Android static taint analysis apparatus and analysis method based on taint finding association

Abstract

The application discloses an Android static taint analysis device and method based on taint search association, the device is provided with a decompilation module, a word segmentation module and a semantic analysis module connected in sequence, the method adopts one or more parallel taint propagation edges pointing to taints in different callback methods, wherein, the taint search association only searches and analyzes taint-related codes, effectively searches and associates taint-related statements according to rules, to construct an accurate and complete taint propagation path graph, and simultaneously adopts taint alias acquisition, solves the alias analysis problem in taint analysis, and realizes Android static taint analysis containing accurate alias analysis. The method can improve the accuracy and analysis efficiency of taint analysis, and especially solves the problem of taint analysis accuracy decline caused by the characteristics of Android applications.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of mobile internet security technology, and particularly relates to an Android static taint analysis device and method based on taint finding and association. BACKGROUND

[0002] In recent years, mobile internet technology has developed rapidly, and the security problems that have followed have become increasingly prominent. Due to its special use scenario, and the function characteristics of large storage and communication privacy, when facing malicious attackers and third-party information users represented by personalized advertising service providers, how to effectively protect personal privacy information without user authorization has become a research hotspot in mobile internet security.

[0003] Taint analysis is a form of information flow analysis, and is widely used in software defect detection, including Android application privacy leakage detection. In order to improve the detection accuracy and analysis efficiency of taint analysis, many studies have tried various methods, but most current static taint analysis methods first construct a directed graph such as a control flow graph, a call graph, and a data flow graph according to program code, and then perform a graph reachability analysis-like method on the directed graph to obtain a taint propagation path and to alarm the discovered taint leakage. However, actual program code may contain a large number of control and data dependency relationships that are irrelevant to the taint propagation process. Such relationships often result in a large number of edges and nodes in the analyzed graph that are irrelevant to the taint propagation path. The existence of these redundant edges and nodes neither helps to improve the accuracy of taint analysis nor reduces the false positive rate, and also increases the time and memory overhead of the analysis process.

[0004] In the static taint analysis technology for Android applications, the consideration of Android characteristics is an important factor affecting the analysis accuracy. Android applications are composed of system calls and event-driven, and have characteristics such as multiple entry points and non-linearity. When performing taint analysis on Android applications, if the above-mentioned Android application characteristics are not adequately considered, the accuracy of taint analysis will decrease, and inevitable false positives or false negatives will be generated. Since simulating all possible callback method execution sequences will result in excessive analysis overhead, existing technologies generally solve the above-mentioned problems by assuming the execution sequence of callback methods in components, but the existing solutions still have deficiencies in handling such problems, which reduces the overall accuracy of taint analysis. SUMMARY

[0005] The application aims at the deficiency of the prior art, and provides an Android static taint analysis device and method based on taint search association. The method can improve the accuracy and analysis efficiency of taint analysis, and especially solves the problem of taint analysis accuracy reduction caused by the characteristics of an Android application.

[0006] The technical solution for achieving the application is as follows:

[0007] An Android static taint analysis device based on taint search association, the static taint analysis device is sequentially connected with:

[0008] A decompilation module: the input of the decompilation module is an Android application package APK, and the decompilation module is used for decompiling the Android application package APK, in particular, decompiling a classes.dex bytecode file in the application package APK into a Java source code form for analysis;

[0009] A word segmentation module: the word segmentation module is used for preprocessing source code, that is, the word segmentation module performs word segmentation on code statements according to code semantics, so as to further determine and analyze the code;

[0010] A semantic analysis module: the semantic analysis module adopts an Android static taint analysis method based on taint search association and a taint propagation rule to determine the semantics of program code processed by the word segmentation module, converts taint-related statements in the actual program into taint propagation edges, and associates the taint propagation edges according to the Android static taint analysis method based on taint search association and the taint propagation rule, to finally form a taint propagation path graph and output the taint propagation path graph, wherein the taint propagation rule defines the following four types of statements:

[0011] A first direct assignment statement: a direct assignment statement in the form of “left value = right value”, which represents a direct assignment from the “right value” to the “left value”;

[0012] A second method call statement: a method call statement in the form of “method name (parameter)”, which represents a method with the actual parameter “parameter” and the name “method name”;

[0013] A third return assignment statement: a return assignment statement in the form of “left value = method name (parameter<, …)”, which represents a method with the actual parameter “parameter” and the name “method name” returning a value to the “left value”;

[0014] A fourth return call statement: a return call statement in the form of “external method name (internal method name (parameter i )”, which represents a return value of a method with the actual parameter “parameter” and the name “internal method name” being called as the i-th actual parameter by a method with the name “external method name”.

[0015] The pollution propagation rules include:

[0016] The direct assignment propagation rule: in a direct assignment statement, if the variable or value on the right side of the equal sign is "pollution", the variable on the left side of the equal sign is "new pollution";

[0017] The method call propagation rule: in a method call statement, if the i-th actual parameter in the called method is "pollution", the i-th formal parameter in the definition of the called method is "new pollution";

[0018] The return assignment propagation rule: in a return assignment statement, if the return value of the called method is "pollution", the variable on the left side of the equal sign is "new pollution";

[0019] The return call propagation rule: in a return call statement, if the return value of the internally called method is "pollution" and the return value is in the i-th actual parameter position of the externally called method, the i-th actual parameter of the externally called method is "new pollution";

[0020] The pollution generation determination rule: taking the pollution source method call as "pollution", according to the return assignment propagation rule and the return call propagation rule, if "new pollution" can be generated, it is considered that there is pollution generation, otherwise it is considered that there is no pollution generation;

[0021] The pollution elimination determination rule: in a direct assignment statement, if the right value is a constant or null, and the left value is a pollution variable, the pollution is eliminated;

[0022] The pollution leakage determination rule: in a method call statement, if the called method is a pollution sink method, and the actual parameter of the called pollution sink method contains pollution, it is considered that pollution leakage occurs;

[0023] The alias analysis start rule: in a direct assignment statement, if the left value is an object type, the alias analysis is started with the left value name as the target;

[0024] The pollution alias deletion rule: in a direct assignment statement, if the left value is a pollution alias and the right value is an object type other than this type of alias, the left value name is removed from the corresponding position in the alias list as the target,

[0025] The semantic analysis module is also implanted with a pollution source / pollution sink list, which is used for identification of pollution sources and pollution sinks, is made by existing technologies, and is provided by an automated classification method based on machine learning. An accurate pollution source / pollution sink list can improve the accuracy of pollution analysis.

[0026] The application discloses an Android static taint analysis method based on taint searching and association, and relates to the technical field of computer software security.

[0027] 1) importing a taint source method list and a taint sink method list obtained by an automatic classification method based on machine learning in advance;

[0028] 2) searching for a calling position of a method in a source method set in complete code to be analyzed, and storing a searching result as a taint starting point list, wherein the taint starting point list comprises a complete code line found and relevant position information of the complete code line, if the taint starting point list is empty, i.e., no source method calling is found in the code to be analyzed, taint analysis is terminated; if the taint starting point list is not empty, step 3) is performed;

[0029] 3) judging whether a taint generating code segment in the taint starting point list obtained in step 2) is subjected to a taint propagation behavior after taint generation, the taint propagation behavior is direct assignment or being passed into any called method as a parameter, if not, the next searching result in the taint starting point list is continuously judged; if yes, step 4) is performed, after the judgment of all searching results in the taint starting point list is completed, step 9) is performed;

[0030] 4) taking the taint generating code subjected to the taint propagation behavior obtained in step 3) as a starting point, constructing a taint propagation edge, and taking the taint propagation edge generated from the statement as a first edge to construct a new taint propagation path graph, wherein a taint propagation edge structure is [serial number, position, taint, new taint, type], wherein,

[0031] The serial number represents a relative position of an operation statement in a program, adopts a code line number and is represented in the form of an increasing number;

[0032] The position represents a class name, a method name and a selection structure of a current analyzed statement where an operation statement is located, and is represented in the form of "class name.method name(<parameter><, parameter>...)<. selection structure>", wherein a sharp bracket represents optional content in the sharp bracket;

[0033] The taint represents a current taint position of a propagation edge starting point, i.e., a taint position needing to be analyzed to obtain a taint backward propagation path, and is represented in the form of "class name.<method name>. variable name / method name(<parameter><, parameter>...)", wherein a sharp bracket represents optional content in the sharp bracket;

[0034] The new taint represents a next taint position of a propagation edge terminal point, i.e., a taint position obtained by analysis, and is represented in the form of the "taint" field;

[0035] The type indicates the type of the propagation edge, including four types: "assignment", "call", "return", and "termination". It is used in the algorithm to determine the next operation based on the statement.

[0036] 5) Using a depth-first search method, find program statements related to the "new taint" field and the taint alias of the taint pointed to by the "new taint" field of the previous taint propagation edge. Construct the next taint propagation edge based on the search results. If the search results statement is not in the currently analyzed class, the generated taint propagation edge is stored in the taint propagation path reserve list; otherwise, the constructed taint propagation edge is directly added to the taint propagation path graph. If the analyzed taint enters other callback methods of the current component, assuming the taint propagates to any callback method regardless of order, construct one or more taint propagation edges. A parallel taint propagation edge pointing to taints in different callback methods is formed. If the search result is empty, the current taint propagation path graph is completed and added to the taint propagation path graph set, and the process returns to step 3). The taint propagation path backup list is a set of taint propagation path segments containing one or more taint propagation edges. The paths are classified according to the different class methods in which they are located. The taint propagation path backup list is used during the class method call verification process. The path segments that pass the verification will be added to the taint propagation path graph.

[0037] 6) Determine whether each statement in step 5) contains a call to a class method in the tainted object. If so, perform class method call verification. The class method call verification process is as follows: during the taint propagation path construction process, continuously monitor whether the class method corresponding to the backup taint propagation path in the backup taint propagation path backup list is called. Once the class method is called, immediately convert the backup path into a valid taint propagation path and add it to the taint propagation path graph that is currently being constructed.

[0038] 7) Check each statement in step 5) to see if a taint has spread to an object or a domain of an object. If so, continue to acquire aliases until all aliases of the currently analyzed tainted variable are acquired. The process of acquiring taint aliases is as follows: when a taint is found to be spreading to an object, take the tainted object as the target and search upwards in the current method to see if there is an alias for the tainted object. If there is, acquire aliases for the new alias until all aliases of the currently analyzed tainted object are acquired and the acquired taint aliases are returned in the form of a set for use in the taint search process in step 5).

[0039] 8) Check each query in step 5) to see if it causes the alias to become invalid. If so, remove the invalid alias from the list of aliases corresponding to the taints that have invalid aliases, and return to step 5).

[0040] 9) The set of the path graph of the pollution propagation is constructed, and the set of the path graph of the pollution propagation is returned.

[0041] The technical solution adopts constructing one or more parallel pollution propagation edges pointing to the pollution in different callback methods, so that the pollution analysis method can better handle the multi-entry and nonlinear characteristics of the Android application, and the accuracy of the pollution analysis is improved. In the technical solution, the pollution finding and association only analyzes the pollution related code, reduces the negative impact of the pollution unrelated code on the performance of the pollution analysis system, avoids the excessive time and space consumption caused by complete modeling of the analyzed program, and improves the pollution analysis efficiency.

[0042] The technical solution formulates the pollution propagation rules, can effectively find and associate the pollution related statements according to the rules, and constructs an accurate and complete path graph of the pollution propagation.

[0043] The technical solution adopts the pollution alias acquisition, solves the alias analysis problem in the pollution analysis, and realizes the Android static pollution analysis containing accurate alias analysis.

[0044] The method can improve the accuracy and efficiency of the pollution analysis, and especially solves the problem of the decrease of the accuracy of the pollution analysis caused by the characteristics of the Android application. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 The figure is a process diagram of the pollution propagation edge construction in the embodiment.

[0046] Figure 2 The figure is a process diagram of the pollution finding and association in the embodiment.

[0047] Figure 3 The figure is a path diagram of the pollution propagation in the embodiment.

[0048] Figure 4 The figure is a process diagram of the class method call verification in the embodiment.

[0049] Figure 5 The figure is a process diagram of the pollution alias acquisition in the embodiment.

[0050] Figure 6 The figure is a flowchart of the method in the embodiment. DETAILED DESCRIPTION

[0051] The content of the application will be further described in combination with the drawings and the embodiments, but is not limited to the application.

[0052] Embodiment:

[0053] Reference Figure 6An Android static taint analysis device based on taint finding and association, the static taint analysis device is provided with sequentially connected:

[0054] The input of the decompilation module is an Android application package APK, and the decompilation module is used for decompiling the Android application package APK, in particular, decompiling the classes.dex bytecode file in the application package APK into a Java source code form available for analysis;

[0055] The word segmentation module is used for preprocessing the source code, that is, the word segmentation module performs word segmentation on the code statements according to the code semantics, so as to facilitate further semantic judgment and analysis of the code;

[0056] The semantic analysis module adopts an Android static taint analysis method based on taint finding and association and a taint propagation rule to perform semantic judgment on the program code processed by the word segmentation module, converts the taint-related statements in the actual program into taint propagation edges, and associates the taint propagation edges according to the Android static taint analysis method based on taint finding and association and the taint propagation rule, finally forms a taint propagation path graph and outputs the taint propagation path graph, wherein the taint propagation rule defines the following four types of statements:

[0057] The first type of direct assignment statement is a direct assignment statement in the form of "left value = right value", which represents a direct assignment from the "right value" to the "left value";

[0058] The second type of method call statement is a method call statement in the form of "method name (parameter)", which represents a method with the actual parameter "parameter" and the name "method name";

[0059] The third type of return assignment statement is a return assignment statement in the form of "left value = method name (parameter<, …)", which represents a method with the actual parameter "parameter" and the name "method name" returning a value to the "left value";

[0060] The fourth type of return call statement is a return call statement in the form of "external method name (internal method name (parameter i )", which represents a return value of a method with the actual parameter "parameter" and the name "internal method name" being called as the i-th actual parameter by a method with the name "external method name";

[0061] The taint propagation rule includes:

[0062] Direct assignment propagation rule: in a direct assignment statement, if the variable or value on the right side of the equal sign is "taint", then the variable on the left side of the equal sign is "new taint";

[0063] Method call propagation rule: in the method call statement, if the i-th actual parameter of the called method is "taint", the i-th formal parameter of the called method definition is "new taint";

[0064] Return assignment propagation rule: in the return assignment statement, if the return value of the called method is "taint", the variable on the left side of the equal sign is "new taint";

[0065] Return call propagation rule: in the return call statement, if the return value of the internally called method is "taint" and the return value is in the i-th actual parameter position of the externally called method, the i-th actual parameter of the externally called method is "new taint";

[0066] Taint generation determination rule: the taint source method call is "taint", according to the return assignment propagation rule and the return call propagation rule, if "new taint" can be generated, it is considered that there is taint generation, otherwise it is considered that there is no taint generation;

[0067] Taint elimination determination rule: in the direct assignment statement, if the right value is a constant or null, and the left value is a taint variable, the taint is eliminated;

[0068] Taint leakage determination rule: in the method call statement, if the called method is a taint sink method, and the actual parameter of the called taint sink method contains taint, it is considered that taint leakage occurs;

[0069] Alias analysis start rule: in the direct assignment statement, if the left value is an object type, the left value name is taken as the target to start alias analysis;

[0070] Taint alias deletion rule: in the direct assignment statement, if the left value is a taint alias and the right value is an object type other than this type of alias, the left value name is taken as the target to remove it from the corresponding position in the alias list,

[0071] The semantic analysis module is also implanted with a taint source / taint sink list, which is used for identification of taint sources and taint sinks. In this example, the taint source / taint sink list is established according to the automatic classification method based on machine learning. An accurate taint source / taint sink list can improve the accuracy of taint analysis,

[0072] An Android static taint analysis method based on taint finding and association, comprising the above-mentioned Android static taint analysis device based on taint finding and association, the method comprising the following steps:

[0073] 1) Import the taint source method list and the taint sink method list obtained by the automatic classification method based on machine learning in advance;

[0074] 2) find the call position of the method in the source method set in the complete code to be analyzed, and store the search result as a list of pollution starting points, which contains the complete code line found and the relevant position information of the complete code line. If the list of pollution starting points is empty, i.e. no source method call is found in the code to be analyzed, the pollution analysis terminates. If the list of pollution starting points is not empty, step 3) is executed;

[0075] 3) judge whether the code fragment that generates pollution in the list of pollution starting points obtained in step 2) has a propagation behavior after the pollution is generated, i.e. direct assignment or as a parameter into any called method. If not, the next search result in the list of pollution starting points is judged. If yes, step 4) is executed. After the judgment of all search results in the list of pollution starting points is completed, step 9) is executed;

[0076] 4) take the pollution generation code with propagation behavior obtained in step 3) as the starting point to construct a pollution propagation edge, and generate a new pollution propagation path graph with the pollution propagation edge as the first edge. The structure of the pollution propagation edge is: [serial number, position, pollution, new pollution, type], wherein,

[0077] The serial number represents the relative position of the operation statement in the program, which is represented by the code line number in the form of an increasing number.

[0078] The position represents the class name, method name and selection structure of the current analyzed statement where the operation statement is located, and the representation form is "class name.method name(<parameter><, parameter…>)<. selection structure>", and the content in the angle brackets is optional.

[0079] The pollution represents the current pollution position that needs to be analyzed to obtain the pollution backward propagation path, and the representation form is "class name<. method name>. variable name / method name(<parameter><, parameter>…)", and the content in the angle brackets is optional.

[0080] The new pollution represents the next pollution position obtained by analysis, and the representation form is the same as the "pollution" field.

[0081] The type represents the type of the propagation edge, including "assignment", "call", "return" and "terminate", which is used as the basis for the next operation decision for the statement in the algorithm.

[0082] 5) According to the depth-first method, find the program statements related to the "new pollution" field of the last pollution propagation edge and the pollution alias of the pollution indicated by the "new pollution" field, and build the next pollution propagation edge according to the search result statement. If the search result statement is not in the current analyzed class, the generated pollution propagation edge is stored in the pollution propagation path standby list. Otherwise, the constructed pollution propagation edge is directly added to the pollution propagation path graph. If the analyzed pollution enters other callback methods of the current component, it is assumed that the pollution propagates to any callback method in any order. One or more parallel pollution propagation edges are constructed, which point to the pollution in different callback methods. If the search result is empty, the current pollution propagation path graph is constructed, and the constructed pollution propagation path graph is added to the pollution propagation path graph set. Return to step 3). The pollution propagation path standby list is a set composed of one or more pollution propagation path segments containing one or more pollution propagation edges. The paths are classified according to the different class methods where the paths are located. The pollution propagation path standby list is used in the class method call verification process. The verified path segment is added to the pollution propagation path graph;

[0083] 6) Determine whether the search result statement in step 5) contains a call to the class method in the pollution object. If so, perform class method call verification. The class method call verification process is as follows: During the pollution propagation path construction process, continuously monitor whether the class method corresponding to the standby pollution propagation path in the pollution propagation path standby list is called. Once the class method call behavior is found, the standby path is immediately converted to a valid pollution propagation path and added to the pollution propagation path graph being constructed.

[0084] 7) Determine whether there is pollution propagation to an object or a certain domain of an object in the search result statement in step 5). If so, perform continuous alias acquisition until all aliases of the current analyzed pollution variable are obtained. The pollution alias acquisition process is as follows: When pollution propagation to an object is found, the polluted object is targeted, and the current method is searched upwards to determine whether the polluted object has an alias. If so, the new alias is searched again. Until all aliases of the current analyzed pollution object are obtained, and the obtained pollution aliases are returned in the form of a set for use in the search process in step 5).

[0085] 8) Determine whether the search result statement in step 5) causes alias invalidation. If so, remove the invalid alias from the alias list corresponding to the pollution with the invalid alias. Return to step 5).

[0086] 9) The pollution propagation path graph set is constructed, and the pollution propagation path graph set is returned,

[0087] Specifically, as Figure 6The left side of the dashed box is the input of the device: Android application package (APK),

[0088] The right side of the dashed box is the output of the device: the taint propagation path graph.

[0089] The components of the device include a decompilation module, a word segmentation module, and a semantic analysis module.

[0090] In this example, the taint finding and correlation process is as shown in FIG. 4. Figure 2 The taint propagation path graph generated by the taint finding and correlation process is as shown in FIG. 5. Figure 3 The process is as follows:

[0091] 1) The source of the taint source() is found to assign a value to tiantValue1, and a propagation edge from source() to tiantValue1 is constructed;

[0092] 2) The tiantValue1 is found to be called by the copy method as a parameter, and a propagation edge from tiantValue1 to copy(tiantValue1) is constructed;

[0093] 3) The tiantValue1 is found to be called by the sink method as a parameter, and a propagation edge from tiantValue1 to sink(tiantValue1) is constructed, and the taint is leaked;

[0094] 4) The tiantValue1 is found to be assigned a constant value, and a propagation edge from "clear_if" to tiantValue1 is constructed, and the taint is cleared;

[0095] 5) The tiantValue1 is found to be assigned a constant value, and a propagation edge from "clear_else" to tiantValue1 is constructed, and the taint is cleared;

[0096] 6) The tiantValue1 is converted from an actual parameter to a formal parameter in the copy method, and a propagation edge from tiantValue1 to the local variable s is constructed;

[0097] 7) The s is found to be returned by the copy method, and a propagation edge from s to "return s" is constructed;

[0098] 8) The "return s" returns the value of s to the place where the copy method is called, and a propagation edge from "return s" to copy(tiantValue1) is constructed;

[0099] 9) find that copy(taintValue1) assigns to taintValue2, build a propagation edge from copy(taintValue1) to taintValue2;

[0100] 10) find that taintValue2 is a parameter of sink method call, build a propagation edge from taintValue2 to sink(taintValue1), the taint is leaked.

[0101] In this example, the class method call verification process is as shown in Figure 4 , and the process is as follows:

[0102] 1) find that the taint source source() assigns to A.taintValue1, build a propagation edge from source() to A.taintValue1;

[0103] 2) find that A.taintValue1 enters class B as a constructor method parameter, build a propagation edge from A.taintValue1 to B(taintValue1, taintValue2);

[0104] 3) A.taintValue1 is converted from an actual parameter to a formal parameter in the B method, build a propagation edge from A.taintValue1 to the local variable taintValue1;

[0105] 4) find that taintValue1 assigns to B.taintValue1, build a propagation edge from taintValue1 to B.taintValue1;

[0106] 5) find that B.taintValue1 assigns to t in leakTaintValue1, build a propagation edge from B.taintValue1 to t, but this edge is a backup propagation edge;

[0107] 6) find that t is a parameter of sink method call, build a propagation edge from t to sink(t), but this edge is a backup propagation edge, and the taint is not leaked temporarily;

[0108] 7) find that the class method leakTaintValue1 in the taint object b is called, add the backup propagation edge built in steps 5) and 6) to the taint propagation path graph, and the taint is leaked.

[0109] In this example, the taint alias acquisition process is as shown in Figure 5 , and the process is as follows:

[0110] 1) A tainted variable s is found to propagate to an object field taintB.taintString, starting aliasing of taintB;

[0111] 2) An alias of taintB, taintBAlias, is found, starting aliasing of taintBAlias;

[0112] 3) No further aliases of taintBAlias are found, aliasing of taintBAlias terminates;

[0113] 4) The tainted object taintBAlias is found to propagate to an object field tiantA.t, starting aliasing of tiantA;

[0114] 5) An alias of taintA, taintAAlias, is found, starting aliasing of taintAAlias;

[0115] 6) No further aliases of taintAAlias are found, aliasing of taintAAlias terminates;

[0116] 7) Because taintAAlias.t.taintString is in the tainted alias set, taintAAlias.t.taintString will also be treated as tainted during the construction of the taint propagation edges.

Claims

1. An Android static taint analysis device based on taint lookup and association, characterized in that, The static stain analysis device is provided with sequentially connected: Decompilation module: The input to the decompilation module is the Android application package APK. The decompilation module is used to decompile the Android application package APK, specifically to decompile the classes.dex bytecode file in the application package APK into Java source code that can be analyzed. Word segmentation module: The word segmentation module is used to preprocess the source code, that is, the word segmentation module segments the code statements according to the semantics of the code; Semantic Analysis Module: The semantic analysis module uses taint propagation rules to perform semantic determination on the program code processed by the word segmentation module. It transforms taint-related statements in the actual program into taint propagation edges, and associates these edges according to the taint propagation rules to form a taint propagation path graph, which is then output. The taint propagation rules define the following four statement types: The first type of direct assignment statement: the direct assignment statement in the form of "lvalue = rvalue", which represents a direct assignment from "rvalue" to "lvalue"; The second type of method call statement is the "method name (parameters)" form, which indicates that the method containing the actual parameter "parameters" and named "method name" is being called. The third type of return assignment statement is in the form of "lvalue = method name (parameter <, ...>)", which means that a method named "method name" that contains the actual parameter "parameter" returns a value to the "lvalue". The fourth type of return statement is: "outer method name (inner method name (parameters)" i A return call statement in the form of ")" indicates that the return value of the method named "inner method name" containing the actual parameter "parameter" is called by the method named "outer method name" as the i-th actual parameter; The rules for the propagation of taint include: Direct assignment propagation rule: In a direct assignment statement, if the variable or value on the right side of the equals sign is "tainted", then the variable on the left side of the equals sign becomes the "new tainted". Method call propagation rule: In a method call statement, if the i-th actual parameter in the called method is a "taint", then the i-th formal parameter in the definition of the called method is a "new taint". Return assignment propagation rule: In a return assignment statement, if the return value of the called method is a "taint", then the variable on the left side of the equals sign becomes a "new taint". Return call propagation rule: In a return call statement, if the return value of the inner called method is "tainted" and the return value is located at the i-th actual parameter position of the outer called method, then the i-th actual parameter of the outer called method is "new tainted"; Taint generation determination rules: Taking the source method call of the taint as the "taint", according to the return assignment propagation rules and the return call propagation rules, if a "new taint" can be generated, it is considered that a taint has been generated; otherwise, it is considered that no taint has been generated. Taint removal criteria: In a direct assignment statement, if the right-hand side is a constant or null value and the left-hand side is a tainted variable, then the taint is removed. Taint Leakage Detection Rule: In a method call statement, if the called method is a taint convergence point method, and the actual parameters of the called taint convergence point method contain taints, then a taint leakage is considered to have occurred. Alias ​​analysis start rule: In a direct assignment statement, if the left-hand side is an object type, alias analysis is started with the left-hand side name as the target; Tainted alias removal rules: In a direct assignment statement, if the left-hand side is a tainted alias and the right-hand side is an object type other than the class name, then the tainted alias will be removed from the corresponding position in the alias list based on the left-hand side name. The semantic analysis module includes a list of taint sources / taint convergence points, which is used to identify taint sources and taint convergence points. It is created using existing technology and provided by an automated classification method based on machine learning.

2. An Android static taint analysis method based on taint lookup association, comprising the Android static taint analysis device based on taint lookup association as described in claim 1, characterized in that, The method includes the following steps: 1) Import the list of taint source methods and the list of taint aggregation methods obtained in advance by machine learning-based automated classification methods; 2) Locate the method call positions in the source method set within the complete code to be analyzed, and store the search results as a taint start point list. The list contains the complete code lines found and their related location information. If the taint start point list is empty, meaning no source method calls were found in the analyzed code, then the taint analysis terminates; if the taint start point list is not empty, then proceed to step 3). 3) Determine one by one whether the code snippets that generated taints in the taint starting point list obtained in step 2) have performed propagation behavior after the taints were generated. Propagation behavior means directly assigning values ​​or passing them as parameters to any called method. If not, continue to judge the next search result in the taint starting point list. If yes, execute step 4). After judging all search results in the taint starting point list, execute step 9. 4) Starting with the taint generation code obtained in step 3) that has undergone propagation, construct taint propagation edges, and use the taint propagation edge generated by this statement as the first edge to construct a new taint propagation path graph. The structure of the taint propagation edge is: [Sequence Number, Position, Ttain, New Ttain, Type]. The sequence number indicates the relative position of the operation statement in the program, using line numbers and represented in incrementing numerical form; The position indicates the class name, method name, and selection structure where the operation statement is located, and is represented in the form of "class name.method name(<parameters><,parameters...>)<.selection structure>", where angle brackets indicate that the content within the angle brackets is optional. A taint represents the starting point of the propagation edge, which is the current taint position that needs to be analyzed to obtain the taint's propagation path backward. The form is "ClassName<.MethodName>.VariableName / MethodName(<parameters><,parameters>…)", and the angle brackets indicate that the content within the angle brackets is optional. The new taint indicates the endpoint of the propagation edge, which is the location of the next taint obtained from the analysis. The representation format is the same as the "taint" field. The type indicates the type of the propagation edge, including four types: "assignment", "call", "return", and "terminate". It is used as the basis for the algorithm to determine the next operation for this statement. 5) Using a depth-first search method, find program statements related to the "new taint" field and the taint alias of the taint pointed to by the "new taint" field of the previous taint propagation edge, and construct the next taint propagation edge based on the search results. If the search results statement is not in the currently analyzed class, the generated taint propagation edge is stored in the taint propagation path reserve list; otherwise, the constructed taint propagation edge is directly added to the taint propagation path graph. If the analyzed taint enters other callback methods of the current component, assuming that the taint propagates to any callback method regardless of the order, construct one or more taint propagation edges. A parallel taint propagation edge pointing to taints in different callback methods. If the search result is empty, the current taint propagation path graph is completed and the completed taint propagation path graph is added to the taint propagation path graph set, and the process returns to step 3). The taint propagation path backup list is a set of taint propagation path segments containing one or more taint propagation edges. The paths are classified according to the different class methods in which the paths are located. The taint propagation path backup list is used in the class method call verification process. The path segments that pass the verification will be added to the taint propagation path graph. 6) Determine whether each search result statement in step 5) contains a call to a class method in the tainted object. If so, perform class method call verification. The class method call verification process is as follows: during the taint propagation path construction process, continuously monitor whether the class method corresponding to the backup taint propagation path in the backup taint propagation path list is called. Once the class method is called, immediately convert the backup path into a valid taint propagation path and add it to the taint propagation path graph that is currently being constructed. 7) Check each statement in step 5) to see if any taints have spread to objects or to a domain of an object. If so, continue to acquire aliases until all aliases of the currently analyzed tainted variable are acquired. The process of acquiring taint aliases is as follows: when it is found that a taint has spread to an object, take the tainted object as the target and search upwards in the current method to see if there are any aliases for the tainted object. If there are, acquire aliases for the new aliases until all aliases of the currently analyzed tainted object are acquired and the acquired taint aliases are returned in the form of a set for use in the taint search process in step 5). 8) Check each query result statement in step 5) to see if it causes the alias to become invalid. If so, remove the invalid alias from the list of aliases corresponding to the taint that has the invalid alias and return to step 5). 9) The taint propagation path graph set has been constructed. Return the taint propagation path graph set.

Images