Application software security evaluation method and device based on OTT and IPTV platform

Abstract

The present invention discloses a method and device for application software security evaluation based on OTT and IPTV platforms, including: determining the detection items input by the user, and loading the vulnerability code features from the vulnerability feature library to generate a data model corresponding to the detection items; obtaining the installation package file submitted by the user, and scanning the decompiled code of the installation package file; using the data model corresponding to the detection item to determine the suspicious code position in the decompiled code; according to the smali syntax, using backtracking and recursive algorithms for the variables in the decompiled code to obtain the context information of the suspicious code; determining the vulnerability position based on the context information of the suspicious code and the suspicious code position. This application proposes an automated evaluation method, which can independently set detection rules to create a detection platform that meets the regulatory standards of the new media industry.

Description

Technical Field

[0001] The present invention relates to the field of new media technology, and in particular to a method and device for security evaluation of application software based on OTT and IPTV platforms. Background Art

[0002] With the increasing popularity of new media smart terminals, Android system, as the most mainstream operating system in the current OTT and IPTV market, has seen a continuous increase in the types and number of applications. As an open system, Android has a variety of security issues in applications, such as reverse decompilation of installation packages, malicious code injection, application piracy, interface hijacking, SMS hijacking, input monitoring, etc. These security issues of new media platform applications will not only leak users' personal information, but may even lead to the theft of intellectual property rights of applications, resulting in reputational and economic damage.

[0003] Although the current security status of the application market is known, due to the professionalism of the new media application security field, developers and users cannot fully understand the security risks and vulnerabilities of the application, and it is difficult to make in-depth assessments and analyses of application security. They also lack professional knowledge to solve security problems one by one. Professional new media application security engineers are scarce and costly, and cannot meet the security assessment needs of a large number of applications. In addition, in essence, the security issues of applications mainly come from the security status of the source code. The security risks of the source code are hidden in a large amount of source code content and are difficult to find and identify. Summary of the invention

[0004] The embodiment of the present invention provides an application software security evaluation method and device based on OTT and IPTV platforms, which are used to propose an automated evaluation method, can independently set detection rules, and create a detection platform that complies with the regulatory standards of the new media industry.

[0005] The embodiment of the present invention provides an application software security evaluation method based on OTT and IPTV platforms, including:

[0006] Determine the detection item input by the user, and load the vulnerability code feature from the vulnerability feature library to generate a data model corresponding to the detection item;

[0007] Obtain the installation package file submitted by the user, and scan the decompiled code of the installation package file;

[0008] Determine the suspicious code location in the decompiled code by using the data model corresponding to the detection item;

[0009] According to the smali syntax, backtracking and recursive algorithms are used on the variables in the decompiled code to obtain the context information of the suspicious code;

[0010] The vulnerability location is determined based on the context information of the suspicious code and the location of the suspicious code.

[0011] In some embodiments, loading vulnerability code features from a vulnerability feature library includes:

[0012] Extracting positive features and negative features of vulnerability codes and security codes from the vulnerability feature library respectively;

[0013] Among them, positive features include:

[0014] Code flows and specifications involving security risks recommended by Android SDK, code features or binary features in higher-version third-party SDKs, features of reinforcement packages of mobile application security vendors, file structures and code features of mobile application security software, code features used to monitor whether the mobile application operating environment is secure, and code features for enhancing security disclosed by Google and the security industry;

[0015] Negative features include:

[0016] C / C++ system function call features that pose a risk of system crash, javascript text features that pose a risk of web service information leakage, special constant leakage features in the source code, code features that pose a risk of database injection attacks, code context features that pose a risk of vulnerabilities, insecure features of Android resource files, plaintext features of Android certificates, and code features that pose a risk of security vulnerabilities disclosed by Google.

[0017] In some embodiments, the data model corresponding to the detection item includes at least one of the following models: a keyword model, a regular expression model, and a blacklist and whitelist model.

[0018] In some embodiments, the suspicious code location in the decompiled code is determined by directly matching features at the binary level.

[0019] In some embodiments, after determining the vulnerability location, the method further includes calling back the vulnerability location to the target engine.

[0020] The embodiment of the present application further proposes an application software security evaluation device based on an OTT and IPTV platform, including a processor configured to:

[0021] Determine the detection item input by the user, and load the vulnerability code feature from the vulnerability feature library to generate a data model corresponding to the detection item;

[0022] Obtain the installation package file submitted by the user, and scan the decompiled code of the installation package file;

[0023] Determine the suspicious code location in the decompiled code by using the data model corresponding to the detection item;

[0024] According to the smali syntax, backtracking and recursive algorithms are used on the variables in the decompiled code to obtain the context information of the suspicious code;

[0025] The vulnerability location is determined based on the context information of the suspicious code and the location of the suspicious code.

[0026] The embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the aforementioned method are implemented.

[0027] The embodiment of the present invention proposes an automated evaluation method, which can independently set detection rules and create a detection platform that complies with the regulatory standards of the new media industry.

[0028] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0030] Figure 1 This is a basic flow chart of an embodiment of the present application. DETAILED DESCRIPTION

[0031] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0032] The embodiment of the present invention provides an application software security assessment method based on OTT and IPTV platforms. In this example, it can be implemented through a static engine. The static engine uses tools to parse the application package information based on the submitted APK file, obtain the complete application permissions, components, behaviors and other information and the application smali source code file, analyze the vulnerability of the source code smali in combination with the vulnerability situation, and locate the specific files and methods. Binary feature analysis is performed on the C / C++ dynamic link library in the application package. Figure 1As shown, the method of the present application comprises the following steps:

[0033] In step S101, the detection item input by the user is determined, and the vulnerability code feature is loaded from the vulnerability feature library to generate a data model corresponding to the detection item. In this example, the vulnerability feature library can be pre-set. In some embodiments, the data model corresponding to the detection item includes at least one of the following models: a keyword model, a regular model, and a blacklist and whitelist model.

[0034] In step S102, the installation package file submitted by the user is obtained, and the decompiled code of the installation package file is scanned, that is, the APK file is decompiled to obtain the source code.

[0035] In step S103, the suspicious code position in the decompiled code is determined using the data model corresponding to the detection item. The problematic code is located based on the source code and data model obtained above.

[0036] In step S104, backtracking and recursive algorithms are used on variables in the decompiled code according to the smali syntax to obtain context information of the suspicious code.

[0037] In step S105, the vulnerability location is determined based on the context information of the suspicious code and the location of the suspicious code. In Android, Java method parameters usually determine whether a vulnerability exists. In this example, after obtaining the suspicious code location, the static engine uses backtracking and recursive algorithms on the variables in the code according to the smali syntax to obtain the context information of the suspicious code, and again uses regular expressions to determine the security vulnerabilities that may be caused by the context.

[0038] The embodiment of the present invention proposes an automated evaluation method, which can independently set detection rules and create a detection platform that complies with the regulatory standards of the new media industry.

[0039] In some embodiments, loading vulnerability code features from a vulnerability feature library includes:

[0040] Extracting positive features and negative features of vulnerability codes and security codes from the vulnerability feature library respectively;

[0041] Among them, positive features include:

[0042] Code flows and specifications involving security risks recommended by Android SDK, code features or binary features in higher-version third-party SDKs, features of reinforcement packages of mobile application security vendors, file structures and code features of mobile application security software, code features used to monitor whether the mobile application operating environment is secure, and code features for enhancing security disclosed by Google and the security industry;

[0043] Negative features include:

[0044] C / C++ system function call features that pose a risk of system crash, javascript text features that pose a risk of web service information leakage, special constant leakage features in the source code, code features that pose a risk of database injection attacks, code context features that pose a risk of vulnerabilities, insecure features of Android resource files, plaintext features of Android certificates, and code features that pose a risk of security vulnerabilities disclosed by Google.

[0045] In some embodiments, the suspicious code location in the decompiled code is determined by directly matching features at the binary level.

[0046] In some embodiments, after determining the vulnerability location, the method further includes calling back the vulnerability location to the target engine.

[0047] The present application embodiment also proposes a method for application software security assessment based on OTT and IPTV platforms, which is implemented by using static engine and dynamic state detection technology.

[0048] Static testing includes the following steps:

[0049] Step 1: Extract the features of vulnerability code and security code for positive / negative comparison.

[0050] Step 2: Scan the decompiled code of the application package based on the submitted APK source code.

[0051] Step 201: Use an efficient regular expression tool to perform code matching on source code level features to determine the location of suspicious code and the presence or absence of safe code.

[0052] Step 202: directly match the binary-level features.

[0053] Step 3: Get the code environment information and compare it to see if it is consistent to prevent false positives.

[0054] Step 301, Java method parameters in Android usually determine whether a vulnerability exists, so after obtaining the code location in the second step, the engine uses backtracking and recursive algorithms on the variables in the code according to the smali syntax to obtain the context information of the suspicious code, and again uses regular expressions to determine the security vulnerabilities that may be caused by the context.

[0055] Step 4: Locate the vulnerability based on the matching results of steps 2 and 3, and call back the results to the engine for scheduling.

[0056] The dynamic detection engine installs the APK file on the simulated device according to the actual situation of vulnerabilities and risks, starts the application, and uses tools to dynamically attack and obtain application information to obtain risk information. The Android device simulator runs with the help of the Linux kernel, and libhoudini is used to make it run smoothly on the x86 server. It includes the following steps:

[0057] Step 1: First, scan the code to see if there is any suspected vulnerability code to increase the verification speed.

[0058] Step 2: If it exists, get the current class information.

[0059] Step 3. Install the current evaluation APK to the simulated device or real machine. The simulator and real machine have the original Android debugging tool, Android injection tool, communication monitoring tool, scanning and simulated attack tool, and interface interception tool.

[0060] Step 4: Dynamically start the assessment project. For the detection of the ability to defend against attacks, the engine starts the application and calls the tools in point 3 in sequence to attack; for the detection of the ability to defend against threat environments, the engine simulates the characteristics of the dangerous operating environment and starts the application.

[0061] Step 5: Determine whether the result is safe based on the running result of the application.

[0062] Step 6: Call back the result to the engine for scheduling.

[0063] The solution of this application combines the detection methods of static detection and dynamic detection. In the static detection method, the static detection module can quickly locate and search for the static code features of the vulnerability, and mark the location of the risk and vulnerability; in the dynamic detection method, the dynamic detection engine combines the simulator device management module to quickly install the application, simulate real-time dynamic attacks after starting the application, and verify the risks and vulnerabilities in the application through the behavior and logs of the application response. It can detect the security issues of third-party SDKs and the use of application permissions. It also has rich platform functions such as independent verification and editing of detection results, batch application security statistics and version security management. It can independently set detection rules to create a detection platform that meets the regulatory standards of the new media industry.

[0064] The embodiment of the present application further proposes an application software security evaluation device based on an OTT and IPTV platform, including a processor configured to:

[0065] Determine the detection item input by the user, and load the vulnerability code feature from the vulnerability feature library to generate a data model corresponding to the detection item;

[0066] Obtain the installation package file submitted by the user, and scan the decompiled code of the installation package file;

[0067] Determine the suspicious code location in the decompiled code by using the data model corresponding to the detection item;

[0068] According to the smali syntax, backtracking and recursive algorithms are used on the variables in the decompiled code to obtain the context information of the suspicious code;

[0069] The vulnerability location is determined based on the context information of the suspicious code and the location of the suspicious code.

[0070] The embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the aforementioned method are implemented.

[0071] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0072] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0073] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for a terminal (which can be a mobile phone, computer, server or network equipment, etc.) to execute the methods described in each embodiment of the present invention.

[0074] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A method for security assessment of application software based on OTT and IPTV platforms, characterized in that: include: Determine the detection item input by the user, and load the vulnerability code feature from the vulnerability feature library to generate a data model corresponding to the detection item; Obtain the installation package file submitted by the user, and scan the decompiled code of the installation package file; Determine the suspicious code location in the decompiled code by using the data model corresponding to the detection item; According to the smali syntax, backtracking and recursive algorithms are used on the variables in the decompiled code to obtain the context information of the suspicious code; Determine the vulnerability location based on the context information of the suspicious code and the location of the suspicious code; Loading vulnerability code features from the vulnerability feature library includes: Extracting positive features and negative features of vulnerability codes and security codes from the vulnerability feature library respectively; Among them, positive features include: Code flows and specifications involving security risks recommended by Android SDK, code features or binary features in higher-version third-party SDKs, features of reinforcement packages of mobile application security vendors, file structures and code features of mobile application security software, code features used to monitor whether the mobile application operating environment is secure, and code features for enhancing security disclosed by Google and the security industry; Negative features include: Features of C / C++ system function calls that pose a risk of system crashes, features of javascript text that may leak web service information, features of special constant leaks in source code, features of code that may be attacked by database injections, features of code context that may have vulnerabilities, features of insecure Android resource files, features of plain text Android certificates, and features of code that has security vulnerabilities disclosed by Google; The data model corresponding to the detection item includes at least one of the following models: a keyword model, a regular model, a blacklist and whitelist model; The suspicious code location in the decompiled code is determined by directly matching the binary level features.

2. The method for security evaluation of application software based on OTT and IPTV platforms as claimed in claim 1, characterized in that: After determining the vulnerability location, the method further includes calling back the vulnerability location to the target engine.

3. An application software security evaluation device based on OTT and IPTV platforms, characterized in that: comprising a processor configured to: Determine the detection item input by the user, and load the vulnerability code feature from the vulnerability feature library to generate a data model corresponding to the detection item; Obtain the installation package file submitted by the user, and scan the decompiled code of the installation package file; Determine the suspicious code location in the decompiled code by using the data model corresponding to the detection item; According to the smali syntax, backtracking and recursive algorithms are used on the variables in the decompiled code to obtain the context information of the suspicious code; Determine the vulnerability location based on the context information of the suspicious code and the location of the suspicious code; Loading vulnerability code features from the vulnerability feature library includes: Extracting positive features and negative features of vulnerability codes and security codes from the vulnerability feature library respectively; Among them, positive features include: Code flows and specifications involving security risks recommended by Android SDK, code features or binary features in higher-version third-party SDKs, features of reinforcement packages of mobile application security vendors, file structures and code features of mobile application security software, code features used to monitor whether the mobile application operating environment is secure, and code features for enhancing security disclosed by Google and the security industry; Negative features include: Features of C / C++ system function calls that pose a risk of system crashes, features of javascript text that may leak web service information, features of special constant leaks in source code, features of code that may be attacked by database injections, features of code context that may have vulnerabilities, features of insecure Android resource files, features of plain text Android certificates, and features of code that has security vulnerabilities disclosed by Google; The data model corresponding to the detection item includes at least one of the following models: a keyword model, a regular model, a blacklist and whitelist model; The suspicious code location in the decompiled code is determined by directly matching the binary level features.

4. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to claim 1 or 2 are implemented.

Images