An application detection method and apparatus, a storage medium, and an electronic device

Abstract

Embodiments of the present application disclose an application detection method and device, a storage medium and an electronic device. The method comprises: obtaining a target application package and an application benchmark package for an application; performing reverse compilation comparison processing on the target application package and the application benchmark package to obtain a difference class set for the target application package; and performing static taint detection on the target application package based on the difference class set to obtain a taint path set for the target application package. The application detection efficiency can be improved by using the embodiments of the present application.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to an application detection method and device, a storage medium and an electronic device. BACKGROUND

[0002] With the rapid development of network technology, more and more security threats are faced by users when using applications, and the problem of privacy data leakage of applications is also increasingly valued. The application installation package of an application should at least meet the requirements of security compliance in the development stage; therefore, application detection is usually performed on the application installation package of the application to reduce security risks. SUMMARY

[0003] Embodiments of the present application provide an application detection method and device, a storage medium and an electronic device, and the technical solutions are as follows:

[0004] In a first aspect, an application detection method is provided, and the method comprises the following steps:

[0005] obtaining a target application package and an application benchmark package of an application;

[0006] performing decompilation comparison processing on the target application package and the application benchmark package to obtain a difference class set of the target application package;

[0007] performing static taint detection on the target application package based on the difference class set to obtain a taint path set of the target application package.

[0008] In a second aspect, an application detection device is provided, and the device comprises the following modules:

[0009] an obtaining module, configured to obtain a target application package and an application benchmark package of an application;

[0010] a processing module, configured to perform decompilation comparison processing on the target application package and the application benchmark package to obtain a difference class set of the target application package;

[0011] a detection module, configured to perform static taint detection on the target application package based on the difference class set to obtain a taint path set of the target application package.

[0012] In a third aspect, a computer storage medium is provided, and the computer storage medium stores a plurality of instructions, which are suitable for being loaded by a processor and performing the method steps described above.

[0013] In a fourth aspect, an electronic device is provided, which can include a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and performing the method steps described above.

[0014] The technical scheme provided by some embodiments of the present application has at least the following beneficial effects:

[0015] In one or more embodiments of the present application, the electronic device obtains a target application package and an application reference package for an application, and then performs decompilation comparison processing on the target application package and the application reference package to obtain a difference class set for the target application package. The difference class set can be used to perform static taint detection on the target application package to obtain a taint path set for the target application package. The difference class set determined based on the application reference package can avoid full detection and analysis of the target application package. The electronic device can only need to perform static taint detection on the difference code indicated by the target application package based on the difference class set, thereby reducing the application detection processing amount and avoiding redundancy and repetition, and greatly improving the efficiency of application detection. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical scheme in the embodiments of the present application or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0017] Figure 1 is a flowchart of an application detection method provided by an embodiment of the present application;

[0018] Figure 2 is a flowchart of an application detection method provided by an embodiment of the present application;

[0019] Figure 3 is a scene diagram of file matching involved in an application detection method provided by an embodiment of the present application;

[0020] Figure 4 is a scene diagram of file matching involved in an application detection method provided by an embodiment of the present application;

[0021] Figure 5 is a flowchart of an application detection method provided by an embodiment of the present application;

[0022] Figure 6 is a scene diagram of determining a set of entry functions involved in an application detection method provided by an embodiment of the present application;

[0023] Figure 7 is an architecture diagram of an application detection system provided by an embodiment of the present application;

[0024] Figure 8is a structural schematic diagram of an application detection device provided by an embodiment of the present application.

[0025] Figure 9 is a structural schematic diagram of a processing module provided by an embodiment of the present application.

[0026] Figure 10 is a structural schematic diagram of an electronic device provided by an embodiment of the present application.

[0027] Figure 11 is a structural schematic diagram of an operating system and a user space provided by an embodiment of the present application.

[0028] Figure 12 is Figure 11 an architecture diagram of an Android operating system.

[0029] Figure 13 is Figure 11 an architecture diagram of an IOS operating system. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0031] In the description of the present application, it should be understood that the terms "first", "second" and the like are used only for the purpose of description, and should not be understood as indicating or implying relative importance. In the description of the present application, it should be noted that, unless otherwise specified and limited, "including" and "having" and any variants thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units not listed, or optionally includes other steps or units inherent to the process, method, product or device. Those skilled in the art can understand the specific meaning of the above terms in the present application according to the specific circumstances. In addition, in the description of the present application, "multiple" means two or more, unless otherwise specified. "And / or", which describes the relationship between the associated objects, means that there can be three relationships, for example, A and / or B can mean that there are three cases of A alone, A and B together, and B alone. The character " / " generally represents a "or" relationship between the associated objects.

[0032] The present application will be described in detail below in combination with specific embodiments.

[0033] In one embodiment, asFigure 1 As shown, a kind of application detection method is proposed, which can be realized by computer program and run on the application detection device based on von Neumann system.The computer program can be integrated in the application, or run as an independent tool application.The application detection device can be electronic equipment, including but not limited to: personal computer, tablet computer, handheld device, vehicle-mounted device, server, computing device or other processing device connected to wireless modem, etc.In different networks, terminal equipment can be called different names, such as: user equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, cellular phone, cordless phone, 5G network or future evolution network device, etc.

[0034] Specifically, the application detection method includes:

[0035] S101: obtain target application package and application reference package for the application.

[0036] The application can be understood as some terminal operation system itself with the application, which can be third-party application, which refers to the third-party development, non-terminal operation system itself with the application, including some third-party development application, applet, plug-in, etc.In some embodiments, application installation or application update can be carried out based on the application corresponding application installation package (apk).In the present application, target application package and application reference package can be understood as the application installation package of different application versions for the same application.

[0037] The application installation package (apk) version corresponding to the target application package and the application reference package is different, and the apk version of the target application package is usually greater than that of the application reference package.

[0038] In one or more embodiments, the target application package can be the current application installation package for the application to be updated;The application reference package can be understood as the historical application installation package published for the application.The application reference package can be set based on the actual application scene, and the apk version of the target application package is greater than or earlier than that of the application reference package.

[0039] It can be understood that in the scenarios of application update and application installation, as the security threats faced by the application are increasing, the privacy data leakage problem of the application design is also increasingly valued, and the development of the target application package of the application should at least meet the security compliance requirements. In the actual application stage, application detection is usually involved for the application installation package, and static taint propagation detection is often involved in the application detection. Static taint propagation detection (referred to as static taint detection) refers to detecting whether data can be propagated from a taint source to a taint sink by analyzing the data dependency relationship between application variables without running and modifying the code of the application installation package. The taint path result of the target application package corresponding to the application can be obtained after static taint detection.

[0040] In some embodiments, after the application development end completes the development of the target application package of the application version of the application, the target application package can be uploaded to an electronic device (such as a service platform), and the electronic device can obtain the target application package of the application at this time. In addition, the electronic device can save a historical application installation package of a historical version of the application, and the electronic device can obtain the application reference package belonging to the same application as the target application package from the historical application installation package.

[0041] S102: Perform decompilation comparison processing on the target application package and the application reference package to obtain a difference class set for the target application package.

[0042] It can be understood that the decompilation comparison processing can be understood as obtaining the corresponding decompilation file of the application installation package (such as the target application package and the application reference package) by decompiling the application installation package. By comparing the decompilation file of the target application package and the corresponding decompilation file of the application reference package, the difference class set of the target application package relative to the application reference package can be determined.

[0043] It can be understood that the difference class set includes at least one class (which can also be understood as a method class or a function class) representing the difference between the decompilation file of the target application package and the corresponding decompilation file of the application reference package. In some embodiments, the difference class set can be a deletion class set deleted by the decompilation file of the target application package relative to the corresponding decompilation file of the application reference package. The difference class set can be an incremental class set added by the decompilation file of the target application package relative to the corresponding decompilation file of the application reference package.

[0044] In some embodiments, the decompiled file obtained by decompiling the application installation package (such as the target application package, the application benchmark package) can be understood as: the decompiled file obtained by reverse engineering the data of the detection object (that is, the application installation package) for reverse compilation. In some embodiments, the reverse compilation process of the detection object refers to obtaining the corresponding uncompiled file from the compiled file corresponding to the detection object, taking the common detection application as an example, that is, by reverse engineering the application installation package to be detected of the application for reverse compilation, the decompiled file can be obtained. The decompiled file can be at least a smali code file, and in some embodiments, the decompiled file can also be xml resource files and AndroidManifest.xml layout files, etc.

[0045] It can be understood that the target application package (that is, the detection object) of the application obtained by the electronic device can be decompiled by reverse compiling the target application package after unpacking the target application package in advance (which can be understood as decompiling). Taking an Android application package as an example, the application installation package is usually a ".APK file format" file, which can be understood as a ZIP format compressed file; the electronic device can unpack the application installation package, and the unpacking process can obtain classes.dex (compiled code file), resources.arsc (compiled resource file), and AndroidManifest.xml (compiled layout file) from the application installation package file. Then, based on the reverse compilation tool in reverse engineering, the above-mentioned compiled files (such as compiled code files, resource files, and layout files) can be decompiled to obtain the "uncompiled file" before the "compiled file", that is, to obtain smali code files, xml resource files, and AndroidManifest.xml layout files, etc. In one or more embodiments, the decompiled file can be at least a smali file tree, which refers to the file collection under the smali directory generated after decompiling the apk. These smali files are named "package name + class name" and end with ".smali".

[0046] Optionally, by obtaining the decompiled file obtained by decompiling the target application package and the application benchmark package (the decompiled file corresponding to the target application package, the decompiled file corresponding to the application benchmark package), the difference class set of the target application package relative to the application benchmark package can be determined by data comparison between the decompiled file of the target application package and the decompiled file corresponding to the application benchmark package.

[0047] Optionally, the electronic device can only decompile the target application package by reverse engineering to obtain the decompiled file of the target application package; and the decompiled file of the application benchmark package can not be decompiled and can be directly obtained. Generally, the application benchmark package is detected by the electronic device before being released. The application detection process involves generating the decompiled file corresponding to the application benchmark package, such as generating the smali file tree corresponding to the application benchmark package. The electronic device can save the decompiled file corresponding to the application benchmark package. In a specific implementation, when the step of performing the decompilation comparison processing on the target application package and the application benchmark package is involved, the decompiled file corresponding to the application benchmark package can be directly obtained without recompiling the application benchmark package.

[0048] S103: performing static taint detection on the target application package based on the difference class set to obtain a taint path set for the target application package.

[0049] It can be understood that the electronic device obtains the difference class set for the target application package by performing the decompilation comparison processing on the target application package and the application benchmark package. The difference class set reflects the code difference between the target application package and the application benchmark package to some extent. In order to improve the application detection efficiency, the present application does not use the form of detecting all the codes corresponding to the target application package when performing static taint detection on the target application package, but determines the difference class set of the target application package relative to the benchmark application package. Since the benchmark application package has been pre-detected by the electronic device to obtain the taint path set, the static taint detection on the target application package can be performed based on the difference class set. In some embodiments, it can be understood that the static taint detection can be performed on the difference code indicated by the target application package based on the difference class set. In this way, the efficiency of the application detection on the target application package can be greatly improved. The improvement of the application detection based on the comprehensive scanning and analysis of the related taint analysis tool on the apk in the related scenario is also realized. The incremental code of the new version corresponding to the target application package is detected in a targeted manner. At the same time, the taint detection redundancy can be avoided, the target application package can be quickly released, and the detection resources can be saved.

[0050] It can be understood that the electronic device determines whether there is incremental code in the target application package relative to the application benchmark package based on the difference class set. If there is incremental code, the electronic device can call the taint detection tool for static taint detection to perform static taint detection on the incremental code indicated by the difference class set in the target application package, detect whether data can be propagated from a taint to a taint sink by detecting data dependency relationships between application program variables indicated by the incremental code, and further determine a first taint path set obtained by using the taint detection tool this time. The electronic device can obtain a second taint path set corresponding to the application benchmark package, and then perform data fitting on the first taint path set and the second taint path set according to the difference class set to obtain a taint path set for the target application package.

[0051] It can be understood that if there is no incremental code, the difference class set is usually a deletion class set at this time. The electronic device can determine the taint path set based on the second taint path set corresponding to the application benchmark package in combination with the deletion class set without calling the taint detection tool to detect the target application package. Specifically, the second taint path set that does not contain the target taint path after ignoring the target taint path in the second taint path set is obtained as the taint path set for the target application package.

[0052] In the embodiment of the present application, the electronic device obtains a target application package and an application benchmark package for an application, and then performs decompilation comparison processing on the target application package and the application benchmark package to obtain a difference class set for the target application package. The difference class set can be used to perform static taint detection on the target application package to obtain a taint path set for the target application package. The difference class set determined based on the application benchmark package can avoid full detection and analysis of the target application package. The electronic device only needs to perform static taint detection on the difference code indicated by the target application package based on the difference class set, thereby reducing the application detection processing amount and avoiding redundancy and repetition, and greatly improving the efficiency of application detection.

[0053] Please refer to Figure 2 , Figure 2 is a flow diagram of another embodiment of an application detection method proposed in the present application. Specifically:

[0054] S201: Obtain a target application package and an application benchmark package for an application.

[0055] For details, please refer to S101, which will not be repeated here.

[0056] S202: Determine a first decompiled file corresponding to the application benchmark package, and determine a second decompiled file corresponding to the target application package.

[0057] The first decompiled file can be understood as a decompiled file obtained by reverse engineering the application benchmark package to be detected of the application by the electronic device. The first decompiled file can at least be a smali code file corresponding to the application benchmark package. In some embodiments, the first decompiled file can be a smali file tree, which refers to a file collection of smali files under a smali directory generated after decompiling the application benchmark package apk. The smali files are named with "package name + class name" and end with ".smali".

[0058] The second decompiled file can be understood as a decompiled file obtained by reverse engineering the target application package to be detected of the application by the electronic device. The second decompiled file can at least be a smali code file corresponding to the application benchmark package. In some embodiments, the second decompiled file can be a smali file tree, which can be understood as a file collection of smali files under a smali directory generated after decompiling the target application package apk. The smali files are named with "package name + class name" and end with ".smali".

[0059] Optionally, the first decompiled file and the second decompiled file can be obtained by using an apk compiling tool in reverse engineering, such as an apk compiling tool: apktool.

[0060] It can be understood that, in terms of time dimension, the installation package version of the application benchmark package is before the installation package version of the target application package.

[0061] It can be understood that, after determining the first decompiled file and the second decompiled file, the electronic device compares the first decompiled file and the second decompiled file to obtain a difference class set for the target application package. For details, refer to other method steps of the embodiments of the present application.

[0062] S203: Reference at least one benchmark file contained in the first decompiled file, determine a first file that does not match each benchmark file in the second decompiled file, and determine an incremental class set for the target application package based on the first file.

[0063] In one or more embodiments, the first decompiled file can be a smali file tree corresponding to the benchmark application package, the smali file tree can be understood as a file collection of smali files under a smali directory generated after the benchmark application package apk is decompiled, wherein the benchmark file can be understood as a smali file in the first decompiled file (such as a decompiled file tree). Further, taking the Android system as an example, Smali can be understood as a disassembly language of the Android virtual machine, and the smali file tree is a tree directory structure composed of smali files, which is usually regarded as a file collection composed of smali files.

[0064] In a specific implementation scenario, the electronic device performs file traversal on the second decompiled file with reference to at least one benchmark file contained in the first decompiled file to determine a first file in the second decompiled file that does not match each of the benchmark files, and determines an incremental class set for the target application package based on a class corresponding to the first file. It can be understood that if the number of first files is n (n is a natural number), the number of classes of the first files in the incremental class set is n. The first file can be understood as an incremental file relative to the first decompiled file, such as an incremental smali file.

[0065] Briefly, by traversing the smali file tree corresponding to the target application file to be analyzed, for each smali file in the smali file tree, the class corresponding to the first smali file does not exist in the benchmark apk, so that the class of the first smali file belongs to a newly added class, and therefore the file name of the first smali file is added to the incremental set.

[0066] In a feasible implementation, an incremental class set IncrementalList is set, and the first decompiled file is a smali file tree T1 and the second decompiled file is a smali file tree T2.

[0067] The second decompiled file is a smali file tree T2 containing N (N is a positive integer) target files, and the electronic device takes at least one benchmark file contained in the first decompiled file, i.e., the smali file tree T1, as a reference, as follows:

[0068] 1、Obtain "target file 1", perform file traversal on the first decompiled file, that is, "smali file tree T1", match the current "target file 1" with each "reference file" in "smali file tree T1" respectively, detect whether "target file 1" is not matched with each reference file, if not matched, determine that "target file 1" is the first file; add the class corresponding to "target file 1" as the first file to the incremental class set IncrementalList;

[0069] 2、Obtain "target file 2", perform file traversal on the first decompiled file, that is, "smali file tree T1", match the current "target file 2" with each "reference file" in "smali file tree T1" respectively, detect whether "target file 2" is not matched with each reference file, if not matched, determine that "target file 2" is the first file; add the class corresponding to "target file 2" as the first file to the incremental class set IncrementalList; ....

[0071] i、As shown in Figure 3 , Figure 3 is a scene diagram of file matching involved in the present application, as Figure 3 , the electronic device can obtain "target file i" (i is an integer greater than 0), perform file traversal on the first decompiled file, that is, "smali file tree T1", match the current "target file i" with each "reference file" in "smali file tree T1" respectively, detect whether "target file i" is not matched with each reference file, if not matched, determine that "target file i" is the first file; add the class corresponding to "target file i" as the first file to the incremental class set IncrementalList;

[0072] By analogy, until i is equal to N, the matching is completed, and the incremental class set IncrementalList is obtained.

[0073] It can be understood that the first smali file is named with "package name + class name" and ends with ".smali", so by obtaining the file name of the first smali file, the corresponding suffix ".smali" in the file name is removed, and then the file name after removing ".smali" (that is, as an incremental class) is added to the incremental class set to complete "adding the class corresponding to the first file to the incremental class set". Further, at least one incremental class (such as a new function class) in the incremental class set can be a new function class added by the "benchmark file contained in the first decompiled file" (which can be understood as that the incremental function class does not exist in the first decompiled file); in some embodiments, at least one incremental class (such as an incremental function class) in the incremental class set can be an incremental function class modified by the "benchmark file contained in the first decompiled file" (which can be understood as that the incremental function class is a modified function class generated after modifying a certain benchmark file in the first decompiled file).

[0074] Optionally, the above-mentioned process of "determining the first file not matching each of the benchmark files in the second decompiled file" can be by detecting whether the benchmark file is consistent with 'at least one target file contained in the second decompiled file', that is, comparing the data between the benchmark file and the target file, if a certain benchmark file is inconsistent with all target files, the "certain benchmark file" is usually a new smali file, the "certain benchmark file" is taken as the first file, at this time the class corresponding to the first file usually belongs to the new function class.

[0075] Optionally, the above-mentioned process of "determining the first file not matching each of the benchmark files in the second decompiled file" can be by comparing the file names, that is, "determining the first file name not matching the benchmark file name of each of the benchmark files in the second decompiled file, determining the incremental class set for the target application package based on the first file name", it can be understood that if the name of a certain target file in the second decompiled file does not match all benchmark file names, the "certain target file" is taken as the first file, and the first file name is the name of the "certain target file".

[0076] In one or more embodiments, after determining the first file, the first file can be marked as ignored from the second decompiled file to which it belongs, the ignore mark is used to indicate that the first file with the ignore mark is skipped in the next round of file matching process (the step of "matching each "benchmark file" in the "smali file tree T1" with the "target file i"). The first file at this time can not be matched, avoiding judging the already determined first file in each round to save matching calculation resources and improve application detection efficiency.

[0077] In some embodiments, the first file can be deleted from the second decompiled file after being determined each time, so as to avoid matching the first file in the next round of the step of "matching the current 'benchmark file i' with each 'target file' in the'smali file tree T2' respectively", thereby saving the matching calculation resources and improving the application detection efficiency.

[0078] In a feasible embodiment, the electronic device can further: determine, with reference to the benchmark file names of the at least one benchmark file contained in the first decompiled file, fourth file names in the second decompiled file that match the at least one benchmark file name. At this time, it can be understood that the fourth file names match the benchmark file names, and the fourth file and the benchmark file can be the same, or the fourth file can be obtained by modifying or adjusting the code of the benchmark file. Based on this, the file data of the fourth file and the benchmark file can be further compared for consistency. The digest values corresponding to the fourth file and the benchmark file can be obtained by performing digest calculation on the fourth file and the benchmark file respectively, and the consistency of the digest values corresponding to the fourth file and the benchmark file can be determined to determine whether the file data of the fourth file and the benchmark file is consistent.

[0079] It can be understood that the digest algorithm can be used to calculate the digest value of the file (such as the fourth file and the benchmark file), and the digest algorithm includes but is not limited to MD (message digest) algorithm, SHA (secure hash) algorithm, MAC (message authentication code) algorithm, etc. The specific algorithm can be set based on the actual application, which is not limited here.

[0080] For example, the MD5 algorithm in the MD (message digest) algorithm can be used to calculate the digest values corresponding to the fourth file and the benchmark file. When the digest values are consistent, the fourth file and the benchmark file are the same. When the digest values are not consistent, the fourth file is obtained by modifying or adjusting the code of the benchmark file. In this case, the electronic device determines the modification class for the target application package based on the fourth file name, and adds the modification class to the incremental class set. The determination method of the incremental class corresponding to the first file can be specifically referred to, which is similar.

[0081] S204: With reference to the at least one target file contained in the second decompiled file, determine in the first decompiled file a second file that does not match each of the target files and a third file that matches at least one of the target files, and determine a deletion class set and an incremental class set for the target application package based on the second file and the third file.

[0082] In one or more embodiments, the second decompiled file can be a smali file tree corresponding to the benchmark application package, the smali file tree can be understood as a file collection of smali files under a smali directory generated after decompiling the benchmark application package apk, wherein the target file can be understood as a smali file in the second decompiled file (such as a decompiled file tree). Further, taking the Android system as an example, Smali can be understood as the disassembly language of the Android virtual machine, and the smali file tree is a tree directory structure composed of smali files, which is usually regarded as a file collection composed of smali files.

[0083] In a specific implementation scenario, the electronic device references at least one target file contained in the second decompiled file, performs file traversal on the first decompiled file to determine, in the first decompiled file, a second file that does not match each of the target files and a third file that matches at least one of the target files, and determines a deletion class set and an incremental class set for the target application package based on the second file and the third file.

[0084] Briefly, the second file and the third file are determined by traversing the smali file tree corresponding to the benchmark application file. Since the second file does not match each of the target files in the second decompiled file, the function class corresponding to the second file is usually deleted. In a feasible implementation manner, the electronic device can add a second file name of the second file to the deletion class set for the target application package.

[0085] Optionally, the process of “determining, in the first decompiled file, a second file that does not match each of the target files” can be detecting whether the target file is consistent with each benchmark file contained in the first decompiled file, that is, comparing data between each benchmark file and the target file. If a certain benchmark file is inconsistent with all target files, the “certain benchmark file” is usually a deleted smail file, and the “certain benchmark file” is taken as the second file. At this time, the class corresponding to the second file usually belongs to the deleted function class.

[0086] Optionally, the process of “determining, in the first decompiled file, a second file name that does not match a target file name of each of the target files” can be comparing file names, that is, “determining, in the first decompiled file, a second file name that does not match a target file name of each of the target files, and determining a deletion class set for the target application package based on the second file name”.

[0087] Further, the electronic device determines a third file matching the at least one target file in the first decompiled file. The determination can be made by comparing file names. That is, a target file having the same name as a reference file can be considered as a third file, where the target file and the reference file have the same class corresponding to the smali file. The target file and the reference file having the same name can have the same file data or can be third files obtained by modifying or adjusting the code of the reference file. In this case, the electronic device can further compare the file data of the third file and the reference file. For example, the electronic device can calculate the digest values of the third file and the reference file. When the digest values are the same, the third file and the reference file are the same. When the digest values are different, the third file is a third file obtained by modifying or adjusting the code of the reference file. In this case, the electronic device determines a modification class for the target application package based on the name of the third file and adds the modification class to the incremental class set.

[0088] It can be understood that the second smali file is named by "package name+class name" and ends with ".smali". Thus, the electronic device removes the suffix ".smali" from the file name of the second smali file, and adds the file name after the removal of ".smali" (i.e., as an incremental class) to the reduction class set to complete the adding of the class corresponding to the second file to the reduction class set.

[0089] It can be understood that the third smali file is named by "package name+class name" and ends with ".smali". Thus, the electronic device removes the suffix ".smali" from the file name of the third smali file, and adds the file name after the removal of ".smali" (i.e., as an incremental class) to the reduction class set to complete the adding of the class corresponding to the third file to the incremental class set.

[0090] In an embodiment, an incremental class set IncrementalList and a reduction class set ReducedList are set.

[0091] The first decompiled file is a smali file tree T1, and the second decompiled file is a smali file tree T2.

[0092] The electronic device takes the N target files included in the second decompiled file (i.e., the smali file tree T2) as a reference.

[0093] 1、Obtain the "baseline file 1", and perform file traversal on the second decompiled file, that is, the "smali file tree T2". Match the current "baseline file 1" with each "target file" in the "smali file tree T2", on the one hand: detect whether the "baseline file 1" is not matched with each target file, if not matched, determine that the "baseline file 1" is the second file; add the class corresponding to the "baseline file 1" as the second file to the reduced class set ReducedList, wherein the file matching can be performed by comparing the file names of the files; on the other hand: detect whether the "baseline file 1" is matched with at least one target file, if matched, determine that the "baseline file 1" is the third file; then perform file data matching between the third file and the "reference target file with the same file name as the third file", if the file data of the two is not the same, it indicates that the "reference target file with the same file name as the third file" is the third file generated by modifying or adjusting the code of the "third file", at this time, the class corresponding to the third file is added to the incremental class set IncrementalList.

[0094] 2、Obtain the "baseline file 2", and perform file traversal on the second decompiled file, that is, the "smali file tree T2". Match the current "baseline file 2" with each "target file" in the "smali file tree T2", on the one hand: detect whether the "baseline file 2" is not matched with each target file, if not matched, determine that the "baseline file 2" is the second file; add the class corresponding to the "baseline file 2" as the second file to the reduced class set ReducedList, wherein the file matching can be performed by comparing the file names of the files; on the other hand: detect whether the "baseline file 2" is matched with at least one target file, if matched, determine that the "baseline file 2" is the third file; then perform file data matching between the third file and the "reference target file with the same file name as the third file", if the file data of the two is not the same, it indicates that the "reference target file with the same file name as the third file" is the third file generated by modifying or adjusting the code of the "third file", at this time, the class corresponding to the third file is added to the incremental class set IncrementalList. ....

[0096] i、As Figure 4 shown, Figure 4 is another file matching scenario involved in the present application, as Figure 3, the electronic device can obtain the "reference file i", perform file traversal on the second decompiled file, i.e., the "smali file tree T2", and match the current "reference file i" with each "target file" in the "smali file tree T2", respectively. On the one hand, it is detected whether the "reference file i" is not matched with each target file. If not, it is determined that the "reference file i" is the second file. The class corresponding to the "reference file i" as the second file is added to the reduced class set ReducedList. The file matching can be performed by comparing the file names of the files. On the other hand, it is detected whether the "reference file i" is matched with at least one target file. If matched, it is determined that the "reference file i" is the third file. Then, the third file and the reference target file with the same file name as the third file are matched in file data. If the file data of the two is not the same, it is indicated that the reference target file with the same file name as the third file is the third file generated by modifying or adjusting the code of the third file. At this time, the class corresponding to the third file is added to the incremental class set IncrementalList.

[0097] By analogy, until i equals N, the incremental class set IncrementalList and the reduced class set ReducedList are obtained.

[0098] It can be understood that the above process reads the file name N1 of each smali file by traversing the reference smali file tree T1. If there is no smali file with the same file name N1 in the smali file tree T2, the second file is determined at this time. The file name of the second file is N1. Then, the suffix ".smali" of N1 is removed and added to the reduced class set ReducedList. If there is a file name N2 in the smali file tree T2 that is the same as the file name N1, the MD5 value of the N1 file (denoted as MD5_1) and the MD5 value of the N2 file (denoted as MD5_2) are calculated. If MD5_1 and MD5_2 are the same, N2 is deleted or ignored from T2 to save the calculation processing resources in subsequent matching and improve the detection efficiency. If MD5_1 and MD5_2 are not the same, the suffix of N1 is removed and added to the incremental class set IncrementalList, and N2 is deleted from T2 to save the calculation processing resources in subsequent matching and improve the detection efficiency.

[0099] In a feasible implementation, the file data of the third file and the reference file are further compared. The electronic device can perform the steps of "obtaining the summary matching result of the third file and the reference file, and adding the third file name of the third file to the incremental class set based on the summary matching result".

[0100] The abstract matching result can be understood as calculating the abstract values of the two files (e.g., the third file and the reference file) respectively by using an abstract algorithm (e.g., MD5 algorithm), and matching the abstract values of the two files to obtain a matching result. The matching result is also referred to as an abstract matching result. For example, the abstract values of the two files can be compared (whether the abstract values of the two files are consistent) to obtain a comparison result as the abstract matching result. The abstract matching result includes an abstract matching type and an abstract mismatching type. The abstract result of the abstract matching type can be understood as that the abstract values of the two files (e.g., the third file and the reference file) are matched, for example, the abstract values of the two files are consistent. The abstract result of the abstract mismatching type can be understood as that the abstract values of the two files (e.g., the third file and the reference file) are not matched, for example, the abstract values of the two files are inconsistent.

[0101] It can be understood that, for example, the MD5 algorithm can be used to calculate the abstract values of the third file and the reference file, and the abstract values of the third file and the reference file are matched. When the abstract matching result indicates that the abstract values of the two are consistent, the abstract matching result is usually of the abstract matching type, which can be understood as that the third file and the reference file are the same. When the abstract matching result indicates that the abstract values of the two are different, the abstract matching result is usually of the abstract mismatching type, which can be understood as that the third file is usually obtained by modifying or adjusting the code on the reference file. In this case, the electronic device determines the modification class for the target application package based on the third file name of the third file, and adds the modification class to the incremental class set.

[0102] Further, if the result type of the abstract matching result is the abstract mismatching type, the third file name of the third file (the third file name can represent the class corresponding to the third file) is added to the incremental class set.

[0103] In one or more embodiments, during the application development process involved in the target application file, if the files in the application installation package published by the historical version are modified, the function class corresponding to the files before and after the file modification does not change. However, because the data encapsulated by the substantive function class changes, the electronic device can add the class corresponding to the second file to the incremental class set as an incremental function class.

[0104] It can be understood that the process of obtaining the abstract matching result of the third file and the reference file can be that two abstract values are calculated by using a related abstract algorithm on the third file and the reference file, and then the abstract values are compared to obtain the abstract matching result. The related abstract algorithm can be MD5 algorithm, SHA algorithm, MAC algorithm, etc.

[0105] S205: performing static taint detection on the target application package based on the difference class set to obtain a taint path set for the target application package.

[0106] It can be understood that the difference class set can be an incremental class set and / or a deleted class set.

[0107] For details, refer to the method steps of other embodiments involved in the present application, which will not be repeated here.

[0108] In the embodiments of the present application, the electronic device obtains a target application package and an application reference package for an application, and then performs decompilation comparison processing on the target application package and the application reference package to obtain a difference class set for the target application package. Based on the difference class set, the target application package can be subjected to static taint detection to obtain a taint path set for the target application package. By determining the difference class set based on the application reference package, full detection and analysis of the target application package can be avoided. The electronic device can only need to perform static taint detection on the difference code indicated by the target application package based on the difference class set, thereby reducing the application detection processing amount and avoiding redundancy and repetition, and greatly improving the efficiency of application detection. In addition, based on the decompiled file, the incremental class set and the deleted class set can be determined, and the incremental code components subjected to static taint analysis can be screened based on the same, thereby improving the intelligence of application detection.

[0109] Please refer to Figure 5 , Figure 5 is a flow diagram of another embodiment of an application detection method proposed in the present application. Specifically:

[0110] S301: Obtain a target application package and an application reference package for an application;

[0111] For details, refer to the method steps of other embodiments involved in the present application, which will not be repeated here.

[0112] S302: Perform decompilation comparison processing on the target application package and the application reference package to obtain a difference class set for the target application package;

[0113] S303: Determine a set class corresponding to the difference class set.

[0114] According to one or more embodiments, the set class can be a deleted class, an incremental class, or a deleted class and an incremental class based on actual application conditions.

[0115] It can be understood that the electronic device can perform static taint detection on the target application package based on the set class to obtain a taint path set for the target application package

[0116] S304: If the set type is an incremental type, call the taint detection tool to perform static taint detection on the target application package based on the incremental set type, obtain a first taint path set, and take the first taint path set as a taint path set of the target application package;

[0117] It can be understood that the electronic device obtains the difference set of the target application package by performing the decompilation comparison processing on the target application package and the application reference package. The difference set to some extent reflects the code difference between the target application package and the application reference package. In order to improve the application detection efficiency, the present application does not use the form of detecting all the codes corresponding to the target application package by the confidant when performing static taint detection on the target application package. Instead, the difference set of the target application package relative to the reference application package is determined. Since the reference application package has been pre-detected by the electronic device to obtain the taint path set, the static taint detection can be performed on the target application package based on the difference set. In some embodiments, it can be understood that the static taint detection can be performed on the difference code indicated by the target application package based on the difference set. In this way, the efficiency of the application detection on the target application package can be greatly improved.

[0118] It can be understood that the incremental set is used to assist the electronic device to determine the incremental code of the target application package relative to the application reference package, and then perform taint detection on the incremental code, so as to reduce the calculation processing amount when performing taint detection on the entire target application package and improve the detection efficiency.

[0119] In a feasible implementation manner,

[0120] 1. The electronic device can determine a detection entry function set of the target application package based on the incremental set.

[0121] 1.1 Obtain an inter-process call graph of the target application package, and determine an initial entry function set based on the inter-process call graph.

[0122] It can be understood that the electronic device can call the taint detection tool, such as the method of generating a control flow graph in the open source code analysis framework soot tool. The taint detection tool parses the binary code of the target application package into intermediate code and generates a CFG. The taint detection tool generates an inter-process call method, such as the method of generating a bidirectional ICFG in the FlowDroid framework, analyzes the function call relationship of the target application package and generates an inter-process call graph ICFG, records the system component lifecycle functions and callback functions in the ICFG into a set E, which is the initial entry function set.

[0123] In a specific implementation scenario, the electronic device sets the pollution source function source and the sink function sink before generating the inter-process call graph (i.e., starting the analysis directly), and in a specific implementation: generally, the function exposed to the outside is set as the source function, the function performing the key logic inside the program is set as the sink function, if a reachable path from the pollution source function source to the sink function sink can be obtained through analysis, it indicates that there is a potential security vulnerability, and at this time a taint path can be obtained;

[0124] It can be understood that when the target application package is analyzed, the absolute path indicated by the target application package is used to find the location of the analyzed object, and the open source analysis framework soot is used to realize the reverse disassembly of the bytecode program, i.e., the open source analysis framework soot is used to generate a syntax simple intermediate language representation form, so that the bytecode variables of all source programs of the target application package are corresponded to the new data structure of the intermediate language representation, so as to completely express the control flow information and data transmission information of the program.

[0125] Further, the electronic device calls the taint detection tool to parse the binary code of the target application package into intermediate code, so as to obtain the function internal control flow graph (CFG) in the form of the intermediate language representation corresponding to the intermediate code. The conversion process is to indicate each statement of the binary code of the target application package as a control flow graph node Bi, and save the predecessor node Bp and the successor node Bs of each statement according to the execution order; further, the call graph CG is generated: since the execution of most applications (the application corresponding to the target application package) will involve function calls, when there is a call relationship between functions, the electronic device can simulate the function call relationship. The electronic device can generally parse the function call statement in the code, map the called function and the called function, and save the mapping relationship in the call statement node by using the data structure of “HashMap”, so as to generate the corresponding call graph CG.

[0126] Further, the electronic device can composite the call graph CG and the function internal control flow graph CFG to generate a new graph class, which is called the inter-process control flow graph ICFG, and the graph class is used to describe the entire analyzed program; then, the system component lifecycle function and the callback function in the inter-process control flow graph ICFG are recorded, and the system component lifecycle function and the callback function are added to a reference set (such as setting an empty set E, and adding to the set E). After the above process is completed, the reference set obtained is the initial entry function set.

[0127] In some application scenarios, the initial entrance function set is the total entrance point of the inter-process control flow graph ICFG, and subsequent static taint detection is equivalent to performing static taint analysis on all codes corresponding to the target application package. In order to improve the detection efficiency, the electronic device can perform function node traversal processing on the inter-process call graph based on the incremental class set and the initial entrance function set to determine at least one target node function, thereby generating a detection entrance function set containing the at least one target node function. Finally, the detection entrance function set is equivalent to indicating that the electronic device only calls the taint detection tool to perform taint detection on the incremental code.

[0128] 1.2, the electronic device performs function node traversal processing on the inter-process call graph based on the incremental class set and the initial entrance function set to determine at least one target node function;

[0129] In a specific implementation: the electronic device takes at least one initial entrance function indicated by the initial entrance function set as a reference, performs node class matching processing on each next function node corresponding to each initial function node in the inter-process control flow graph based on the incremental class set, and obtains a target node function corresponding to at least one target function node.

[0130] The initial function node is a first node corresponding to the initial entrance function in the inter-process control flow graph, and a target function class to which a target entrance function corresponding to the target function node belongs is a function class in the incremental class set.

[0131] It can be understood that, assuming that the initial entrance function set is set E, the electronic device starts from each initial entrance function Entry of set E to traverse the inter-process call graph ICFG in turn, judges whether the class of the next node function (such as the NextMethod function) of each read initial entrance function Entry is in the incremental class set, and if so, adds the next node function as a target node function to the incremental function set (for example, an incremental function set IncreEntrance is predefined, and when the class of the next node function belongs to the incremental class set, the next node function of the next node function is added to the IncreEntrance as a target node function), and when the traversal of the entire inter-process call graph ICFG is completed, a detection entrance function set containing at least one target node function is obtained.

[0132] As shown in Figure 6 , the electronic device can perform function node traversal processing on the inter-process call graph based on the incremental class set and the initial entrance function set to determine at least one target node function, thereby generating a detection entrance function set containing the at least one target node function. Figure 6This is a schematic diagram of a scenario involving the determination of a set of entry functions, as described in this application. Assuming the initial set of entry functions is set E, the electronic device sequentially traverses the (initial) entry functions Entry in set E. Before each round of traversal of the entry function Entry, it determines whether each (initial) entry function Entry in set E has been traversed (i.e.,...). Figure 6 If the step corresponding to "Traversal has ended" is not found, then based on the current "(Initial) Entry", traverse the "Inter-procedural Call Graph (ICFG)". For each node function (e.g., NextMethod function) read from the "Initial Entry", determine whether the class of the next node function (the class of NextMethod function) is located in the incremental class set (i.e., ...). Figure 6 As shown in the diagram: If the increment class set contains a class with the `NextMethod` function, and if so, then the "next node function" is added to the increment function set as the target node function. (For example, a predefined increment function set `IncreEntrance` is used; if the class corresponding to the "next node function" belongs to the increment class set, then its "next node function" is added as the target node function to the set.) Figure 6 In the IncreEntrance shown, after the last initial entry function Entry completes the traversal of the entire inter-process call graph ICFG, the detection entry function set IncreEntrance containing at least one target node function is obtained.

[0133] Understandable.

[0134] 1.3 The electronic device generates a set of detection entry functions that includes at least one target node function.

[0135] In some implementations, after obtaining the set of detection entry functions, the electronic device completes the control flow analysis process using a taint detection tool.

[0136] 2. The electronic device then calls the taint detection tool based on the detection entry function set to perform static taint detection on the target application package, and obtains the first taint path set.

[0137] Understandably, electronic devices can invoke taint analysis methods in taint detection tools such as the FlowDroid framework to perform data stream analysis and thus execute a static taint detection process.

[0138] Understandably, the electronic device can obtain the inter-procedural call graph (ICFG) corresponding to the target application package, and then perform static taint detection on the ICFG based on the detection entry function set to obtain a first taint path set for the target application package.

[0139] Understandably, the electronic device traverses all detection entry functions in the detection entry function set (such as the set IncreEntrance). For each detection entry function NewEntry, it extracts its next node in the ICFG and determines whether the node belongs to the tainted source function. If so, the taint analysis algorithm in the taint detection tool is called to mark sensitive data in the system, then traces the propagation path of the marked data in the program. Based on the taint detection tool, it detects security issues such as the confidentiality and integrity of the system. At the same time, the function variables of the node are set as tainted variables, and taint analysis is performed. If the node belongs to the tainted function sink and uses tainted variables, then the propagation path of the tainted variable is a complete tainted path. This tainted path is then added to the tainted path set. This process continues until the inter-process control flow graph (ICFG) is traversed, and the data flow analysis ends to complete the static taint detection, resulting in the first tainted path set.

[0140] Understandably, the first tainted path set is the set of tainted paths generated by the electronic device through tainted detection analysis using a tainted detection tool. The first tainted path set reflects the tainted paths within the incremental code components obtained by the detection entry function, generated based on the incremental class set, specifically performing tainted detection analysis on the incremental code components in the target application package. Understandably, in one or more embodiments, the actual object of tainted detection by the tainted detection tool is not the entire target application package, but rather the incremental code components within the target application package, thereby generating the first tainted path set.

[0141] S305: If the set class is a pruning class, then obtain the second tainted path set corresponding to the application base package, and determine the tainted path set for the target application package based on the second tainted path set and the pruning class set.

[0142] Understandably, if all the classes in the difference class set belong to the pruning class set, then the difference class set is the pruning class set. In this case, the target application package, relative to the application base package, typically does not contain incremental code components. Considering that the application base package version installed before the target application package has already completed taint detection, it can be understood that before the application base package is released, the electronic device has already completed static taint detection of the application base package, generating a second taint path set. The second taint path set can be understood as the taint path set corresponding to the application base package after static taint detection processing. Understandably, the electronic device does not need to call the taint detection tool again to perform taint detection on the target application package, but instead obtains the taint path set for the target application package based on the second taint path set corresponding to the application base package and combined with the pruning class set.

[0143] In a specific implementation scenario, the electronic device can determine the set of tainted paths for the target application package from the second set of tainted paths based on the second set of tainted paths and the set of reduction classes.

[0144] It can be understood that the set of reduction classes includes at least one reduction class, and when the second set of tainted paths corresponding to the application reference package is obtained, each tainted path in the second set of tainted paths can be traversed. It can be understood that the tainted path can generally map a tainted variable, a tainted function corresponding to a node, and a class corresponding to the tainted function. Based on this, the electronic device can determine the tainted function class corresponding to each tainted path, for example, based on the name of the tainted function or the tainted variable recorded in the tainted path to determine the tainted function class. The electronic device only needs to match the reduction class with the tainted function class corresponding to each tainted path, and when the two match, for example, are consistent, the electronic device can determine the reference tainted path indicated by the reduction class matched with the reduction class. By analogy, the matching of all reduction classes in the set of reduction classes is completed, and at least one reference tainted path is determined from the second set of tainted paths. That is, the step of "determining at least one reference tainted path from the second set of tainted paths based on the set of reduction classes" is performed. After the electronic device determines at least one reference tainted path, these reference tainted paths generally do not exist in the target application package. Based on this, the electronic device only deletes the at least one reference tainted path in the second set of tainted paths, and the set of tainted paths for the target application package can be obtained.

[0145] S306: If the set class is an increment class and a reduction class, the set of tainted paths for the target application package is determined based on the first set of tainted paths, the second set of tainted paths, and the set of reduction classes.

[0146] It can be understood that if the set class is an increment class and a reduction class, that is, the difference class set includes the increment class set and the reduction class set, the increment class set is used to assist the electronic device to determine the increment code of the target application package corresponding to the application reference package, and then the increment code is subjected to a tainted detection, so as to reduce the calculation processing amount when the entire target application package is subjected to a tainted detection and improve the detection efficiency. The electronic device can remove the related tainted paths of the reduction class set in the second set of tainted paths by performing a tainted path fitting on the first set of tainted paths and the second set of tainted paths, and can obtain the set of tainted paths for the target application package. Thus, the effect of improving the detection efficiency and saving the work amount of the tainted detection is achieved.

[0147] In a specific implementation scenario, the electronic device can perform the step of determining at least one reference taint path from the second set of taint paths based on the set of pruned classes (for details, refer to S305), and then obtain at least one target taint path in the second set of taint paths, where the target taint path is a taint path in the second set of taint paths other than the reference taint path. It can be understood that the target taint path is obtained from the second set of taint paths other than the reference taint path. Then, the at least one target taint path is added to the first set of taint paths, and the set of taint paths for the target application package is obtained. The first set of taint paths can be obtained by referring to other method steps, which will not be described here.

[0148] In the embodiments of the present application, the electronic device obtains the target application package of the application and the application reference package, and then performs decompilation comparison processing on the target application package and the application reference package to obtain the set of difference classes for the target application package. The set of difference classes can be used for static taint detection of the target application package to obtain the set of taint paths for the target application package. The set of difference classes determined based on the application reference package can avoid full detection and analysis of the target application package. The electronic device can only need to perform static taint detection on the difference code indicated by the target application package based on the set of difference classes, thereby reducing the application detection processing amount and avoiding redundancy and repetition, and greatly improving the efficiency of application detection. In addition, the incremental class set and the pruned class set can be determined based on the decompiled file, and the incremental code component for static taint analysis is screened based on the same, thereby improving the intelligence of application detection. In addition, different types of difference class sets can be used for taint detection in different ways, thereby improving the utilization efficiency of the taint analysis result corresponding to the application reference package generated in the history, and optimizing the static taint detection process.

[0149] Please refer to Figure 7 , which is a schematic diagram of an application detection system architecture provided in the embodiments of the present application. As shown in Figure 4 , the application detection system 100 includes an electronic device 20 and a target device cluster, which can include a plurality of target devices, such as Figure 7 , specifically including target device 1, target device 2, …, target device n, where n is an integer greater than 0. The embodiments described herein take the electronic device 20 and the target device 1 in Figure 7 as an example.

[0150] The electronic device 20 has an application detection function. When the electronic device 20 is a server, the electronic device 20 can be a single server device, for example, a rack-mounted, blade, tower, or cabinet server device, or a workstation, mainframe computer, or other hardware device with strong computing power; or a server cluster composed of multiple servers. The servers in the server cluster can be symmetrically composed, that is, each server is functionally equivalent and positionally equivalent in the service link, and each server can independently provide services. The independent service can be understood as not requiring the assistance of another server.

[0151] The target devices in the target device cluster can be devices with communication functions. The target devices can be devices for developing application installation packages such as target application packages and application benchmark packages. The target devices include but are not limited to handheld devices, personal computers, tablet computers, vehicle-mounted devices, smartphones, computing devices, or other processing devices connected to wireless modems.

[0152] The target device 1 communicates with the electronic device 20 through a network. The network can be a wireless network or a wired network. The wireless network includes but is not limited to a cellular network, a wireless local area network, an infrared network, or a Bluetooth network. The wired network includes but is not limited to an Ethernet network, a universal serial bus (USB), or a controller area network.

[0153] The target device 1 can upload a target application package of an application to be detected based on at least a communication network between the electronic device. It can be understood that the electronic device 20 obtains a target application package of an application. The electronic device can obtain an application benchmark package of the application.

[0154] The electronic device 20 performs a decompilation comparison process on the target application package and the application benchmark package to obtain a difference class set of the target application package.

[0155] The electronic device 20 performs static taint detection on the target application package based on the difference class set to obtain a taint path set of the target application package.

[0156] In addition, the file test system embodiments provided in the above embodiments and the file test method in some embodiments belong to the same concept, and the implementation process is detailed in the method embodiments. Therefore, details are not repeated here.

[0157] The following will be combined Figure 8 The application detection device provided in the embodiments of the present application will be described in detail. It should be noted that Figure 8 The application detection device shown in the figure is used to execute the embodiments of the present application Figures 1-7The method of the embodiment shown, for ease of illustration, only shows parts related to the embodiments of the present application, and specific technical details not disclosed, please refer to the present application Figures 1-7 The embodiment shown.

[0158] Please refer to Figure 8 , which shows a structural schematic diagram of an application detection device according to the embodiments of the present application. The application detection device 1 can be realized by software, hardware or a combination of the two to become all or part of a user terminal. According to some embodiments, the application detection device 1 includes an acquisition module 11, a processing module 12 and a detection module 13, specifically for:

[0159] The acquisition module 11 is configured to acquire a target application package of an application and an application reference package;

[0160] The processing module 12 is configured to perform decompilation comparison processing on the target application package and the application reference package to obtain a difference class set for the target application package;

[0161] The detection module 13 is configured to perform static taint detection on the target application package based on the difference class set to obtain a taint path set for the target application package

[0162] Optionally, as Figure 9 shown, the processing module 12 includes:

[0163] The file determination unit 121 is configured to determine a first decompilation file corresponding to the application reference package and a second decompilation file corresponding to the target application package;

[0164] The set determination unit 122 is configured to perform comparison processing on the first decompilation file and the second decompilation file to obtain a difference class set for the target application package.

[0165] Optionally, the set determination unit 122 is specifically configured to:

[0166] reference at least one reference file contained in the first decompilation file, determine a first file in the second decompilation file that does not match each of the reference files, and determine an incremental class set for the target application package based on the first file; and / or

[0167] reference at least one target file contained in the second decompilation file, determine a second file in the first decompilation file that does not match each of the target files and a third file that matches at least one of the target files, and determine a deletion class set and an incremental class set for the target application package based on the second file and the third file.

[0168] Optionally, the set determination unit 122 is specifically configured to:

[0169] In the second decompiled file, a first file name that does not match the base file name of each of the base files is determined, and an incremental class set for the target application package is determined based on the first file name;

[0170] Optionally, the set determination unit 122 is specifically used for:

[0171] In the first decompiled file, a second file name that does not match the target file name of each of the target files and a third file name that matches at least one of the target file names are determined. Based on the second file name and the third file name, a set of deletion classes and a set of increment classes for the target application package are determined.

[0172] Optionally, the set determination unit 122 is specifically used for:

[0173] Add the second file name of the second file to the deletion class set for the target application package; and,

[0174] Obtain the summary matching result between the third file and the reference target file, and add the third file name of the third file to the incremental class set based on the summary matching result. The file name of the third file is the same as the file name of the reference target file.

[0175] Optionally, the set determination unit 122 is specifically used for:

[0176] If the result type of the summary matching result is summary mismatch, then the third file name of the third file is added to the incremental class set.

[0177] Optionally, the detection module 13 is specifically used for:

[0178] Determine the set class corresponding to the set of differences, and perform static taint detection on the target application package based on the set class to obtain a set of taint paths for the target application package.

[0179] Optionally, the detection module 13 is specifically used for:

[0180] If the set class is an incremental class, then the taint detection tool is invoked to perform static taint detection on the target application package based on the incremental class set to obtain a first taint path set, and the first taint path set is used as the taint path set for the target application package.

[0181] If the set class is a pruning class, then obtain the second tainted path set corresponding to the application base package, and determine the tainted path set for the target application package based on the second tainted path set and the pruning class set;

[0182] If the set types are the increment type and the decrement type, the set of the target application package is determined based on the first set of the taint path, the second set of the taint path and the set of the decrement type.

[0183] Optionally, the detection module 13 is specifically configured to:

[0184] determine at least one reference taint path from the second set of the taint path based on the set of the decrement type;

[0185] obtain at least one target taint path in the second set of the taint path, wherein the target taint path is a taint path in the second set of the taint path except the reference taint path;

[0186] add the at least one target taint path to the first set of the taint path to obtain the set of the taint path for the target application package.

[0187] Optionally, the detection module 13 is specifically configured to:

[0188] determine at least one reference taint path from the second set of the taint path based on the set of the decrement type;

[0189] delete the at least one reference taint path in the second set of the taint path to obtain the set of the taint path for the target application package.

[0190] Optionally, the detection module 13 is specifically configured to:

[0191] determine a set of detection entry functions for the target application package based on the increment type set;

[0192] call a taint detection tool based on the set of the detection entry functions to perform static taint detection on the target application package to obtain a first set of the taint path.

[0193] Optionally, the detection module 13 is specifically configured to:

[0194] obtain an inter-process call graph of the target application package, and determine an initial set of entry functions based on the inter-process call graph;

[0195] perform function node traversal processing on the inter-process call graph based on the increment type set and the initial set of the entry functions to determine at least one target node function;

[0196] generate a set of detection entry functions containing the at least one target node function.

[0197] Optionally, the detection module 13 is specifically configured to:

[0198] Based on at least one initial entry function indicated by the initial entry function set, node class matching is performed on each next function node corresponding to each initial function node in the inter-process control flow graph based on the incremental class set to obtain at least one target node function corresponding to the target function node.

[0199] Wherein, the initial function node is the first node corresponding to the initial entry function in the inter-process control flow graph, and the target function class to which the target entry function corresponding to the target function node belongs is the function class in the incremental class set.

[0200] Optionally, the detection module 13 is specifically used for:

[0201] Obtain the inter-procedure call graph corresponding to the target application package;

[0202] Static taint detection is performed on the inter-process call graph based on the set of detection entry functions to obtain a first set of taint paths for the target application package.

[0203] It should be noted that the application detection device provided in the above embodiments is only illustrated by the division of the above functional modules when executing the application detection method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the application detection device and the application detection method embodiments provided in the above embodiments belong to the same concept, and the implementation process is detailed in the method embodiments, which will not be repeated here.

[0204] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0205] This application also provides a computer storage medium that can store multiple instructions, which are adapted to be loaded and executed by a processor as described above. Figures 1-6 The application detection method described in the illustrated embodiment can be found in the following document for a detailed execution process. Figures 1-6 The specific details of the illustrated embodiments will not be elaborated here.

[0206] This application also provides a computer program product storing at least one instruction, which is loaded and executed by the processor as described above. Figures 1-6 The application detection method described in the illustrated embodiment can be found in the following document for a detailed execution process. Figures 1-6 The specific details of the illustrated embodiments will not be elaborated here.

[0207] Please refer to Figure 10Fig. 1 shows a structural block diagram of an electronic device according to an example embodiment of the present application. The electronic device in the present application can include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 can be connected through the bus 150.

[0208] The processor 110 can include one or more processing cores. The processor 110 connects various parts within the entire electronic device by using various interfaces and lines, performs various functions of the electronic device 100 and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 120, and calling data stored in the memory 120. Alternatively, the processor 110 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA). The processor 110 can be integrated with a combination of one or several of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes an operating system, a user interface, and an application program; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 110, but be implemented separately through a communication chip.

[0209] The memory 120 can include a random access memory (RAM) and can also include a read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable storage medium. The memory 120 can be used to store instructions, programs, codes, code sets, or instruction sets. The memory 120 can include a program storage area and a data storage area, where the program storage area can store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playing function, an image playing function, etc.), instructions for implementing each of the following method embodiments, etc., and the operating system can be an Android system, an IOS system developed by Apple Inc., a system developed based on the Android system or the IOS system, or other systems. The data storage area can also store data created by the electronic device in use, such as a phonebook, audio and video data, chat record data, etc.

[0210] Referring to Figure 11 As shown, the memory 120 can be divided into an operating system space and a user space, and the operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good running effects, the operating system allocates corresponding system resources to different third-party applications. However, there are also differences in the demand for system resources in different application scenarios in the same third-party application, for example, in the local resource loading scenario, the third-party application has a higher requirement for the disk reading speed, and in the animation rendering scenario, the third-party application has a higher requirement for the GPU performance. However, the operating system and the third-party application are independent of each other, and the operating system often cannot timely perceive the current application scenario of the third-party application, resulting in that the operating system cannot perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0211] In order to enable the operating system to distinguish the specific application scenario of the third-party application, it is necessary to open up the data communication between the third-party application and the operating system, so that the operating system can obtain the current scenario information of the third-party application at any time, and then perform targeted system resource adaptation based on the current scenario.

[0212] Taking the operating system as an Android system for example, the programs and data stored in the memory 120 are as follows Figure 12As shown, the memory 120 can store a Linux kernel layer 320, a system runtime library layer 340, an application framework layer 360, and an application layer 380, wherein the Linux kernel layer 320, the system runtime library layer 340, and the application framework layer 360 belong to an operating system space, and the application layer 380 belongs to a user space. The Linux kernel layer 320 provides underlying drivers for various hardware of the electronic device, such as display drivers, audio drivers, camera drivers, Bluetooth drivers, Wi-Fi drivers, power management, and the like. The system runtime library layer 340 provides main feature support for the Android system through some C / C++ libraries. For example, an SQLite library provides database support, an OpenGL / ES library provides 3D drawing support, a Webkit library provides browser kernel support, and the like. An Android runtime is also provided in the system runtime library layer 340, which mainly provides some core libraries to allow developers to use the Java language to write Android applications. The application framework layer 360 provides various APIs that can be used when building an application, and developers can also build their own applications by using these APIs, such as activity management, window management, view management, notification management, content provider, package management, call management, resource management, and location management. At least one application program is running in the application layer 380, which can be native applications provided by the operating system, such as a contact program, a message program, a clock program, a camera application, and the like, or third-party applications developed by third-party developers, such as game applications, instant messaging programs, photo beautification programs, and the like.

[0213] For example, taking an IOS system as the operating system, the programs and data stored in the memory 120 can include an IOS kernel 320, an IOS runtime library 340, an application framework 360, and an application layer 380. Figure 13As shown, the IOS system includes: a core operating system layer 420, a core service layer 440, a media layer 460, and a Cocoa Touch layer 480. The core operating system layer 420 includes an operating system kernel, drivers, and low-level hardware abstractions that provide more hardware-specific functionality to program frameworks in the core service layer 440. The core service layer 440 provides system services and / or program frameworks that applications need, such as a Foundation framework, an account framework, an advertisement framework, a data storage framework, a network connection framework, a geographic location framework, a motion framework, and the like. The media layer 460 provides interfaces for applications related to audio and video, such as interfaces related to graphics images, interfaces related to audio technology, interfaces related to video technology, an AirPlay interface for wireless audio and video transmission technology, and the like. The Cocoa Touch layer 480 provides various commonly used interface-related frameworks for application development, and is responsible for user touch interaction on the electronic device. For example, a local notification service, a remote push service, an advertisement framework, a game tool framework, a message user interface (UI) framework, a user interface UIKit framework, a map framework, and the like.

[0214] In Figure 13 In the framework shown, the frameworks related to most applications include, but are not limited to, a Foundation framework in the core service layer 440 and a UIKit framework in the Cocoa Touch layer 480. The Foundation framework provides many basic object classes and data types, and provides the most basic system services for all applications, and is UI-independent. The UIKit framework provides basic UI class libraries for creating touch-based user interfaces, and an iOS application can provide a UI based on the UIKit framework, so it provides the basic framework of the application for building user interfaces, drawing, processing and user interaction events, responding to gestures, and the like.

[0215] In the IOS system, the manner and principle of implementing data communication between a third-party application and an operating system can refer to the Android system, and will not be described herein.

[0216] The input device 130 is configured to receive input instructions or data, and the input device 130 includes but is not limited to a keyboard, a mouse, a camera, a microphone, or a touch device. The output device 140 is configured to output instructions or data, and the output device 140 includes but is not limited to a display device and a speaker. In an example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are a touch display screen configured to receive a touch operation of a user using a finger, a touch pen, or any suitable object on or near the touch display screen, and display a user interface of each application. The touch display screen is usually arranged on a front panel of the electronic device. The touch display screen can be designed as a full screen, a curved screen, or a special-shaped screen. The touch display screen can also be designed as a combination of a full screen and a curved screen, a combination of a special-shaped screen and a curved screen, and the present application does not limit the combination.

[0217] In addition, those skilled in the art can understand that the structure of the electronic device shown in the above-described drawings does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than those shown in the drawings, or combine certain components, or different component arrangements. For example, the electronic device further includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module, and the like, which are not described herein.

[0218] In the embodiments of the present application, the execution subject of each step can be the electronic device introduced above. Alternatively, the execution subject of each step is an operating system of the electronic device. The operating system can be an Android system, an IOS system, or other operating systems, and the present application does not limit the operating system.

[0219] The electronic device of the embodiments of the present application can further have a display device installed thereon, which can be various devices capable of realizing display functions, such as a cathode ray tube display (CR), a light-emitting diode display (LED), an electronic ink screen, a liquid crystal display (LCD), a plasma display panel (PDP), and the like. A user can use the display device on the electronic device 101 to view displayed text, images, video, and the like. The electronic device can be a smart phone, a tablet computer, a game device, an AR (Augmented Reality) device, a car, a data storage device, an audio playback device, a video playback device, a notebook computer, a desktop computing device, a wearable device such as an electronic watch, electronic glasses, an electronic helmet, an electronic bracelet, an electronic necklace, an electronic clothing, and the like.

[0220] In Figure 10 In the electronic device shown, the processor 110 can be configured to invoke an application stored in the memory 120, and specifically perform the following operations:

[0221] obtain a target application package for the application and an application benchmark package;

[0222] perform decompilation comparison processing on the target application package and the application benchmark package to obtain a difference class set for the target application package;

[0223] perform static taint detection on the target application package based on the difference class set to obtain a taint path set for the target application package.

[0224] In one embodiment, when performing the decompilation comparison processing on the target application package and the application benchmark package to obtain the difference class set for the target application package, the processor 110 specifically performs the following operations:

[0225] determine a first decompilation file corresponding to the application benchmark package and a second decompilation file corresponding to the target application package;

[0226] perform comparison processing on the first decompilation file and the second decompilation file to obtain the difference class set for the target application package.

[0227] In one embodiment, when performing the comparison processing on the first decompilation file and the second decompilation file, the processor 110 specifically performs the following operations:

[0228] determining, in the first decompiled file, a second file not matching each of the target files and a third file matching at least one of the target files, and determining, based on the second file and the third file, a pruned class set and an incremental class set for the target application package.

[0229] determining, in the first decompiled file, a second file not matching each of the target files and a third file matching at least one of the target files, and determining, based on the second file and the third file, a pruned class set and an incremental class set for the target application package.

[0230] In one embodiment, the processor 110, when performing the determining, in the second decompiled file, a first file not matching each of the reference files, and determining, based on the first file, an incremental class set for the target application package, specifically performs the following operations:

[0231] determining, in the second decompiled file, a first file name not matching a reference file name of each of the reference files, and determining, based on the first file name, an incremental class set for the target application package;

[0232] The determining, in the first decompiled file, a second file not matching each of the target files and a third file matching at least one of the target files, and determining, based on the second file and the third file, a pruned class set for the target application package, includes:

[0233] determining, in the first decompiled file, a second file name not matching a target file name of each of the target files and a third file name matching at least one of the target file names, and determining, based on the second file name and the third file name, a pruned class set and an incremental class set for the target application package.

[0234] In one embodiment, the processor 110, when performing the determining, based on the second file and the third file, a pruned class set and an incremental class set for the target application package, specifically performs the following operations:

[0235] adding a second file name of the second file to the pruned class set for the target application package; and,

[0236] obtaining a digest matching result of the third file and a reference target file, and adding a third file name of the third file to the incremental class set based on the digest matching result, the file name of the third file being the same as the file name of the reference target file.

[0237] In one embodiment, the processor 110, when performing the adding the third file name of the third file into the reduction class set based on the summary matching result, specifically performs the following operations:

[0238] If the result type of the summary matching result is the summary non-matching type, the third file name of the third file is added into the increment class set.

[0239] In one embodiment, the processor 110, when performing the performing the static taint detection on the target application package based on the difference class set to obtain a taint path set for the target application package, specifically performs the following operations:

[0240] Determining a set class corresponding to the difference class set, performing the static taint detection on the target application package based on the set class to obtain a taint path set for the target application package.

[0241] In one embodiment, the processor 110, when performing the performing the static taint detection on the target application package based on the set class to obtain a taint path set for the target application package, specifically performs the following operations:

[0242] If the set class is the increment class, calling a taint detection tool to perform the static taint detection on the target application package based on the increment class set to obtain a first taint path set, and taking the first taint path set as the taint path set for the target application package;

[0243] If the set class is the reduction class, obtaining a second taint path set corresponding to the application benchmark package, and determining the taint path set for the target application package based on the second taint path set and the reduction class set;

[0244] If the set class is the increment class and the reduction class, determining the taint path set for the target application package based on the first taint path set, the second taint path set and the reduction class set.

[0245] In one embodiment, the processor 110, when performing the determining the taint path set for the target application package based on the first taint path set, the second taint path set and the reduction class set, specifically performs the following operations:

[0246] Determining at least one reference taint path from the second taint path set based on the reduction class set;

[0247] Obtaining at least one target taint path in the second taint path set, wherein the target taint path is a taint path in the second taint path set except the reference taint path.

[0248] add the at least one target taint path to the first taint path set to obtain a taint path set for the target application package.

[0249] In one embodiment, the processor 110, when performing the determining the taint path set for the target application package based on the second taint path set and the pruning class set, specifically performs the following operations:

[0250] determining at least one reference taint path from the second taint path set based on the pruning class set;

[0251] performing deletion processing on the at least one reference taint path in the second taint path set to obtain a taint path set for the target application package.

[0252] In one embodiment, the processor 110, when performing the calling the taint detection tool to perform static taint detection on the target application package based on the incremental class set to obtain a first taint path set, specifically performs the following operations:

[0253] determining a detection entry function set for the target application package based on the incremental class set;

[0254] calling a taint detection tool to perform static taint detection on the target application package based on the detection entry function set to obtain a first taint path set.

[0255] In one embodiment, the processor 1001, when performing the determining a detection entry function set for the target application package based on the incremental class set, specifically performs the following operations:

[0256] obtaining an inter-process call graph of the target application package, and determining an initial entry function set based on the inter-process call graph;

[0257] performing function node traversal processing on the inter-process call graph based on the incremental class set and the initial entry function set to determine at least one target node function;

[0258] generating a detection entry function set containing the at least one target node function.

[0259] In one embodiment, the processor 110, when performing the performing function node traversal processing on the inter-process call graph based on the incremental class set and the initial entry function set to determine at least one target node function, specifically performs the following operations:

[0260] Based on at least one initial entry function indicated by the initial entry function set as a reference, each next function node corresponding to each initial function node in the inter-process control flow graph is subjected to node class matching processing based on the incremental class set, to obtain a target node function corresponding to at least one target function node;

[0261] The initial function node is a first node corresponding to the initial entry function in the inter-process control flow graph, and a target function class to which a target entry function corresponding to the target function node belongs is a function class in the incremental class set.

[0262] In one embodiment, when the processor 1001 performs static taint detection on the target application package by calling a taint detection tool based on the detection entry function set, to obtain a first taint path set, the processor 1001 specifically performs the following operations:

[0263] An inter-process call graph corresponding to the target application package is obtained, and the inter-process call graph is subjected to static taint detection based on the detection entry function set, to obtain a first taint path set for the target application package.

[0264] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when the program is executed, the processes of the above-mentioned embodiments can be included. The storage medium can be a magnetic disc, an optical disc, a read-only memory, or a random access memory.

[0265] The above disclosure is only the preferred embodiments of the present application, and of course cannot limit the scope of the rights of the present application, so equivalent changes made according to the claims of the present application still fall within the scope of the present application.

Claims

1. An application detection method, characterized in that, The method includes: Obtain the target application package and the application benchmark package for the application; The target application package and the application benchmark package are decompiled to determine the first decompiled file corresponding to the application benchmark package and the second decompiled file corresponding to the target application package. The first decompiled file and the second decompiled file are compared by file name to obtain a set of difference classes for the target application package. Static taint detection is performed on the target application package based on the set of difference classes to obtain a set of taint paths for the target application package; The step of performing static taint detection on the target application package based on the set of difference classes to obtain a set of tainted paths for the target application package includes: Determine the set class corresponding to the set of differences, wherein the set class includes an increment class and / or a reduction class; Based on the incremental class set, a set of detection entry functions for the target application package is determined. Based on the set of detection entry functions, a taint detection tool is called to perform static taint detection on the target application package to obtain a first taint path set. Based on the pruning class set, at least one reference tainted path is deleted from the second tainted path set corresponding to the application base package to obtain the target tainted path other than the reference tainted path. Obtain a set of tainted paths for the target application package, including a first set of tainted paths and / or a set of target tainted paths.

2. The method according to claim 1, characterized in that, The step of performing file name matching and comparison on the first decompiled file and the second decompiled file to obtain a set of difference classes for the target application package includes: Referring to at least one benchmark file contained in the first decompiled file, a first file that does not match each of the benchmark files is identified in the second decompiled file; and an incremental class set for the target application package is determined based on the first file; and / or With reference to at least one target file contained in the second decompiled file, a second file that does not match each of the target files and a third file that matches at least one of the target files are determined in the first decompiled file. Based on the second file and the third file, a set of deletion classes and a set of increment classes for the target application package are determined.

3. The method according to claim 2, characterized in that, The step of identifying a first file in the second decompiled file that does not match each of the baseline files, and determining an incremental class set for the target application package based on the first file, includes: In the second decompiled file, a first file name that does not match the base file name of each of the base files is determined, and an incremental class set for the target application package is determined based on the first file name; The step of identifying a second file that does not match each of the target files and a third file that matches at least one of the target files in the first decompiled file, and determining a set of deletion classes for the target application package based on the second file and the third file, includes: In the first decompiled file, a second file name that does not match the target file name of each of the target files and a third file name that matches at least one of the target file names are determined. Based on the second file name and the third file name, a set of deletion classes and a set of increment classes for the target application package are determined.

4. The method according to claim 2, characterized in that, The step of determining the set of deletion classes and the set of increment classes for the target application package based on the second file and the third file includes: Add the second file name of the second file to the deletion class set for the target application package; and, Obtain the summary matching result between the third file and the reference target file, and add the third file name of the third file to the incremental class set based on the summary matching result. The file name of the third file is the same as the file name of the reference target file.

5. The method according to claim 4, characterized in that, The step of adding the third file name of the third file to the deletion class set based on the digest matching result includes: If the result type of the summary matching result is summary mismatch, then the third file name of the third file is added to the incremental class set.

6. The method according to claim 1, characterized in that, The process involves determining a set of detection entry functions for the target application package based on an incremental class set, calling a taint detection tool to perform static taint detection on the target application package based on the detection entry function set, obtaining a first taint path set, and deleting at least one reference taint path from the second taint path set corresponding to the application baseline package based on a deletion class set, thereby obtaining target taint paths other than the reference taint paths. Determining a taint path set for the target application package, including the first taint path set and / or the target taint paths, includes: If the set class is an incremental class, then the taint detection tool is invoked to perform static taint detection on the target application package based on the incremental class set to obtain a first taint path set, and the first taint path set is used as the taint path set for the target application package. If the set class is a pruning class, then based on the pruning class set, at least one reference tainted path is deleted from the second tainted path set corresponding to the application base package to obtain the target tainted path other than the reference tainted path, and a tainted path set for the target application package including the target tainted path is obtained. If the set class is an increment class and a deletion class, then the tainted path set including the first tainted path set and the target tainted path is obtained.

7. The method according to claim 6, characterized in that, The obtained taint path set, which includes the first taint path set and the target taint path, includes: At least one reference tainted path is determined from the second tainted path set based on the pruning class set; Obtain at least one target taint path from the second taint path set, wherein the target taint path is a taint path in the second taint path set other than the reference taint path; The at least one target tainted path is added to the first tainted path set to obtain a tainted path set for the target application package.

8. The method according to claim 6, characterized in that, The step of deleting at least one reference tainted path from the second tainted path set corresponding to the application baseline package based on the tainted class set, to obtain target tainted paths other than the reference tainted paths, includes: At least one reference tainted path is determined from the second tainted path set based on the pruning class set; The at least one reference tainted path in the second tainted path set is deleted to obtain the target tainted path other than the reference tainted path.

9. The method according to claim 1, characterized in that, The step of determining the set of detection entry functions for the target application package based on the incremental class set includes: Obtain the inter-procedure call graph of the target application package, and determine the initial set of entry functions based on the inter-procedure call graph; Based on the incremental class set and the initial entry function set, the inter-process call graph is traversed to determine at least one target node function. Generate a set of detection entry functions that includes at least one target node function.

10. The method according to claim 9, characterized in that, The step of traversing the inter-process call graph based on the incremental class set and the initial entry function set to determine at least one target node function includes: Based on at least one initial entry function indicated by the initial entry function set, node class matching is performed on each next function node corresponding to each initial function node in the inter-process control flow graph based on the incremental class set to obtain at least one target node function corresponding to the target function node. Wherein, the initial function node is the first node corresponding to the initial entry function in the inter-process control flow graph, and the target function class to which the target entry function corresponding to the target function node belongs is the function class in the incremental class set.

11. The method according to claim 1, characterized in that, The step of calling the taint detection tool based on the detection entry function set to perform static taint detection on the target application package, and obtaining the first taint path set, includes: Obtain the inter-procedure call graph corresponding to the target application package; Static taint detection is performed on the inter-process call graph based on the set of detection entry functions to obtain a first set of taint paths for the target application package.

12. An application detection device, characterized in that, The device includes: The acquisition module is used to acquire the target application package and the application benchmark package. The processing module is used to decompile the target application package and the application base package, determine the first decompiled file corresponding to the application base package and the second decompiled file corresponding to the target application package, and perform file name comparison processing on the first decompiled file and the second decompiled file to obtain a set of difference classes for the target application package; The detection module is used to perform static taint detection on the target application package based on the set of difference classes to obtain a set of taint paths for the target application package; The step of performing static taint detection on the target application package based on the set of difference classes to obtain a set of tainted paths for the target application package includes: Determine the set class corresponding to the set of differences, wherein the set class includes an increment class and / or a reduction class; Based on the incremental class set, a set of detection entry functions for the target application package is determined. Based on the set of detection entry functions, a taint detection tool is called to perform static taint detection on the target application package to obtain a first taint path set. Based on the pruning class set, at least one reference tainted path is deleted from the second tainted path set corresponding to the application base package to obtain the target tainted path other than the reference tainted path. Obtain a set of tainted paths for the target application package, including a first set of tainted paths and / or a set of target tainted paths.

13. A computer storage medium, characterized in that, The computer storage medium stores a plurality of instructions adapted for loading by a processor and executing the steps of the method as described in any one of claims 1 to 11.

14. An electronic device, characterized in that, include: A processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method as described in any one of claims 1 to 11.

Images