Android software dynamic escape behavior identification method based on data flow and control flow

Abstract

The application discloses a kind of Android software dynamic escape behavior identification method based on data stream and control flow, solve the existing Android dynamic escape software detection method, cannot high accuracy capture Android dynamic escape software, the problem of low efficiency.The application carries out decompilation to test Android APK file, generates function call chain for environment detection API, while removing the uppermost call chain that is not the entrance of Android APK;Then generate environment detection API control flow subgraph for the remaining call chain, and divide the control flow graph into several behavior control flow subgraphs at branch through data stream analysis, finally analyze the behavior of each behavior control flow subgraph, to determine whether Android APK has dynamic escape technology.The application is used to detect Android dynamic escape software and describe its behavior.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method for identifying Android escape software through software analysis. Specifically, it is a method for identifying dynamic escape behavior in Android software based on data flow and control flow. This method generates multiple control flow subgraphs by statically analyzing the control flow and data flow of APIs related to environment detection in the Android APK. The method then determines whether the Android APK exhibits dynamic escape behavior by analyzing the behavioral differences between these control flow subgraphs. Background Technology

[0002] The Android operating system has achieved widespread adoption globally, currently used by 2.5 billion mobile devices, and by the second quarter of 2021, Android's global market share had reached 83.8%. With Android's rapid global market expansion, it has also become a primary target for malicious actors to implant malware. The CIC estimates that nearly 12,000 new Android malware instances are detected daily. Existing dynamic malware analysis methods are primarily based on sandboxes, which detect malicious behavior or calls to sensitive API functions during the dynamic execution of Android APKs. However, sandbox escape techniques can detect whether the malware is in a sandbox environment or set triggers to execute malicious behavior only under specific conditions, making these methods difficult to detect. Malware developers are highly focused on dynamic malware escape techniques, aiming to escape sandbox detection and remain on user terminals for extended periods, generating profits through continuous malicious activity. This poses a significant threat to system security and personal privacy; therefore, research into Android dynamic escape software is essential.

[0003] Existing methods for detecting and defending against dynamic escape software mainly focus on two aspects: first, building more complete sandboxes with more realistic observable features; and second, using dynamic triggering methods with higher code coverage. Building more complete sandboxes with more realistic observable features aims to prevent malware from accurately determining whether it is in a sandbox environment or a real device based on environmental characteristics, thus triggering malicious behavior and being dynamically captured by the sandbox. Using triggering methods with higher code coverage aims to cover all executable paths in dynamic analysis as much as possible by modifying the triggering method, thereby maximizing the likelihood of triggering malicious behavior and detecting Android dynamic escape software. Therefore, these methods have the following problems:

[0004] 1. Existing sandbox devices have difficulty achieving complete consistency with real devices, and attackers can always find ways to detect their own environment.

[0005] 2. Sandboxes have difficulty simulating wear and tear characteristics that increase with human use, such as changes in contacts, photos, and music playback on a mobile phone, as well as changes in battery level and sensor values.

[0006] 3. Due to the path explosion problem, existing triggering methods are difficult to trigger some highly triggered malicious behaviors, and none of them can guarantee complete coverage of malicious behaviors.

[0007] 4. The pursuit of higher coverage in dynamic analysis inevitably leads to a decrease in efficiency and cannot guarantee accurate detection of Android dynamic escape software. Summary of the Invention

[0008] The purpose of this invention is to provide a method for identifying dynamic escape behavior of Android software based on data flow and control flow, which solves the problem that existing technologies that build complete sandboxes and use triggering methods with higher coverage cannot capture dynamic escape behavior of Android software with high accuracy and are inefficient.

[0009] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0010] A method for recognizing dynamic escape behavior in Android software based on data flow and control flow includes the following steps:

[0011] Step 1: Decompile the test Android APK file, extract the APIs called in the test Android APK, match them with the list of APIs that can be monitored in the environment, generate function call chains for the successfully matched APIs, and determine whether the top layer of the function call chain is the entry point of the Android APK.

[0012] Among them, Android APK represents the Android installation package, API represents the application programming interface, and the list of APIs that can be used for environment detection includes a series of APIs that can be used by applications to determine whether their environment is a real device or an emulator environment;

[0013] Step 2: Find all complete control flow paths starting from the Android APK entry point and passing through the Environment Detection API, and form the Environment Detection API control flow subgraph.

[0014] Step 3: Analyze the data flow propagation between functions of the above environmental detection API control flow subgraph, find the nearest branch statement on the data flow propagation path, and split it into several smaller control flow subgraphs starting from the branch;

[0015] Step 4: Compare the behavioral differences of the functions used in each control flow subgraph, determine whether they have dynamic escape characteristics, and indicate their specific escape behavior.

[0016] Furthermore, step 1 specifically involves the following steps:

[0017] Step 1.1: First, based on the methods mentioned in previous work for detecting the environment, find the corresponding APIs in the Android official documentation to obtain a list of APIs that can be used for detecting the environment;

[0018] Step 1.2: Decompile the test APK using the Androguard tool to obtain all methods in the APK, match them with the list of APIs that can be used for testing the environment selected in Step 1.1 to obtain the characteristic APIs used by the test APK, and then trace the call chain of these characteristic APIs.

[0019] Step 1.3: Determine if the top level of the function call chain belongs to the entry point function in the Android APK. If not, determine if the top level of the function call chain can be enabled by an explicit or implicit intent call from the entry point function. Entry points include the main entry point function defined in Manifest.xml within the APK folder and methods implicitly started in the Android framework layer, such as the onclick function.

[0020] Furthermore, step 2 specifically involves the following steps:

[0021] Step 2.1: Generate the control flow graph within each function in the call chain that meets the conditions;

[0022] Step 2.2: Starting from the Android APK entry point, analyze the control flow graph within each function to generate several inter-function control flow paths that pass through the environment detection API.

[0023] Step 2.3: For each environment detection API, aggregate all complete control flow paths between functions passing through it to form several environment detection API control flow subgraphs.

[0024] Furthermore, step 3 specifically involves the following steps:

[0025] Step 3.1: For each environment detection API, analyze the information flow of the API called by the APK under test, propagate its data flow forward, and generate an explicit information flow propagation path within the function. If the endpoint of its explicit information flow propagation path is located in the judgment condition of the branch statement, then locate this position; otherwise, remove the control flow subgraph of this environment detection API.

[0026] Step 3.2: Divide the remaining environment detection API control flow subgraph into several smaller behavior control flow subgraphs according to the branch statements located above.

[0027] Furthermore, step 4 specifically involves the following steps:

[0028] For the control flow subgraphs obtained above, we analyze the functions they call to infer their behavior, determine whether they conform to dynamic escape behavior, and finally compare the behavioral differences between each control flow subgraph. If at least one behavior subgraph does not contain dynamic escape behavior, while at least one behavior subgraph is determined to contain dynamic escape behavior, we can determine that it is an Android dynamic escape software.

[0029] Compared with the prior art, the advantages of the present invention are as follows:

[0030] The method proposed in this invention can detect Android escaping software with high accuracy and accurately characterize its escaping behavior. By extracting key features of dynamic escaping software and tracing its origin from APIs related to environmental detection, combined with data flow analysis and control flow analysis, it can effectively reduce misjudgments of non-escaping software using relevant APIs. Furthermore, by generating control flow subgraphs and comparing them, it can characterize the specific escaping behavior of Android malware.

[0031] The method proposed in this invention is based on static analysis, effectively capturing dynamically escaping Android software from a static perspective. Compared to dynamic methods, it is more efficient and has a wider path coverage. Furthermore, because this method analyzes the data flow and control flow of specific APIs, it remains effective against mechanisms that can circumvent general static analysis, such as class name obfuscation and reflection. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a flowchart illustrating the process of the present invention, which includes modules for an environment detection API list, function call chain filtering, control flow graph generation, behavior control flow subgraph segmentation, and behavior control flow subgraph analysis. The environment detection API list is obtained by filtering APIs used by samples in the Android dynamic escape sample library. The diagram shows the process of performing control flow and data flow analysis on one of the APIs, including call chain filtering, control flow generation, and data flow segmentation into several behavior control flow subgraphs. Finally, by comparing different subgraphs, it is determined whether the APK is a dynamic escape sample and what kind of dynamic escape behavior it exhibits. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0035] This invention analyzes the data flow and control flow of the environment detection API used by Android APKs to segment multiple control flow subgraphs, describing the different paths the Android APK takes after detecting the emulator environment and specifically characterizing different behaviors. This not only accurately detects whether an Android APK exhibits dynamic escape behavior but also specifically characterizes what kind of dynamic escape behavior it possesses. Furthermore, it is equally effective against static analysis techniques such as class name obfuscation and reflection.

[0036] A method for recognizing dynamic escape behavior in Android software based on data flow and control flow. It includes the following steps:

[0037] Step 1: Decompile the test Android APK file, extract the APIs called in the test Android APK, and match them with the environment detection API list; generate function call chains for the successfully matched APIs, and determine whether the top layer of the function call chain is the Android APK's entry point.

[0038] Here, Android APK refers to the Android installation package, API refers to the application programming interface, and the list of APIs that can be used for environment detection includes a series of APIs that can be used by applications to determine whether their environment is a real device or an emulator environment.

[0039] The specific steps are as follows:

[0040] Step 1.1: First, based on the methods mentioned in previous work for detecting the environment, find the corresponding APIs in the Android official documentation to obtain a list of APIs that can be used for environment detection.

[0041] Step 1.2: Decompile the test APK using the Androguard tool to obtain all methods in the APK. Match these methods with the list of APIs that can be used for environment detection selected in Step 1.1 to obtain the characteristic APIs used by the test APK. Then, trace the call chain of these characteristic APIs.

[0042] Step 1.3: Determine if the top level of the function call chain belongs to the entry point function in the Android APK. If not, determine if the top level of the function call chain can be enabled by an explicit or implicit intent call from the entry point function. Entry points include the main entry point function defined in Manifest.xml within the APK folder and methods implicitly started in the Android framework layer, such as the onclick function.

[0043] Step 2: Find all complete control flow paths starting from the Android APK entry point and passing through the above APIs, and form the environment detection API control flow subgraph.

[0044] The specific steps are as follows:

[0045] Step 2.2: Generate the control flow graph within each function in the call chain that meets the conditions.

[0046] Step 2.2: Starting from the Android APK entry point, analyze the control flow graph within each function to generate several complete control flow paths between functions that call the environment detection API.

[0047] Step 2.3: For each environment detection API, aggregate all complete control flow paths between functions passing through it to form several environment detection API control flow subgraphs.

[0048] Step 3: Analyze the data flow propagation between functions of the above-mentioned environmental detection API control flow subgraph, find the nearest branch statement on its data flow propagation path, and split it into several smaller escape behavior subgraphs starting from the branch.

[0049] The specific steps are as follows:

[0050] Step 3.1: For each environment detection API, analyze the information flow of the API called by the APK under test, propagate its data flow forward, and generate an explicit information flow propagation path within the function. If the endpoint of its explicit information flow propagation path is located in the judgment condition of the branch statement, then locate this position; otherwise, remove the control flow subgraph of this environment detection API.

[0051] Step 3.2: Divide the remaining environment detection API control flow subgraph into several (usually two) smaller behavior control flow subgraphs according to the branch statements located above.

[0052] The specific steps of step 4 are as follows:

[0053] For the control flow subgraphs obtained above, we analyze the functions they call to infer their behavior, determine whether they conform to dynamic escape behavior, and finally compare the behavioral differences between each control flow subgraph. If at least one behavior subgraph does not contain dynamic escape behavior, while at least one behavior subgraph is determined to contain dynamic escape behavior, we can determine that it is an Android dynamic escape software.

Claims

1. A method for recognizing dynamic escape behavior in Android software based on data flow and control flow, characterized in that, Includes the following steps: Step 1: Decompile the test Android APK file, extract the APIs called in the test Android APK, match them with the environment monitoring API list, generate function call chains for the successfully matched APIs, and determine whether the top layer of the function call chain is the Android APK's entry point; Among them, Android APK represents the Android installation package, API represents the application programming interface, and the list of APIs that can be used for environment detection includes a series of APIs that can be used by applications to determine whether their environment is a real device or an emulator environment; Step 2: Identify all complete control flow paths starting from the Android APK's entry point and passing through the Environment Detection API, and form the Environment Detection API control flow subgraph; Step 3: Analyze the data flow propagation between functions of the above environmental detection API control flow subgraph, find the nearest branch statement on the data flow propagation path, and split it into several smaller control flow subgraphs starting from the branch; Step 4: Compare the behavioral differences of the functions used in each control flow subgraph, determine whether they have dynamic escape characteristics, and point out their specific escape behavior; The specific steps of step 3 are as follows: Step 3.1: For each environment detection API, analyze the information flow of the API called by the APK under test, propagate its data flow forward, and generate an explicit information flow propagation path within the function. If the endpoint of its explicit information flow propagation path is located in the judgment condition of the branch statement, then locate this position; otherwise, remove the control flow subgraph of this environment detection API. Step 3.2: Divide the remaining environment detection API control flow subgraph into several smaller behavior control flow subgraphs according to the branch statements located above; The specific steps of step 4 are as follows: For the control flow subgraphs obtained above, analyze the functions called to infer the behavior, determine whether it conforms to dynamic escape behavior, and finally compare the behavioral differences between each control flow subgraph. If at least one behavior subgraph does not contain dynamic escape behavior, while at least one behavior subgraph is determined to contain dynamic escape behavior, then it is determined to be Android dynamic escape software.

2. The method for identifying dynamic escape behavior in Android software based on data flow and control flow according to claim 1, characterized in that, The specific steps of step 1 are as follows: Step 1.1: First, based on the methods mentioned in previous work for detecting the environment, find the corresponding APIs in the Android official documentation to obtain a list of APIs that can be used for detecting the environment; Step 1.2: Decompile the test APK using the Androguard tool to obtain all methods in the APK, match them with the list of APIs that can be used for testing the environment selected in Step 1.1 to obtain the characteristic APIs used by the test APK, and then trace the call chain of these characteristic APIs. Step 1.3: Determine whether the top layer of the function call chain belongs to the Android APK's entry point. If not, determine whether the top layer of the function call chain can be enabled by an explicit or implicit intent call from the entry function. The entry function includes the main entry function defined in Manifest.xml in the APK folder and methods that will be implicitly started in the Android framework layer.

3. The method for identifying dynamic escape behavior in Android software based on data flow and control flow according to claim 1, characterized in that, The specific steps of step 2 are as follows: Step 2.1: Generate the control flow graph within each function in the call chain that meets the conditions; Step 2.2: Starting from the Android APK entry point, analyze the control flow graph within each function to generate several inter-function control flow paths that pass through the environment detection API; Step 2.3: For each environment detection API, aggregate all control flow paths between functions passing through it to form several environment detection API control flow subgraphs.

4. The method for identifying dynamic escape behavior of Android software based on data flow and control flow according to claim 1, characterized in that, The environmental detection API specifically includes: Get IMEI, device serial number, MAC address, Android ID, network configuration, contact list, SMS content, SMS messages, application information, Wi-Fi, battery level information, recent calls, call logs, accelerometer, gyroscope, GPS, and gravity sensor values, CPU information, values ​​of special APIs in the Android SDK's public class `build`, and computational and graphical performance.

5. The method for identifying dynamic escape behavior of Android software based on data flow and control flow according to claim 1, characterized in that, The dynamic escape behavior specifically includes: Using sensitive APIs as specified in the Android official documentation, using system functions that affect program execution, such as exit delay, and loading code from the native layer.

Images