A method and apparatus for detecting an application

Abstract

The application provides a kind of detection method and device of application program;It is related to cloud technology, method includes: the source code of application program is input verification detection, obtains the user input and comparison content of the application program;The comparison content is context content identification processing, obtains the type of the comparison content;The user input is context condition identification processing, obtains the code assignment behavior of the user input;Based on the type of the comparison content and the code assignment behavior of the user input, determine the hidden function in the application program.By the present application, the hidden function in the application program can be accurately detected to ensure the security during the use of application program.

Description

Technical Field

[0001] This application relates to computer software testing technology and cloud technology, and in particular to a method and apparatus for testing applications. Background Technology

[0002] Taint analysis is a technique that tracks and analyzes the flow of tainted information within a program. In vulnerability analysis, taint analysis is used to mark data of interest (usually from external input to the program) as tainted data. By tracing the flow of information related to the tainted data, it can be determined whether these tainted data affect certain critical program operations, thereby uncovering program vulnerabilities.

[0003] Taint analysis techniques typically uncover vulnerabilities in application data flows by tracing security-related data streams and focusing on network communication-related data streams. Static analysis tools, however, only focus on application-specific vulnerabilities and are ineffective against applications containing hidden behaviors. Therefore, these applications pose significant security risks to users.

[0004] Therefore, there is a lack of effective solutions in related technologies to improve the security of applications. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and computer-readable storage medium for detecting applications, which can accurately detect hidden functions in applications to ensure the security of applications during use.

[0006] The technical solution of this application embodiment is implemented as follows:

[0007] This application provides a method for detecting an application, including:

[0008] Input validation is performed on the application's source code to obtain the user input and comparison content; contextual content recognition processing is performed on the comparison content to obtain the type of the comparison content; contextual condition recognition processing is performed on the user input to obtain the code dispatch behavior of the user input; based on the type of the comparison content and the code dispatch behavior of the user input, hidden functions in the application are determined.

[0009] This application provides an application detection device, comprising:

[0010] An input validation detection module is used to perform input validation detection on the application's source code to obtain the user input and comparison content of the application; a context content recognition module is used to perform context content recognition processing on the comparison content to obtain the type of the comparison content; a context content recovery module is used to perform context condition recognition processing on the user input to obtain the code dispatch behavior of the user input; and a behavior discovery and verification module is used to determine the hidden functions in the application based on the type of the comparison content and the code dispatch behavior of the user input.

[0011] In the above scheme, the types of the comparison content include hard-coded strings and confidential strings; the behavior discovery and verification module is further used to determine that the type of the comparison content is a confidential string when the comparison content contains a subset of a specified string, the user input is equal to the value included in the comparison content, and each value included in the comparison content corresponds to a different execution result of the application; and to determine that the type of the comparison content is a hard-coded string when the user input is equal to the value included in the comparison content, the source of the value included in the comparison content is one, and the execution results of the application are all the same.

[0012] In the above scheme, the code dispatching behavior of the user input includes: the number of logical conditions input by the user and the number of branches generated by the logical conditions; the context content recovery module is further used to determine the logical conditions in the context of the user input and the number of the logical conditions; and to verify the user input for each logical condition in order to determine the number of branches generated by the logical condition.

[0013] In the above scheme, the behavior discovery and verification module is further used to determine the dispatch method corresponding to the code dispatch behavior based on the relationship between the number of logical conditions input by the user and the number of branches of the logical conditions; and to verify the user input based on the dispatch method and the type of the comparison content to determine the hidden function in the application.

[0014] In the above scheme, the dispatching methods include: one-to-two dispatching, many-to-two dispatching, and many-to-many dispatching. The behavior discovery and verification module is further used to determine that the hidden function in the application is a secret access key when the dispatching method is one-to-two dispatching and the type of the comparison content is a hard-coded string; to determine that the hidden function in the application is a master password when the dispatching method is many-to-two dispatching, the source of the value included in the comparison content is multiple, and at least one of the types of the value included in the comparison content is a hard-coded string; and to determine that the hidden function in the application is a secret command when the dispatching method is many-to-many dispatching, the source of the value included in the comparison content is multiple, and at least one of the types of the value included in the comparison content is a specified string.

[0015] In the above scheme, the input verification detection module is further used to perform interface recognition processing on the comparison content in the application to obtain the interface information included in the function used by the comparison content; and to determine the source of the value included in the comparison content based on the interface information; wherein the source of the value included in the comparison content includes at least one of the following: file operation, database operation, sharing module, network request, broadcast.

[0016] In the above scheme, the input verification and detection module is further configured to: create a control flow graph of the application based on the application's source code; traverse the control flow graph to determine the functions used in the application's source code; determine the user input in the application's source code according to the correspondence between the functions and the user input; and determine the comparison content in the application's source code according to the correspondence between the functions and the comparison content.

[0017] In the above scheme, the behavior discovery and verification module is further used to perform backward slicing of the application's source code to obtain the logical conditions in the context of the user input; to perform verification processing on the user input for each logical condition to obtain a verification result; when the verification result indicates that the user input does not match any of the logical conditions, it is determined that the application has a hidden function.

[0018] In the above scheme, the behavior discovery and verification module is further used to obtain target information to be tracked in the application, determine the slicing rules corresponding to the target information, and perform backward slicing processing on the source code of the application according to the slicing rules to obtain the logical conditions in the context of user input corresponding to the target information.

[0019] This application provides an electronic device, including:

[0020] Memory, used to store executable instructions;

[0021] The processor, when executing executable instructions stored in the memory, implements the application detection method provided in the embodiments of this application.

[0022] This application provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implement the application detection method provided in this application.

[0023] The embodiments of this application have the following beneficial effects:

[0024] By performing contextual content recognition processing on the compared content, the type of compared content is determined; by performing contextual condition recognition processing on user input, the code dispatch behavior of user input is determined; and by referencing the context of user input, the accuracy of user input validation is improved. Combining the determined type of compared content and the code dispatch behavior of user input, hidden functions in the application are uncovered, thereby ensuring security during application use. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the architecture of the application detection system 100 provided in this application embodiment;

[0026] Figure 2 This is a schematic diagram of the structure of terminal 400-1 provided in the embodiments of this application;

[0027] Figure 3A This is a flowchart illustrating the application detection method provided in this embodiment of the application;

[0028] Figure 3B This is a flowchart illustrating the application detection method provided in this embodiment of the application;

[0029] Figure 3C This is a flowchart illustrating the application detection method provided in this embodiment of the application;

[0030] Figure 4 This is a schematic diagram of the system structure of the application detection method provided in the embodiments of this application;

[0031] Figure 5 This is a schematic diagram of the overall process of the application detection method provided in the embodiments of this application;

[0032] Figure 6 This is a flowchart illustrating the strategy for hidden behavior verification in the application detection method provided in this application embodiment. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0034] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0035] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0036] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0037] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0038] 1) User input: Data manually entered by local users in the application, such as strings entered by the user.

[0039] 2) Comparison content: The comparison data in the application's source code that is logically processed with the user input, such as the string that is compared with the user input in the judgment condition.

[0040] 3) Code dispatch behavior: Two attributes of validating user input in a method, including (i) how many times the user input is validated within the condition of a method; and (ii) how many conditional branches can be taken if the validation is satisfied.

[0041] 4) Hard-coded strings: Hard-coded strings are software development practices that embed strings directly into the application's source code, and can only be modified by editing the source code and recompiling the executable file.

[0042] 5) Confidential strings: These are a special type of object, namely strings that cannot be changed in the code.

[0043] 6) Context: refers to the runtime environment in which the application is executed. The runtime environment includes configured environment information, such as the values ​​of various variables or parameters set.

[0044] 7) Taint Analysis: This is a technique that tracks and analyzes the flow of tainted information within a program. In vulnerability analysis, taint analysis is used to mark data of interest (usually from external input to the application) as tainted data. By tracing the flow of information related to the tainted data, it's possible to determine whether it affects certain critical program operations, thereby uncovering program vulnerabilities. In other words, the question of whether an application has a vulnerability is transformed into the question of whether tainted information will be used by operations at the sink point (the location of information leakage, i.e., the taint convergence point).

[0045] 8) Code is the source file written by programmers using a language supported by development tools. It is a set of explicit rules that represent information in discrete form using characters, symbols, or signal elements. In modern programming languages, source code can appear in the form of books or tapes, but the most common format is a text file.

[0046] 9) A method is a named subroutine created in Java. Within a class, the function of a program is embodied in its methods. For simple data types, Java implements pass-by-value; the method receives the value of the parameter but cannot change that value. If you need to change the value of the parameter, use a reference data type because a reference data type passes the memory address of the data to the method, and operations on the data within the method can change its value.

[0047] 10) A control flow graph (CFG) is an abstract representation of an application. It is an abstract data structure used in the compiler and maintained internally. It represents all paths that an application will traverse during execution. It uses a graph to represent the possible flow of execution of all basic blocks within a process, and can also reflect the real-time execution process of a process.

[0048] 11) Secret Access Key (SK): The secret access key is used to sign and verify the request data, ensuring the confidentiality, integrity, and correctness of the requester's identity.

[0049] 12) Master password: After setting the master password, you only need to enter the master password once for each session to view the saved account and password. This means you don't need to re-enter the account and password every time you view them.

[0050] 13) Secret commands, used to modify the hidden attribute of files or folders.

[0051] 14) Shared modules: By preparing to "publish" shared modules, "publish" refers to a collection of files that together allow modules to be built, packaged, and published.

[0052] Related technologies typically uncover vulnerabilities in application data flows by tracking security-related data flows and focusing on network communication-related data flows. However, many commercially available applications, besides the useful functions users need, contain many hidden behaviors not explicitly displayed to the user. These hidden behaviors can potentially tamper with data by sending specified keystrokes to directly access the management page without the user's knowledge. Therefore, these hidden behaviors pose a significant security risk to users. Static analysis tools, however, only focus on application-related vulnerabilities, neglecting logical issues and the application's context. This results in unverifiable logic, failing to discover hidden functions within the application, and ultimately leading to weak application security.

[0053] To address the aforementioned technical problems, embodiments of this application provide a method, apparatus, electronic device, and computer-readable storage medium for detecting applications. These methods can accurately detect hidden functions within applications to ensure security during application use. The following describes exemplary applications of the application detection method provided in this application. This method can be implemented by various electronic devices, such as smartphones, tablets, laptops, desktop computers, and other types of terminals, or as a server. Exemplary applications when the electronic device is implemented as a terminal will be described below.

[0054] The following describes an exemplary application system architecture for a terminal implementing the application detection method provided in the embodiments of this application. See also Figure 1 , Figure 1 This is a schematic diagram of the architecture of an application detection system 100 provided in an embodiment of this application. The application detection system 100 includes a server 200, a network 300, and terminals (terminals 400-1 and 400-2 are shown exemplarily). The terminals are connected to the server 200 through the network 300, which can be a wide area network (WAN), a local area network (LAN), or a combination of both.

[0055] In some embodiments, terminal 400-1 contains an application. The application's source code is sent to server 200. Server 200 performs input verification and detection on the application's source code to obtain the user input and comparison content. Contextual content recognition processing is performed on the comparison content to obtain the type of the comparison content. Contextual condition recognition processing is performed on the user input to obtain the code dispatch behavior of the user input. Based on the type of the comparison content and the code dispatch behavior of the user input, hidden functions in the application are determined, and the hidden functions of the application are returned to terminal 400-1. Terminal 400-1 displays the hidden functions of the application through various display methods so that the user is aware of the security risks of the application.

[0056] In some embodiments, terminal 400-1 can integrate the function of the application detection method provided in the embodiments of this application, that is, terminal 400-1 implements the application detection method provided in the embodiments of this application independently. Terminal 400-1 includes an application; it obtains the application's source code, performs input verification detection on the application's source code to obtain the application's user input and comparison content; it performs contextual content recognition processing on the comparison content to obtain the type of the comparison content; it performs contextual condition recognition processing on the user input to obtain the code dispatch behavior of the user input; based on the type of the comparison content and the code dispatch behavior of the user input, it determines the hidden functions in the application, and displays the hidden functions of the application through various display methods so that the user is aware of the security risks existing in the application.

[0057] In some embodiments, server 200 may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Terminals 400-1, 400-2, and server 200 may be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment.

[0058] Next, the structure of the electronic device for implementing the application detection method provided in the embodiments of this application will be described. As mentioned above, the electronic device provided in the embodiments of this application can be... Figure 1 Terminal 400-1 in [the context of the terminal]. See also [the relevant documentation]. Figure 2 , Figure 2 This is a schematic diagram of the structure of terminal 400-1 provided in an embodiment of this application. Figure 2The terminal 400 shown includes at least one processor 410, a memory 450, at least one network interface 420, and a user interface 430. The various components in the terminal 400 are coupled together via a bus system 440. It is understood that the bus system 440 is used to implement communication between these components. In addition to a data bus, the bus system 440 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 440.

[0059] The processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0060] User interface 430 includes one or more output devices 431 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0061] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 450 may optionally include one or more storage devices physically located away from the processor 410.

[0062] The memory 450 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 450 described in this application embodiment is intended to include any suitable type of memory.

[0063] In some embodiments, memory 450 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0064] Operating system 451 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks;

[0065] The network communication module 452 is used to reach other computing devices via one or more (wired or wireless) network interfaces 420, exemplary network interfaces 420 including: Bluetooth, WiFi, and Universal Serial Bus (USB), etc.

[0066] Presentation module 453 is configured to enable the presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more output devices 431 (e.g., a display screen, a speaker, etc.) associated with user interface 430;

[0067] The input processing module 454 is used to detect and translate one or more user inputs or interactions from one or more input devices 432.

[0068] In some embodiments, the application detection device provided in this application can be implemented in software. Figure 2 A detection device 455 for an application stored in memory 450 is shown. This device can be software in the form of programs and plug-ins, and includes the following software modules: an input verification detection module 4551, a context content recognition module 4552, a context content recovery module 4553, and a behavior detection and verification module 4554. These modules are logically linked and can therefore be arbitrarily combined or further separated according to their implemented functions. The functions of each module will be described below.

[0069] The application detection method provided in this application embodiment can be derived from... Figure 1 Terminal 400-1 or server 200 can be executed independently, or it can be... Figure 1 Terminal 400-1 and server 200 work together to execute the commands.

[0070] Below, by Figure 1 The detection method for detecting an application provided in this application that is executed independently by terminal 400-1 in this embodiment is illustrated as an example. See also... Figure 3A , Figure 3A This is a flowchart illustrating the application detection method provided in this application embodiment, which will be combined with... Figure 3A The steps shown are explained.

[0071] In step 101, input validation is performed on the application's source code to obtain the user input and comparison content of the application.

[0072] In some embodiments, a control flow graph of the application is created based on the application's source code; the control flow graph is traversed to determine the functions used in the application; user input in the application's source code is determined according to the correspondence between functions and user input; and comparison content in the application's source code is determined according to the correspondence between functions and comparison content.

[0073] In some examples, creating an application's control flow graph based on its source code can be achieved by: designating each statement in the application's source code as a node, and establishing directed edges between adjacent statements in the order of statement execution; the directed edges represent the application's execution path, with the direction of the edges indicating the order of statement execution, thus obtaining a directed control flow graph. Traversing all paths in the directed control flow graph identifies the functions used in the application. The terminal stores the correspondence between functions, user input, and comparison content. For example, the function `EditText.getText().toString()` retrieves the string input by the user; in the function `if(A<60, "Fail", if(A>80, "Good"))`, 60 and 80 are the comparison content. The described string should not be considered a limitation of this application; user input can also be database input, configuration files, etc.

[0074] In step 102, the comparison content is subjected to contextual content recognition processing to obtain the type of the comparison content.

[0075] In some embodiments, the types of the comparison content include hard-coded strings and confidential strings. Contextual content recognition processing is performed on the comparison content to determine its type, which can be achieved as follows: When the comparison content contains a subset of a specified string, the user input equals the values ​​included in the comparison content, and each value included in the comparison content corresponds to a different execution result of the application, the type of the comparison content is determined to be a confidential string. When the user input equals the values ​​included in the comparison content, the values ​​included in the comparison content originate from a single source, and the execution results of the application are all the same, the type of the comparison content is determined to be a hard-coded string.

[0076] In some examples, assuming the comparison content includes "abc" and "cd", and "abc" and "de" are identified as specified strings, when the user's input value space contains a subset of the specified string, such as "abc", meaning the user can input "abc", when the user inputs "abc" which is equal to the comparison content "abc", the application will execute a secret command. Therefore, the type of the comparison content is a secret string.

[0077] In other examples, assuming the comparison content includes values ​​from a single source (e.g., all from a database operation to get the local hostname using gethostname()), when the user enters any local hostname, the user's input is equal to the value of the comparison content, and the application's execution result is only one. Therefore, the type of the comparison content is a hard-coded string.

[0078] In this embodiment of the application, the type of the comparison content is determined by performing contextual content recognition processing on the comparison content, so as to improve the accuracy of subsequent detection of the application's hidden functions based on the type of the comparison content.

[0079] In step 103, the user input is processed for contextual condition recognition to obtain the code dispatch behavior of the user input.

[0080] In some embodiments, the code dispatching behavior of user input includes: the number of logical conditions input by the user and the number of branches generated by the logical conditions; see also Figure 3B , Figure 3B This is a flowchart illustrating an application detection method provided in an embodiment of this application. Figure 3A Step 103 can also be achieved by executing steps 1031 and 1032. Each step will be explained in detail below.

[0081] In step 1031, the logical conditions in the context of the user input and the number of logical conditions are determined.

[0082] In some examples, it's about determining how many logical conditions exist within the context of a user input, and how many times (i.e., how many comparisons) the user input is validated within a set of conditions (i.e., logical conditions). For instance, the function `if(A<60, "Fail", if(A<80, "Good", if(A>90, "Excellent")))` indicates that the conditions are A<60, A<80, and A>90, meaning the user input A is validated three times, and the number of logical conditions is 3, i.e., multiple comparisons.

[0083] In step 1032, the user input is validated for each logical condition to determine the number of branches generated by the logical condition.

[0084] In some examples, user input is validated based on logical conditions, generating corresponding strings to ensure that each logical condition in the application passes. This determines how many branches (i.e., how many actions) can be taken for each valid logical condition. For example, the function `if(A<60, "Fail", if(A<80, "Good", if(A>90, "Excellent")))` shows that the logical conditions have branches of "Fail", "Good", and "Excellent", meaning there are three branches, or multiple actions.

[0085] In this embodiment, the code dispatch behavior of the user input is determined by performing contextual condition recognition processing on the user input, so as to detect the hidden functions of the application based on the code dispatch behavior of the user input and improve the accuracy of detection.

[0086] In step 104, hidden features in the application are determined based on the type of the compared content and the code dispatch behavior of the user input.

[0087] In some embodiments, the dispatch method corresponding to the code dispatch behavior is determined based on the relationship between the number of logical conditions input by the user and the number of branches of the logical conditions; the user input is validated based on the dispatch method and the type of comparison content to determine the hidden functions in the application. For example, assuming that the number of logical conditions input by the user is 3 (multiple comparisons) and the number of branches of the logical conditions is 3 (multiple actions), the dispatch method is determined to be many-to-many dispatch.

[0088] In some embodiments, the assignment methods include: one-to-two assignment, many-to-two assignment, and many-to-many assignment; see also Figure 3C , Figure 3C This is a flowchart illustrating an application detection method provided in an embodiment of this application. It shows that after step 104 in 3A, steps 1041 to 1043 can also be executed, and will be explained in conjunction with each step.

[0089] In step 1041, when the dispatch method is one-to-two dispatch and the type of the comparison content is a hard-coded string, the hidden function in the application is determined to be a secret access key.

[0090] As an example, suppose the function `if(A==abc){true;}else{false;}` is used. We know that the condition `A==0` represents one comparison, and the branches are `true` and `false`, representing two actions. Therefore, it's a one-to-two dispatch. If `abc` is a hard-coded string, we can determine that the hidden function in the application uses a secret access key.

[0091] In step 1042, when the dispatch method is multiple-to-two dispatch, the comparison content includes values ​​from multiple sources, and at least one of the types of the comparison content includes values ​​that are hard-coded strings, the hidden function in the application is determined to be the master password.

[0092] As an example, since the comparison content includes values ​​from multiple sources—that is, the comparison content includes multiple different values—and at least one of the types of the comparison content includes hard-coded strings, it can be seen that when the user inputs any of these multiple different values, the program will perform the same operation. In other words, each different value can override other values; that is, the application can use hard-coded strings to override other value sources to drive the application to the same state (the same application execution result). This allows us to determine the hidden function in the application as the master password.

[0093] In step 1043, when the dispatch method is many-to-many dispatch, the source of the value included in the comparison content is multiple, and at least one of the types of the value included in the comparison content is a specified string, the hidden function in the application is determined to be a secret command.

[0094] As an example, when a user uses an application running on the terminal, and enters a specific key (a specified string, such as "hel") in the application, the application's background can directly access the management page to tamper with the data, thus confirming that the hidden function in the application is a secret command.

[0095] In this embodiment of the application, the user input is validated by combining the determined type of comparison content and the code dispatch behavior of the user input in order to uncover hidden functions in the application and improve the coverage of application detection.

[0096] In some embodiments, the comparison content in the application is subjected to interface identification processing to obtain the interface information included in the function used by the comparison content; based on the interface information, the source of the value included in the comparison content is determined; wherein, the source of the value included in the comparison content includes at least one of the following: file operation, database operation, shared module, network request, broadcast.

[0097] In some examples, the terminal stores the correspondence between the interface information included in the function and the source of the comparison content. For example, when the interface information included in the function is identified as objItem.Name = "StudentDB", it can be known that the source of the comparison content is a database operation.

[0098] It should be noted that the source of the values included in the comparison content is file operation, indicating that the values included in the comparison content are obtained by operating on files. The source of the values included in the comparison content is database operation, indicating that the values included in the comparison content are obtained by operating on databases. The source of the values included in the comparison content is network request, indicating that the values included in the comparison content are obtained by initiating a network request to the server. The source of the values included in the comparison content is broadcast, indicating that the values included in the comparison content are obtained through broadcast. The source of the values included in the comparison content is shared module, indicating that the values included in the comparison content are obtained through the shared module.

[0099] In the embodiment of the present application, by performing interface recognition processing on the comparison content in the application program, the source of the comparison content is determined, so as to subsequently detect the hidden functions of the application program based on the source of the comparison content and improve the accuracy of detection.

[0100] In some embodiments, backward slicing is performed on the source code of the application program to obtain the logical conditions in the context of user input; for each logical condition, verification processing is performed on the user input to obtain a verification result; when the verification result indicates that the user input does not match any logical condition, it is determined that the application program has hidden functions.

[0101] In some examples, backward slicing is performed on the source code of the application program to obtain the logical conditions in the context of user input, and the logical conditions in the context of user input of interest are selected through slicing rules: Backward slicing is performed on the source code of the application program to obtain the logical conditions in the context of user input, which can be achieved by the following method: Obtain the target information to be traced in the application program, and determine the slicing rule corresponding to the target information; According to the slicing rule, perform backward slicing on the source code of the application program to obtain the logical conditions in the context of user input corresponding to the target information.

[0102] For example, obtain the user input of interest to the user as the target information to be traced, determine the slicing rule corresponding to the target information, perform backward slicing on the source code of the application program according to the slicing rule corresponding to the target information, and obtain the logical conditions in the context of user input corresponding to the target information. Assume that the logical conditions include A < abc, A < 80, A > 90, and the user input A can only input numbers, assumed to be 70. When verifying the user input 70 through A < abc and the verification result indicates that the user input 70 does not match this logical condition A < abc, it is determined that the application program has hidden functions.

[0103] It should be noted that slices are categorized into backward slices and forward slices based on the position of the cutoff point (point of interest n) within the slice S. Backward slices are used to find statements and control predicates in program P that affect variables related to a specific point of interest; these should be located before the point of interest in program P. Backward slice processing can be implemented using slices in the Go programming language.

[0104] In this embodiment, the application is sliced ​​based on the slicing rules of the points of interest, which improves slicing efficiency and saves processing resources.

[0105] The following describes an exemplary application of the embodiments of this application in a practical application scenario. Taking the detection of an Android application package (APK) as an example, the Android application package is used as input to the terminal (the terminal is used to implement the application detection method provided in the embodiments of this application). The terminal performs input verification detection on the Android application package to obtain the user input and comparison content of the application. Contextual content recognition processing and contextual condition recognition processing are performed on the comparison content and user input respectively to obtain the source of the comparison content and the code distribution behavior of the user input. Based on the source of the comparison content and the code distribution behavior of the user input, the hidden functions in the application are determined, and the hidden functions of the application are detected intelligently. The terminal outputs the hidden functions for user reference, allowing users to more comprehensively perceive the security performance of the application.

[0106] See Figure 4 , Figure 4 This is a schematic diagram of the system structure of the application detection method provided in this application embodiment. The system structure of the application detection method includes four modules: an input verification detection module, a context content recognition module, a context content recovery module, and a behavior discovery and verification module. The following will combine... Figure 4 This application describes in detail the modules of the system structure of the application detection method provided in the embodiments of this application.

[0107] Input validation and detection module: This module performs taint analysis on the application and identifies critical system application programming interfaces (APIs). It performs taint analysis to identify user input and comparison content, representing and monitoring its propagation through static taint analysis. Critical system API identification identifies the source of comparison content: file operations, database operations, shared modules, and functions involving string manipulation such as network requests and broadcasts, such as `EditText.getText`, `EditText.getEditableText`, and `Editable.toString` functions in the Android system. It should be noted that the input validation and detection module currently only focuses on manual input behavior from local users.

[0108] The contextual content recognition module performs static backward slicing of the application to obtain the generation logic of the comparison content, thereby determining whether the generation logic is hard-coded. It also determines whether the current input value needs to be modified based on the logic. For example, in the case of a Christmas Easter egg, by checking if the system date is December 25th, if it is, the entire interface is changed to a Christmas style. Therefore, when changing the entire interface to a Christmas style, the system date needs to be changed to December 25th.

[0109] The context recovery module: 1) Determines how many logical conditions govern the user input value, i.e., how many times the user input was validated (i.e., how many comparisons) within a single method's judgment conditions (i.e., logical conditions). 2) Sequentially inputs the user input and generates corresponding strings for each branch of the logical conditions, ensuring that each logic in the application passes, i.e., determining how many branches (i.e., how many actions) can be taken for each valid logical condition.

[0110] Behavior Discovery and Verification Module: 1) Primarily based on the logical conditions within the context of the above input values, it determines whether the application's behavior falls into one of the following three categories: a) secret access key; b) master password; c) hidden command interface (i.e., secret command). For example, a screen lock application could use an access key to reset any user's password to unlock the screen and enter the system, or it could expose the crack by inputting a hard-coded graphical verification code. 2) Excluding user-accessible behaviors, it displays the application's hidden behaviors (secret access key, master password, hidden command interface (i.e., secret command)) for security personnel to assist in the judgment.

[0111] See Figure 5 , Figure 5 This is a schematic diagram of the overall process of the application detection method provided in the embodiments of this application. The following will be combined with... Figure 5This application provides a detailed description of the overall process of the application detection method provided in its embodiments.

[0112] In step 501, the terminal performs input validation checks on the input APK. This input validation can be implemented using open-source software for static taint analysis, such as the taint analysis tool FlowDroid, to identify user input, comparison content, and the source of the comparison content.

[0113] In step 502, the terminal performs contextual content recognition processing on the comparison content. After input verification detection, the terminal has two branches: one is to process the string in the application (i.e., the comparison content) and perform contextual content recognition on the string to determine the logical conditions of the string. Based on the logical conditions of the string, it is analyzed that the string is a hard-coded string (when the logical conditions of the string are fixed and do not depend on other values, it is a hard-coded string).

[0114] In step 503, the terminal performs contextual condition recognition processing on the user input. The second branch is to perform contextual condition recognition processing on the user input to determine how many branches exist in the logical conditions of the user input (i.e., the number of branches), and then for each branch, determine how many logical conditions need to be input (the number of logical conditions).

[0115] In step 504, the terminal determines hidden behaviors in the application. The main process here is to compare content (including the source and type of the compared content) and user input (including user input and the code dispatch behavior of the user input) to determine the presence of secret access keys, master passwords, and secret commands in the application.

[0116] In some embodiments, Figure 6 This is a flowchart illustrating the strategy for hidden behavior verification in the application detection method provided in this application embodiment.

[0117] Step 601: The terminal determines whether the logical condition originates from user input. If yes, proceed to step 602; otherwise, proceed to step 603. The terminal judges the input application APK to determine whether the logical condition in the APK can be achieved through user input. For example, the logical condition includes A. <abc,A<80,A> If the user inputs 90, but the user can only input the number 70, then the terminal determines that the user input cannot fulfill the logical condition in the APK, meaning the terminal determines that the logical condition does not originate from the user input.

[0118] Step 602: The terminal determines whether a condition exists. If yes, proceed to step 607 to determine that the dispatch method is one-to-two dispatch, and then proceed to step 607; if no, proceed to step 605.

[0119] Step 603: The terminal determines that the logical conditions require additional requests to be implemented.

[0120] Step 604: The terminal determines that the hidden behavior is a secret access key.

[0121] Step 605: The terminal determines whether multiple conditions exist.

[0122] Step 606: The terminal determines whether there are two actions. If yes, it determines that the dispatch method is many-to-two dispatch and then executes step 607; if no, it determines that the dispatch method is many-to-many and then executes step 607.

[0123] It should be noted that the code dispatch of user input can have two attributes: (i) how many times the user input is validated within the judgment conditions (i.e., logical conditions) of a method (the number of logical conditions, i.e., how many comparisons); and (ii) how many conditional branches can be taken if the validation is satisfied (the number of branches, i.e., how many actions). The terminal combines these two attributes to determine how to dispatch validated user input in terms of code execution flow.

[0124] Since each satisfied logical condition can only produce two branches (true or false), these two branches are denoted as two actions. By calculating the number of times the input is compared and the actions that the comparison can produce, three dispatch methods can be determined: (i) one comparison and two actions (i.e., one-to-two dispatch); (ii) multiple comparisons and two actions (i.e., many-to-two dispatch); (iii) multiple comparisons and multiple actions (i.e., many-to-many dispatch). In other words, dispatching methods can be categorized as follows: one-to-two dispatch (this code dispatch indicates that the user input is valid only once within the decision block of the method. Therefore, if the conditions for validating the user input are met, only one expected branch is taken), many-to-two dispatch (this code patch means that the user input is validated multiple times within the decision block. However, if any of these validations are met, only one expected branch will be taken. In this case, each comparison between the user input and the array element is a condition. Therefore, it has "many" conditions. However, regardless of which condition is met, one expected dispatch will be taken), and many-to-many dispatch (if there are multiple comparisons and multiple operations, it means that the user input is validated multiple times with different comparison targets, and multiple results can be generated based on the comparisons. A representative example of this dispatch is a toggle case block, where each action is assigned to a unique case).

[0125] Step 607: The terminal determines the hidden behavior (i.e., the hidden function) based on the dispatch method.

[0126] In some embodiments, hidden behavior of the application is discovered from a one-to-two dispatch. Discovering hidden behavior of the application from a one-to-two dispatch can be achieved by determining the presence of hidden behavior involving a secret access key when the user-input code dispatch is a one-to-two dispatch and the comparison content is a hard-coded string within the application.

[0127] It's important to note that with this type of code dispatch, user input is validated only once within the application's methods, and the comparison content is unknown to the user. Furthermore, only two result operations can determine if the user input is the key used for unlocking, meaning the application includes hidden behavior involving a secret access key. Hard-coded string verification can be achieved as follows: if all comparisons originate from the same source, within a method, the application will consistently move to the same state whenever the user input equals any value of the comparison content, confirming that the comparison content is a hard-coded string. In other words, these comparison items form a list, and the user input is compared to each item in the list to check for equivalence; each equivalent item results in the same program behavior.

[0128] In some embodiments, hidden application behavior is discovered from multiple binary dispatches. Discovering hidden application behavior from multiple binary dispatches can be achieved by determining that the application exhibits hidden master password behavior when the user-input code dispatch behavior is a multiple binary dispatch, the comparison content includes values ​​from multiple different sources, and one of the comparison content includes a hard-coded string.

[0129] It's important to note that in this code dispatch, user input is validated multiple times using a single method, and satisfaction with different validations leads to the same program behavior. Furthermore, for validations with the same user input and all logical conditions, the comparisons may come from one or more sources. When the comparisons include values ​​from multiple sources (this type of comparison illustrates a method where the program performs the same operation if the user input equals any of the values ​​in the comparisons; in other words, each comparison value can override the others), and one of these values ​​is a hard-coded string (the application can use a hard-coded string to override other value sources to drive the application to the same state), comparisons from different sources indicate that the values ​​of the comparisons are generated in different ways and are not identical. Therefore, when the comparisons include values ​​from multiple sources and there is a hard-coded string that can override other input sources, it can be determined that there is hidden master password behavior in the application.

[0130] In some embodiments, secret commands are discovered from many-to-many dispatches. A hidden function in the application is identified as a secret command when the dispatch method is many-to-many, the comparison content includes values ​​from multiple sources, and at least one of the types of the comparison content includes a specified string.

[0131] It's important to note that in many-to-many dispatches, different comparison values ​​(values ​​included in the comparison content) from different or the same source are used to validate the same user input. When the value included in the comparison content is resolved to a secret string (i.e., a specified string), this context indicates that within one approach, user input can derive a value from a set of specified strings, and each string can trigger a different program action. In other words, the value space of user input contains a subset of specified strings whose values ​​are unknown to the ordinary user, and each of these strings can put the application into a different state; therefore, these specified strings can be identified as secret commands.

[0132] In some embodiments, the terminal can also determine the hidden behavior of the application by judging whether additional modifications are required. That is, when the user input requires additional modification to satisfy all the logical conditions of the user input context, the terminal can determine that the application has hidden logical behavior. For example, the user can only input numbers (the user input only includes numbers), but there is a string judgment in the logical conditions, thus determining that the application has hidden logical behavior.

[0133] In this embodiment of the application, hidden functions are discovered by checking and verifying user input, which solves the problem in related technologies that cannot discover hidden behaviors in applications, and avoids the risks brought about by hidden behaviors.

[0134] The following description continues to illustrate the exemplary structure of the application detection device 455 provided in the embodiments of this application as a software module. In some embodiments, such as Figure 2 As shown, the software module in the application detection device 455 stored in the memory 450 may include:

[0135] The input verification and detection module 4551 is used to perform input verification and detection on the source code of the application to obtain the user input and comparison content of the application; the context content recognition module 4552 is used to perform context content recognition processing on the comparison content to obtain the type of the comparison content; the context content recovery module 4553 is used to perform context condition recognition processing on the user input to obtain the code dispatch behavior of the user input; and the behavior discovery and verification module 4554 is used to determine the hidden functions in the application based on the type of the comparison content and the code dispatch behavior of the user input.

[0136] In some embodiments, the behavior discovery and verification module 4552 is further configured to determine that the type of the comparison content is a confidential string when the comparison content contains a subset of a specified string, the user input is equal to the value included in the comparison content, and each value included in the comparison content corresponds to a different execution result of the application; and to determine that the type of the comparison content is a hard-coded string when the user input is equal to the value included in the comparison content, the source of the value included in the comparison content is one, and the execution results of the application are all the same.

[0137] In some embodiments, the code dispatching behavior of the user input includes: the number of logical conditions input by the user and the number of branches generated by the logical conditions; the context content recovery module 4553 is further configured to determine the logical conditions in the context of the user input and the number of the logical conditions; and to validate the user input for each of the logical conditions to determine the number of branches generated by the logical conditions.

[0138] In some embodiments, the behavior discovery and verification module 4554 is further configured to determine the dispatch method corresponding to the code dispatch behavior based on the quantitative relationship between the number of logical conditions input by the user and the number of branches of the logical conditions; and to verify the user input based on the dispatch method and the type of the comparison content to determine the hidden function in the application.

[0139] In some embodiments, the dispatch method includes: one-to-two dispatch, many-to-two dispatch, and many-to-many dispatch; the behavior discovery and verification module 4554 is further configured to determine that the hidden function in the application is a secret access key when the dispatch method is one-to-two dispatch and the type of the comparison content is a hard-coded string; determine that the hidden function in the application is a master password when the dispatch method is many-to-two dispatch, the source of the value included in the comparison content is multiple, and at least one of the types of the value included in the comparison content is a hard-coded string; and determine that the hidden function in the application is a secret command when the dispatch method is many-to-many dispatch, the source of the value included in the comparison content is multiple, and at least one of the types of the value included in the comparison content is a specified string.

[0140] In some embodiments, the input verification detection module 4551 is further configured to perform interface identification processing on the comparison content in the application to obtain interface information included in the function used by the comparison content; and determine the source of the value included in the comparison content based on the interface information; wherein the source of the value included in the comparison content includes at least one of the following: file operation, database operation, sharing module, network request, broadcast.

[0141] In some embodiments, the input verification and detection module 4551 is further configured to: create a control flow graph of the application based on the application's source code; traverse the control flow graph to determine the functions used in the application's source code; determine the user input in the application's source code according to the correspondence between the functions and the user input; and determine the comparison content in the application's source code according to the correspondence between the functions and the comparison content.

[0142] In some embodiments, the behavior discovery and verification module 4554 is further configured to perform backward slicing of the application's source code to obtain logical conditions in the context of the user input; to perform verification processing on the user input for each logical condition to obtain a verification result; and to determine that the application has a hidden function when the verification result indicates that the user input does not match any of the logical conditions.

[0143] In some embodiments, the behavior discovery and verification module 4554 is further configured to acquire target information to be tracked in the application, determine the slicing rules corresponding to the target information, and perform backward slicing processing on the source code of the application according to the slicing rules to obtain the logical conditions in the context of user input corresponding to the target information.

[0144] This application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the application detection method described in this application embodiment.

[0145] This application provides a computer-readable storage medium storing executable instructions. When these executable instructions are executed by a processor, they cause the processor to execute the detection method for the application provided in this application. For example, ... Figure 3A , 3B The 3C application detection method is shown.

[0146] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EP ROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0147] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0148] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple co-located files (e.g., files that store one or more modules, subroutines, or code sections).

[0149] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0150] In summary, this application's embodiments improve the accuracy of user input validation by referencing the context of user input. By combining the determined type of comparison content with the code dispatch behavior of user input, hidden functions in the application are uncovered, thereby increasing the coverage of application detection. In this application's embodiments, interface identification processing is performed on the comparison content in the application to determine the source of the comparison content, enabling subsequent detection of hidden functions based on the source of the comparison content, thus improving detection accuracy. Furthermore, this application's embodiments discover hidden functions by checking and validating user input, solving the problem in related technologies that cannot discover hidden behaviors in applications, thereby mitigating the risks associated with hidden behaviors.

[0151] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A method for detecting an application, characterized in that, The method includes: Input validation is performed on the application's source code to obtain the user input and comparison content of the application; Perform contextual content recognition processing on the compared content to obtain the type of the compared content; The user input is subjected to contextual condition recognition processing to obtain the code dispatch behavior of the user input. The code dispatch behavior of the user input includes the number of logical conditions of the user input and the number of branches generated by the logical conditions. Based on the type of the compared content and the code dispatch behavior of the user input, the hidden functions in the application are determined.

2. The method according to claim 1, characterized in that, The types of content to be compared include hard-coded strings and confidential strings; The step of performing contextual content recognition processing on the compared content to obtain the type of the compared content includes: When the comparison content contains a subset of a specified string, the user input is equal to the value included in the comparison content, and each value included in the comparison content corresponds to a different execution result of the application, the type of the comparison content is determined to be a confidential string; When the user input is equal to the value included in the comparison content, the value included in the comparison content comes from the same source, and the execution results of the application are all the same, the type of the comparison content is determined to be a hard-coded string.

3. The method according to claim 1, characterized in that, The step of performing contextual condition recognition processing on the user input to obtain the code dispatch behavior of the user input includes: Determine the logical conditions in the context of the user input and the number of such logical conditions; The user input is validated for each of the logical conditions to determine the number of branches generated by the logical conditions.

4. The method according to claim 1, characterized in that, The process of determining hidden functions in the application based on the type of the compared content and the code dispatch behavior input by the user includes: Based on the relationship between the number of logical conditions input by the user and the number of branches of the logical conditions, determine the dispatch method corresponding to the code dispatch behavior; Based on the dispatch method and the type of the comparison content, the hidden functions in the application are determined.

5. The method according to claim 4, characterized in that, The assignment methods include: one-to-two assignment, many-to-two assignment, and many-to-many assignment; The step of determining hidden functions in the application based on the dispatch method and the type of the comparison content includes: When the dispatch method is one-to-two dispatch and the type of the comparison content is a hard-coded string, the hidden function in the application is determined to be a secret access key; When the dispatch method is multiple-to-two dispatch, the source of the value included in the comparison content is multiple, and at least one of the types of the value included in the comparison content is a hard-coded string, the hidden function in the application is determined to be the master password; When the dispatch method is many-to-many dispatch, the source of the value included in the comparison content is multiple, and at least one of the types of the value included in the comparison content is a confidential string, the hidden function in the application is determined to be a secret command.

6. The method according to claim 1, characterized in that, The method further includes: The comparison content in the application is processed by interface identification to obtain the interface information included in the function used by the comparison content; Based on the interface information, determine the source of the values ​​included in the comparison content; The sources of the values ​​included in the comparison include at least one of the following: file operations, database operations, shared modules, network requests, and broadcasts.

7. The method according to claim 1, characterized in that, The input validation and detection of the application's source code to obtain the user input and comparison content of the application includes: Create the application's control flow graph based on the application's source code; Traverse the control flow graph to determine the functions used in the application's source code; Based on the correspondence between the function and the user input, determine the user input in the source code of the application. Based on the correspondence between the function and the comparison content, the comparison content in the source code of the application is determined.

8. The method according to claim 1, characterized in that, The method further includes: The source code of the application is sliced ​​backward to obtain the logical conditions in the context of the user input. The user input is validated for each logical condition to obtain a validation result; When the verification result indicates that the user input does not match any of the logical conditions, it is determined that the application has a hidden function.

9. The method according to claim 8, characterized in that, The step of performing backward slicing on the application's source code to obtain the logical conditions in the context of the user input includes: Obtain the target information to be tracked in the application, and determine the slicing rules corresponding to the target information; According to the slicing rules, the source code of the application is sliced ​​backward to obtain the logical conditions in the context of the user input corresponding to the target information.

10. A detection device for an application, characterized in that, The device includes: The input validation and detection module is used to perform input validation and detection on the application's source code to obtain the user input and comparison content of the application. A contextual content recognition module is used to perform contextual content recognition processing on the comparison content to obtain the source of the comparison content; The context content recovery module is used to perform context condition recognition processing on the user input to obtain the code dispatch behavior of the user input. The code dispatch behavior of the user input includes the number of logical conditions of the user input and the number of branches generated by the logical conditions. The behavior discovery and verification module is used to determine hidden functions in the application based on the source of the compared content and the code assignment behavior input by the user.

11. An electronic device, characterized in that, The electronic device includes: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the method for detecting the application according to any one of claims 1 to 9.

12. A computer-readable storage medium storing executable instructions, characterized in that, When the executable instructions are executed by the processor, they implement the application detection method according to any one of claims 1 to 9.

13. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the application detection method according to any one of claims 1 to 9.

Images