn,size,no,type,sn’,m> Composition, where sn represents m p In P FSA The position in the loop; size indicates the branch number of the branch; no indicates the branch sequence number of the target path; type indicates the node type, indicating which branch type the selected branch belongs to; m indicates the statement itself. The node type can be in (insert into the loop body), out (exit the loop body) and x (other). If m s If it appears multiple times on the path within the current function, sn' means m s First appeared in P FSA Finally, when the output P FSA When P FSA Remove m from the node.

[0084] The main structure of the path obtained through static taint analysis is shown in Table 2. FSAFlow operates on Jimple statements, so the output path is also represented by Jimple statements for subsequent detection. Jimple is an intermediate file from Java Source files to Java Class files generated by the SOOT tool.

[0085] Table 2 Main structures of paths obtained by static taint analysis

[0086]

[0087] S140, using a static instrumentation algorithm to insert a preset monitoring code into the sensitive information flow path in the first APK to obtain a second APK, and sending the second APK to the client, so that the client runs the second APK after receiving the second APK.

[0088] In an embodiment of the present application, the server uses static insertion to insert a preset monitoring code into the sensitive information flow path in the first APK, obtains a second APK based on the first APK in which the monitoring code is inserted, and sends the second APK to the client so that the client can install the application based on the second APK.

[0089] Before static instrumentation, FSAFlow FSADue to the existence of loop structure, statements may appear repeatedly on the path, so P FSA The statements in are summarized. Let SN be the set of all positions {sn} where statement m appears on the path. FSAFlow appends SN to the node where m first appears on the path so that the position of m is only inserted once. After attachment, other nodes about m are retained on the path to ensure the consistency of control information flow when inserting other nodes. In addition, each loop structure involved in the path is assigned a unique identifier to facilitate state monitoring in nested loops.

[0090] In addition, according to the class, method and path identification, you can also use a multi-level hash map HashMap policy The sensitive information flow path is managed hierarchically so that each participating class and method is traversed only once. policy The data structure is <classname,<method,<pathid,pathfragment> >>, can be directly accessed through multi-level key values. Based on this, each key value of the method index can store fragment information of multiple paths. Pathfragment only stores branch nodes. It should be noted that the nodes associated with the function call on the path can be deleted and will not appear in the HashMappolicy. Subsequent detection is also performed based on the HashMappolicy.

[0091] FSAFlow extends the BodyTransformer of the SOOT tool and implements the internalTransform method to traverse all units (statements) of the method body and insert monitoring code at the specified location. Table 3 describes the static instrumentation process in detail.

[0092] Table 3 Static instrumentation algorithm

[0093]

[0094]

[0095] HashMap policy The classes that appear in are loaded one by one from the actual class files, and then the methods in the class files are parsed one by one. For each method, policy Extract the corresponding path identifier and path segment from the node. There are three cases for node processing:

[0096] (1) If it matches the source type, the corresponding state variable is found and the monitoring code is inserted in front of it, so that the monitoring of the specified path can be activated when the application is running.

[0097] (2) If it matches the branch type, find the next branch of the current position. For different subsequent paths, according to the subsequent Table 5, insert the corresponding monitoring code before the first statement of the subsequent sensitive information flow path. If the node is not the first repeated node (sn'=-1), it means that the node has been processed and can be ignored.

[0098] (3) If it matches the release point type, the corresponding statement will be found and the control code will be inserted before the statement, so that information flow control and auditing can be performed.

[0099] A method can be called multiple times in a path. It should be noted that the newinvoke node can be used to update the current stub position to the beginning of the method.

[0100] In the embodiment of the present application, by traversing the HashMap policy After completing the code stubs of the relevant class files, a new set of class files can be obtained. Then, all the new class files are repackaged into .dex files to replace the .dex files in the first APK file. The first APK file after replacing the .dex file is compressed to generate a second APK file.

[0101] S150: Monitor the state of the sensitive information flow path through the monitoring code.

[0102] In the embodiment of the present application, by static plugging, the information flow can be monitored when the application is running normally. Although it is not common to reuse and recalculate sensitive information flows in loop structures, in order to ensure the robustness of FSAFlow, the embodiment of the present application considers the propagation of sensitive information flows in loops or nested loops. The code snippet shown in Table 4 is used as an example to illustrate the monitoring mechanism when the application is running.

[0103] Table 4 Code snippets for sensitive information flow propagation in loop structures

[0104]

[0105] If we use the IFDS algorithm to analyze the above example, we will find that program N is * Nodes in<s3,td> ,<s3,in> ,<s3,a> ,<s3,b> ,<s3,c> When IFDS tries to traverse s3 for the fourth time, it finds that there are no new nodes available for path extension. Therefore, IFDS stops traversing the loop body and continues traversing s6. Finally, the output path s0-s1-s21-s31-s41-s51-s22-s32-s42-s52-s23-s33-s43-s53-s6 is nIt indicates the nth execution of si, while the actual execution path is s0-s1-s21-s31-s41-s51-s22-s32-s42-s52-s23-s33-s43-s53-s24-s34-s44-s54-s6, which leads to information leakage and information omission in IFDS. In fact, all static information flow analysis techniques may face this problem.

[0106] To better handle this problem, the taint propagation process is divided into three stages along the path:

[0107] 1) Forward propagation phase (N): The execution statement is outside the loop body, corresponding to the execution phase of s1 and s6.

[0108] 2) Loop propagation phase (P): The execution statements are in the loop body, and according to IFDS, there are still new node expansions corresponding to the execution phase of “s21-s31-s41-s51-s22-s32-s42-s52-s23-s33-s43-s53” in the current loop.

[0109] 3) Loop stabilization phase (S): The execution statement is in the loop body, and according to IFDS, no new nodes are expanded in the current loop. IFDS no longer tracks the execution of this phase, which corresponds to the execution phase of "s24-s34-s44-s54".

[0110] Although IFDS does not analyze the S phase to avoid the problem of path length explosion, it still achieves good accuracy. However, further monitoring of the S phase is beneficial. If there is a leakage path that includes the S phase, it will cause information leakage in IFDS. It is difficult to determine the actual number of cycles executed in the S phase using the STA algorithm, so using an overly accurate STA algorithm for the S phase can easily lead to excessive overhead. Therefore, a more effective and reasonable method is needed to monitor the S phase.

[0111] Before the execution enters the S phase of the loop, it has actually gone through the P phase and reached the maximum taint state through taint accumulation. Therefore, repeated execution of the same code segment of the loop in the S phase tends to stabilize to maintain the maximum taint state of the loop. In fact, the code in the loop may be repeated logical behavior, such as scientific calculations, file reading and writing, etc. The execution of the path usually does not change the final propagation state of the P phase. Therefore, these paths are still valid, but they are ineffective in propagation.

[0112] In the embodiment of the present application, FSAFlow is used to monitor the S stage to ensure safety. In most cases, FSAFlow still only monitors key branch nodes to ensure performance and correctness. In a few cases, misjudgment may occur in the S stage. At this time, the monitoring strategy of the path is modified to no longer monitor the S stage to reduce misjudgment.

[0113] In the embodiment of the present application, FSAFlow implements path control based on push-down automata, which is an extension of finite state automata FSA and consists of a state controller, input, and stack. Figure 2 As shown, formally, given the path path output by static analysis, and assuming its length is N, the corresponding automaton at runtime is expressed as M = (Q, ∑, Γ, δ, q0, F), where:

[0114] (1) Q is a finite set of states. Each node i on the path corresponds to state q. i (i>0). q0 corresponds to the inactive state of the path, q1 corresponds to the source point, and q n corresponds to the release point.

[0115] (2)∑:SNs×TYPE×L ID is the input alphabet. Each input symbol corresponds to a monitoring point of FSAFlow, and the input sequence represents the execution order of the monitoring points of the program execution. The input symbol σ consists of a tuple (SNs, type, l id ) {0,1,...,N} is the set of allowed node numbers corresponding to the monitoring point. Each node on the path is assigned a node number i in sequence. In particular, SNs = {0} indicates that the monitoring point is located on a non-target branch path. type∈{in,out,x} indicates the type of monitoring point location. in / out / x indicates that the monitoring point is a loop structure and other types of entry / exit points, respectively. id Indicates the identifier of the loop structure. If type = x, then l id =-1.

[0116] (3)Γ=Peroid×L ID is the stack alphabet. The stack is a "last in, first out" storage device that can record the corresponding execution phase of the loop in the nested loop execution. Peroid: {N, P, S} represents the forward propagation phase (N), loop propagation phase (P), and loop stabilization phase (S) respectively. L ID is a set of cyclic IDs. If Peroid=S, then L ID =-1.

[0117] (4)δ:Q×∑×Γ→Q×Γ is a transition function. According to the current state, the current input and the symbol at the top of the stack, the next action of the automaton M is determined, including state transition and Push or Pop operation on the stack.

[0118] (5)q0∈Q is the initial state, indicating that the path is not activated.

[0119] (6) is the set of accepting states.

[0120] Table 5 lists the transition functions of automaton M. Automaton M starts from state q0 and an empty stack. After executing the source statement, it reaches state q1 and enters the N phase. In the N phase, when encountering a branch jump such as If / Switch, if the jump target points to the next node in the path, the state will be updated one step forward; when encountering a While / For loop, automaton M will enter the P phase, if both the jump target and the target path need to enter the loop body, the state will be updated one step forward. In the P phase, when encountering a branch jump, if the jump target points to the next node in the path, the state will be updated one step forward; otherwise, when the next node in the path points to the loop exit branch, if the branch jump enters the loop body again, automaton M will enter the S phase. In this case, the loop structure continues to be executed after the execution reaches the maximum value of the taint propagation on the path. In the S phase, branches that will not jump out of the loop structure will be continuously monitored, and the path state remains unchanged. When encountering a branch that jumps out of the loop structure, automaton M will pop the stack and restore the last phase indicated by the stack to the current phase. Then, tracking and monitoring will continue according to different phase requirements. In the P phase or S phase, if the automaton M determines to enter a different loop mechanism by distinguishing the loop structure identifier, loop nesting will occur. In this case, the new stage information will be pushed into the stack, and the allocation of the new stage is the same as the allocation of the current stage. If other situations are encountered, the automaton M will return to state q0 and clear the stack. Among them, a and - in Table 5 represent wildcards. By deleting rules 7 and 10 in Table 5, FSAFlow is able to track any path output by the STA algorithm.

[0121] Table 5 Transition function of automaton M

[0122]

[0123] FSAFlow uses global variables to record the execution status and stack of all monitored sensitive information flow paths. Figure 2 As shown in Figure 6, there are four monitoring points. The main monitoring codes of these monitoring points are shown in Table 6.

[0124] Table 6 Monitoring Code

[0125]

[0126]

[0127] If the statement is executed to the monitoring point corresponding to the release point, FSAFlow checks whether the currently executed statement matches the required state. If so, FSAFlow intercepts the sensitive data transmitted by the release point. If the intercepted sensitive data is a number, the sensitive data is assigned to 0. If the intercepted sensitive data is character data, the character data is replaced with the ASCII code of 0. In order to prevent the use of the length of sensitive data for covert communication, the random number generation application program interface (Application Program Interface, API) is further called to randomly determine the length of the cleared character data. Finally, in order not to affect the normal function of the application, the purified data will be passed to the path release point for continued execution. Optionally, the user is prompted with the intercepted information.

[0128] In the embodiment of the present application, given a program Q, for any path path found by IFDS / FlowDroid, FSAFlow that is not in a stable phase can report the path if and only if the path appears when Q is running.

[0129] Assume that IFDS / FlowDroid sets the path path = s1 → s2 → ... → s i →...→s j →...→s k →s m It is judged as a leakage path, where s1 is the source node and s m is the release point. The jump statement can be used as a split node, and the path is represented as a basic block sequence B1→B2→B3→...→B n . FSAFlow in each B i Insert a monitoring point M in front Bi , and convert Q to Q'. A basic block refers to a series of statements that are executed in a program in sequence with only one entry and one exit. Only the last instruction in a basic block can cause execution to enter other basic blocks.

[0130] In executing any B i Before, first execute its M Bi According to the conversion function in Table 5, if the previous state is q i-1 , M Bi The execution of updates the state to q i When the source statement is executed, path is activated and Q' reaches state q1 from the initial state q0. i to q i+1Any state transition indicates that B is being executed. i After that, B i+1 The code will then be executed. It is necessary to exclude i Convert to B i+1 The possibility of executing other blocks during the execution. Suppose there is an execution path B i →E1→E2→...→E X →B i+1 , first, E1 appears on the path, and the position set of E1 on the path is marked as K = {k|k≠i+1, B k =E1}, monitoring point M of E1 E1 The SNs are equal to K. In B i After that, before executing E1, first execute M E1 According to the conversion function, M E1 Restore the path state to q0, because If rules 2 to 6 are not met, it means that the current path is stopped. i Execute B i →E1→E2→…→E X →B i+1 When the state is not changed from the current path's q i Enter q i+1 , the state transition in the current path can only be made from B i Directly execute to B i+1 Secondly, E1 is not a basic block on the path, and the monitoring point M of E1 E1 The SNs of M is {0}. Obviously, if M E1 , FSAFlow will restore the state to q0 and stop tracking the current path. Therefore, if and only if in executing B i When Bi+1 is executed immediately afterwards, the state changes from q i Convert to q i+1 In addition, the generalized state transition q1→q2→…→q n Must be accompanied by the path B1→B2→B3→…→B n Therefore, execution reaches q if and only if path occurs. n state.

[0131] In the embodiment of the present application, given a program Q, F is the set of statements in Q. Assume that u paths are monitored in Q, the average number of different branch nodes on the path is n, and the average number of statements at the monitoring point is r. Then, the average overhead of FSAFlow during runtime is nru / |F|.

[0132] Given a path path, according to the FSAFlow static instrumentation mechanism, monitoring points can only be set on branch nodes. In addition, repeated branch nodes share one monitoring point. The execution frequency of a monitoring point depends on the execution frequency of the corresponding branch statement. Assume that all statements in F are executed uniformly, and path has n different branch nodes. Then, the execution frequency ratio of all monitoring points of path is n / |F|. If the average number of executed statements of a monitoring point is r, the ratio of the average runtime overhead of monitoring path is nr / |F|. Extended to u paths, the ratio of FSAFlow runtime overhead is nru / |F|.

[0133] For r, the randomness of instruction execution needs to be considered. Most program executions do not follow sensitive information flow paths. Therefore, when the monitoring code of a monitoring point is executed, it is likely to be in the inactive state q0. For most monitoring points, the state transitions from q0 to q i (i≠1) is inconsistent with the conversion function, indicating that only the starting code of the monitoring point is executed, and subsequent complex judgments may not be executed. During the stable period of the loop, many set determination operations can be omitted. Therefore, the actual amount of code executed at each monitoring point may be small.

[0134] For u, only sensitive information flow paths that violate user-defined information flow policies are monitored, rather than all information flow paths. According to the analysis of actual software, such paths are usually rare in commercial software.

[0135] For n, the nodes on the path are mainly composed of sequential statements such as assignment, movement, and calculation. The number of branch statements of a path is usually much smaller than the path length. In addition, the path length is usually much smaller than |F|, so n is much smaller than |F|.

[0136] In general, since nru / |F|<< 1, the performance overhead can be very low. In comparison, in a DTA system that uses a line-by-line instruction tracking mechanism, it is assumed that each instruction requires an instruction for tracking, and these instructions are usually used to copy and calculate the taint in the shadow memory, making the overhead greater than 1, usually an order of magnitude higher, and the performance overhead is significantly higher than FSAFlow.

[0137] In addition, in the embodiment of the present application, the STA algorithm and the static instrumentation algorithm can be terminated.

[0138] In the STA algorithm, the list pathedge records the paths that have been searched. As each extended path is added, more variables will be contaminated. At the same time, after the first expansion analysis, each path will be inserted into the list pathedge. Subsequently, if the new extended path is in pathedge, indicating that the task is already being executed, this analysis will stop to avoid repeated analysis. As the path is expanded, the number of contaminated variables increases monotonically. Because the number of variables and the number of paths are both finite, the upper limit is that all variables are affected. Therefore, there is a graph search state in which all new extended edge tasks have been executed, so the STA algorithm can terminate.

[0139] During the search process, for single-source information flow tracing, the worst case is to search all expansion paths and pollute all variables. In this case, the complexity of the STA algorithm is O(|F||D|2), where F is the set of program statements and D is the set of program variables. Taking into account the verification of function duplicate nodes and assuming that the average number of statements in a method is k, the complexity of the STA algorithm is O(k|F||D|2). In addition, if backward alias analysis is considered, the complexity of the STA algorithm is O(k|F||D|4). However, in fact, the expansion edge of the calling function is only propagated and analyzed once, because after it is analyzed for the first time, it is recorded and summarized into a summary hash table Summaryhash. When the same expansion is encountered later, the summary function can be reused, especially when analyzing different call sites of the same method, the summary function can be reused to improve efficiency.

[0140] For static instrumentation algorithms, use a multi-level hash map HashMap policy Sensitive information flow paths are classified and recorded, and these paths are processed by method hierarchical processing. On this basis, the method of each class is analyzed only once, saving the preparation and waiting time for repeated access. The corresponding monitoring code is inserted into each branch node to monitor the path status. Because the path length and path set are both limited, the static instrumentation algorithm can terminate. For u paths, the average number of branch nodes of a path is represented as v, then the complexity of the static instrumentation algorithm is O(uv), which mainly depends on the number of paths and the number of branch nodes.

[0141] In the embodiment of the present application, a first Android application installation package APK and a custom information flow strategy sent by a client are received, and the custom information flow strategy is an information flow strategy customized by the user for the application; according to the custom information flow strategy, a static taint analysis algorithm STA is used to search for a set of information flow paths from the first APK; according to the custom information flow strategy, a sensitive information flow path is obtained from the set of information flow paths; a static plugging algorithm is used to insert a preset monitoring code into the sensitive information flow path in the first APK to obtain a second APK, and the second APK is sent to the client, so that the client runs the second APK after receiving the second APK; the state of the sensitive information flow path is monitored by the monitoring code. With this solution, only lightweight monitoring code is used for the target application, and microscopic and cumbersome variable-level taint tracking is not involved, thereby realizing fast and low-loss runtime information flow tracking analysis. And using STA to comprehensively search for sensitive information flow paths, it is easier to find implicit flow paths than the traditional DTA algorithm. By verifying the paths that do not appear when the program is running, a higher accuracy than DTA can be achieved, thereby realizing lightweight, low-loss, and fine-grained information flow path tracking, solving the problem of excessive performance overhead of the DTA algorithm.

[0142] Next, an information flow path detection device based on a push-down automaton provided in the present application is introduced. The information flow path detection device based on a push-down automaton introduced below and the information flow path detection method based on a push-down automaton introduced above can refer to each other.

[0143] See also Figure 3 , showing a schematic diagram of the structure of an information flow path detection device based on a push-down automaton provided by the present application, the device comprising:

[0144] The receiving module 301 is used to receive the first Android application installation package APK and the custom information flow strategy sent by the client, wherein the custom information flow strategy is the information flow strategy customized by the user for the application.

[0145] A search module 302 is used to search for an information flow path set from the first APK using a static taint analysis algorithm STA according to the custom information flow strategy;

[0146] An acquisition module 303, configured to acquire a sensitive information flow path from the information flow path set according to the custom information flow strategy;

[0147] The plugging module 304 is used to insert a preset monitoring code into the sensitive information flow path in the first APK by using a static plugging algorithm to obtain a second APK, and send the second APK to the client, so that the client runs the second APK after receiving the second APK;

[0148] The monitoring module 305 is used to monitor the state of the sensitive information flow path through the monitoring code.

[0149] In the embodiment of the present application, the search module 302 is specifically used for:

[0150] Reading a source statement set in the custom information flow strategy;

[0151] The STA is used to search the first APK for a set of information flow paths starting from a source sentence in the source sentence set.

[0152] In the embodiment of the present application, the acquisition module 303 is specifically used for:

[0153] Reading a release point set in the custom information flow strategy;

[0154] In the information flow path set starting from a source sentence in the source sentence set, a sensitive information path ending at a release point in the release point set is obtained.

[0155] In the embodiment of the present application, the device further includes:

[0156] A management module is used to perform hierarchical management on the sensitive information flow path through a multi-level hash mapping table.

[0157] In the embodiment of the present application, the device further includes:

[0158] The recording module is used to record the key node information of all information flow paths in the information flow path set in a string array.

[0159] See also Figure 4 , showing a structural schematic diagram of an information flow path detection system based on a push-down automaton provided in the present application, the system comprising: a server 41 and a client 42.

[0160] Server 41, used to execute the information flow path detection method based on push-down automaton described in the above method embodiment;

[0161] Client 42, used for:

[0162] Sending a first Android application installation package APK and a custom information flow policy to the server, where the custom information flow policy is an information flow policy customized by a user for the application;

[0163] Receive a second APK sent by the server and run the second APK.

[0164] In the embodiment of the present application, a first Android application installation package APK and a custom information flow strategy sent by a client are received, and the custom information flow strategy is an information flow strategy customized by the user for the application; according to the custom information flow strategy, a static taint analysis algorithm STA is used to search for a set of information flow paths from the first APK; according to the custom information flow strategy, a sensitive information flow path is obtained from the set of information flow paths; a static plugging algorithm is used to insert a preset monitoring code into the sensitive information flow path in the first APK to obtain a second APK, and the second APK is sent to the client, so that the client runs the second APK after receiving the second APK; the state of the sensitive information flow path is monitored by the monitoring code. With this solution, only lightweight monitoring code is used for the target application, and microscopic and cumbersome variable-level taint tracking is not involved, thereby realizing fast and low-loss runtime information flow tracking analysis. And using STA to comprehensively search for sensitive information flow paths, it is easier to find implicit flow paths than the traditional DTA algorithm. By verifying the paths that do not appear when the program is running, a higher accuracy than DTA can be achieved, thereby realizing lightweight, low-loss, and fine-grained information flow path tracking, solving the problem of excessive performance overhead of the DTA algorithm.

[0165] It should be noted that the same or similar parts between the various embodiments can be referred to each other. As for the device embodiment and the system embodiment, since they are basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0166] For the above-mentioned embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0167] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0168] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

[0169] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for tracing information flow paths based on push-down automata, characterized in that: The method is applied to a server in an information flow path tracking system based on a push-down automaton, the information flow path tracking system based on a push-down automaton includes the server and a client, and the method includes: Receive a first Android application installation package APK and a custom information flow policy sent by the client, where the custom information flow policy is an information flow policy customized by a user for the application; According to the custom information flow strategy, a static taint analysis algorithm STA is used to search for an information flow path set from the first APK; According to the custom information flow strategy, obtaining a sensitive information flow path from the information flow path set; Using a static instrumentation algorithm, inserting a preset monitoring code into the sensitive information flow path in the first APK to obtain a second APK, and sending the second APK to the client, so that the client runs the second APK after receiving the second APK; The status of the sensitive information flow path is monitored by the monitoring code.

2. The method according to claim 1, characterized in that: The step of searching for an information flow path set from the first APK using a static taint analysis algorithm STA according to the custom information flow strategy includes: Reading a source statement set in the custom information flow strategy; The STA is used to search the first APK for a set of information flow paths starting from a source sentence in the source sentence set.

3. The method according to claim 2, characterized in that The obtaining a sensitive information flow path from the information flow path set according to the custom information flow policy includes: Reading a release point set in the custom information flow strategy; In the information flow path set starting from a source sentence in the source sentence set, a sensitive information path ending at a release point in the release point set is obtained.

4. The method according to any one of claims 1 to 3, characterized in that: Before inserting the monitoring code into the sensitive information flow path using the static plugging algorithm, the method further includes: The sensitive information flow path is hierarchically managed through a multi-level hash mapping table.

5. The method according to any one of claims 1 to 3, characterized in that: After searching for an information flow path set from the first APK using the static taint analysis algorithm STA, the method further includes: The key node information of all the information flow paths in the information flow path set is recorded in a string array.

6. An information flow path tracking device based on push-down automata, characterized in that: The device is applied to a server in an information flow path tracking system based on a push-down automaton. The information flow path tracking system based on a push-down automaton includes the server and a client. The device includes: A receiving module, used for receiving a first Android application installation package APK and a custom information flow policy sent by the client, wherein the custom information flow policy is an information flow policy customized by a user for the application; A search module, configured to search for an information flow path set from the first APK using a static taint analysis algorithm STA according to the custom information flow strategy; An acquisition module, configured to acquire a sensitive information flow path from the information flow path set according to the custom information flow strategy; An instrumentation module, configured to insert a preset monitoring code into the sensitive information flow path in the first APK by using a static instrumentation algorithm to obtain a second APK, and send the second APK to the client, so that the client runs the second APK after receiving the second APK; A monitoring module is used to monitor the status of the sensitive information flow path through the monitoring code.

7. The device according to claim 6, characterized in that The search module is specifically used for: Reading a source statement set in the custom information flow strategy; The STA is used to search the first APK for a set of information flow paths starting from a source sentence in the source sentence set.

8. The device according to claim 7, characterized in that The acquisition module is specifically used for: Reading a release point set in the custom information flow strategy; In the information flow path set starting from a source sentence in the source sentence set, a sensitive information path ending at a release point in the release point set is obtained.

9. The device according to any one of claims 6 to 8, characterized in that The device also includes: A management module is used to perform hierarchical management on the sensitive information flow path through a multi-level hash mapping table.

10. An information flow path tracking system based on push-down automata, characterized in that: include: Server and client; The server is used to execute the method according to any one of claims 1 to 5; The client is used to: Sending a first Android application installation package APK and a custom information flow policy to the server, where the custom information flow policy is an information flow policy customized by a user for the application; Receive a second APK sent by the server and run the second APK.

Images