A software detection method and system based on sensitive information flow relationship

Abstract

The application discloses a software detection method and system based on sensitive information flow relationship, which can be applied to the technical field of software detection. The method comprises the following steps: grouping analysis is performed on all sensitive API calling sequences in a sensitive API calling sequence set through dynamic programming to obtain continuous common sub-sequences corresponding to the grouping; wherein, the grouping analysis is performed on any two sensitive API calling sequences; sensitive API calling sequence relationships are obtained according to the continuous common sub-sequences corresponding to the current sensitive API calling sequence group and preset sensitive API calling sequence relationship rules; and the software to be detected is detected through machine learning according to all sensitive API calling sequence relationships corresponding to the software to be detected. It can be seen that the sensitive API calling sequence relationships are obtained through the continuous common sub-sequences, the possibility of false positives in the detection of the software to be detected through machine learning is reduced, and the software detection accuracy is improved.

Description

Technical Field

[0001] This application relates to the field of software detection technology, and in particular to a software detection method and system based on the relationship of sensitive information flow. Background Technology

[0002] Malicious applications target users' private data, threatening the confidentiality and integrity of that data. Some malicious applications steal users' private information without their knowledge. How to accurately detect malware to protect user privacy has become a hot research topic in the field of information security.

[0003] Current technologies decompile application source files into intermediate code, analyze and model this intermediate code, and then use certain rules to track whether tainted data propagates from taint sources to taint sinks after marking tainted data, thereby determining whether the data has been leaked or tampered with. However, due to the complexity of modern applications, benign and malicious applications may collect the same information. Methods based on coarse-grained information flow feature descriptions for malware detection may produce false positives, making software detection inaccurate. Therefore, designing a method to improve the accuracy of software detection has become a pressing technical problem in this field. Summary of the Invention

[0004] In view of this, embodiments of this application provide a software detection method and system based on the relationship of sensitive information flow, aiming to make software detection more accurate.

[0005] In a first aspect, embodiments of this application provide a software detection method based on the relationship of sensitive information flow, the method comprising:

[0006] Dynamic programming is used to perform group analysis on all sensitive API call sequences in the sensitive API call sequence set to obtain continuous common subsequences of the corresponding groups; wherein, the group analysis involves randomly selecting two sensitive API call sequences from the sensitive API call sequence set for analysis.

[0007] Based on the continuous common subsequences corresponding to the current sensitive API call sequence group and the preset sensitive API call sequence relationship rules, the sensitive API call sequence relationship is obtained;

[0008] Based on the sequence relationships of all sensitive API calls corresponding to the software under test, machine learning is used to detect the software.

[0009] Optionally, the step of performing group analysis on all sensitive API call sequences in the sensitive API call sequence set through dynamic programming to obtain continuous common subsequences of the corresponding groups includes:

[0010] By using dynamic programming to group and analyze all sensitive API call sequences in the sensitive API call sequence set, a preliminary relationship between sensitive API call sequences is obtained.

[0011] Based on the preliminary sensitive API call sequence relationship, determine whether the current sensitive API call sequence group has a continuous common subsequence;

[0012] If it exists, mark the combination method of the corresponding continuous common subsequence with the current sensitive API call sequence group to obtain the continuous common subsequence of the corresponding group.

[0013] Optionally, before using machine learning to detect the software to be detected, the following steps may also be taken:

[0014] Each API in a continuous common subsequence is classified according to a preset mapping dictionary; the mapping dictionary has six API categories, and there is a corresponding relationship between them and the APIs.

[0015] Optionally, each API in a continuous common subsequence can be categorized according to a predefined mapping dictionary, including:

[0016] When an API in a sensitive API call sequence can be mapped to a category in the mapping dictionary, the value at the position in the tuple corresponding to the current API is set to 1; wherein the tuple is a six-tuple defined according to the six API categories in the mapping dictionary;

[0017] The tuples corresponding to all APIs in the software to be tested are merged into a matrix vector.

[0018] Optionally, after fusing all the six-tuples corresponding to the software to be detected into a single matrix vector, the following steps are also included:

[0019] The corresponding sensitive API call sequence relationships and continuous common subsequences are concatenated into the matrix vector so that the software to be detected can be detected by machine learning.

[0020] Optionally, before performing grouping analysis on all sensitive API call sequences in the sensitive API call sequence set using dynamic programming, the following steps are also included:

[0021] When determining whether the sensitive API call sequence is transmitted in a variable, it is important to check if the information is meaningful. If the information is meaningless, the current sensitive API call sequence is ignored.

[0022] Optionally, before determining whether the transmission of a sensitive API call sequence in a variable constitutes meaningful information, the following steps are also included:

[0023] Obtain a set of sensitive API call sequences of the software to be detected; wherein, the set of sensitive API call sequences consists of multiple sensitive API call sequences.

[0024] Secondly, embodiments of this application provide a software detection system based on the relationship of sensitive information flow. The system includes a group analysis module, a relationship acquisition module, and a software detection module.

[0025] The grouping analysis module is used to perform grouping analysis on all sensitive API call sequences in the sensitive API call sequence set through dynamic programming to obtain continuous common subsequences of the corresponding groups; wherein, the grouping analysis involves randomly selecting two sensitive API call sequences from the sensitive API call sequence set for analysis;

[0026] The relationship acquisition module is used to obtain the sensitive API call sequence relationship based on the continuous public sub-sequences corresponding to the current sensitive API call sequence group and the preset sensitive API call sequence relationship rules;

[0027] The software detection module is used to detect the software under test by using machine learning based on the sequence relationship of all sensitive API calls corresponding to the software under test.

[0028] Optionally, the grouping analysis module is specifically used for:

[0029] By using dynamic programming to group and analyze all sensitive API call sequences in the sensitive API call sequence set, a preliminary relationship between sensitive API call sequences is obtained.

[0030] Based on the preliminary sensitive API call sequence relationship, determine whether the current sensitive API call sequence group has a continuous common subsequence;

[0031] If it exists, mark the combination method of the corresponding continuous common subsequence with the current sensitive API call sequence group to obtain the continuous common subsequence of the corresponding group.

[0032] Optionally, the software detection system based on sensitive information flow relationships further includes:

[0033] The API classification module is used to classify each API in a continuous common subsequence according to a preset mapping dictionary; the mapping dictionary has six API categories, and there is a corresponding relationship between them and the APIs.

[0034] This application provides a software detection method based on sensitive information flow relationships, including: performing group analysis on all sensitive API call sequences in a sensitive API call sequence set through dynamic programming to obtain continuous common subsequences of the corresponding groups; wherein, the group analysis involves analyzing sensitive API call sequences from any two sensitive API call sequence sets; obtaining sensitive API call sequence relationships based on the continuous common subsequences corresponding to the current sensitive API call sequence group and preset sensitive API call sequence relationship rules; and detecting the software to be detected using machine learning based on all sensitive API call sequence relationships corresponding to the software to be detected. It is evident that this application's solution utilizes continuous common subsequences to obtain sensitive API call sequence relationships, reducing the possibility of false positives when detecting the software to be detected using machine learning, and improving the accuracy of software detection.

[0035] In addition, this application also provides a software detection system based on the relationship of sensitive information flow, the technical effect of which corresponds to the above method, and will not be described in detail here. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings used in the description of the embodiment or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 A flowchart of a method for software detection based on sensitive information flow relationships provided in this application embodiment;

[0038] Figure 2 Another method flowchart for the software detection method based on sensitive information flow relationship provided in the embodiments of this application;

[0039] Figure 3 A schematic diagram illustrating an application scenario for the software detection method based on sensitive information flow relationships provided in this application embodiment;

[0040] Figure 4 Example diagram of sensitive API call sequence relationship provided in the embodiments of this application;

[0041] Figure 5 This is a schematic diagram of a matrix vector for tuple fusion provided in an embodiment of this application;

[0042] Figure 6 This is a schematic diagram of a software detection system based on sensitive information flow relationships provided in an embodiment of this application. Detailed Implementation

[0043] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0044] Malicious applications target users' private data, threatening the confidentiality and integrity of that data. In recent years, with the development of the mobile internet, users can access abundant internet resources and comprehensive services through mobile devices, leading to the widespread adoption and use of smartphones. Today, smart devices are equipped with sophisticated sensors such as cameras, microphones, gyroscopes, and GPS. Mobile applications can meet needs for work, social interaction, entertainment, travel, shopping, and payments, becoming indispensable tools in people's lives and work. However, this also generates massive amounts of data containing personal privacy information, which some malicious applications can steal without the user's knowledge. How to accurately detect Android malware to protect user privacy has become a hot research topic in the field of information security.

[0045] Information flow analysis technology aims to ensure information security by analyzing the legitimacy of data propagation within a program to prevent the leakage or tampering of private data during transmission. It has wide applications in malware detection and privacy protection. It decompiles application source files into intermediate code, analyzes and models this intermediate code, and tracks whether tainted data propagates from tainted sources to tainted sinks using certain rules. This determines whether the data has been leaked or tampered with, effectively ensuring the confidentiality and integrity of data in the system. However, due to the complexity of modern applications, benign and malicious applications may collect the same information. For example, applications might collect phone contacts to recommend people a user might know, or obtain location information to recommend nearby attractions, hotels, and restaurants. These applications are designed to provide user convenience and are fundamentally different from malicious applications, requiring differentiation. However, methods for detecting malware based on coarse-grained information flow feature descriptions may produce false positives, making software detection inaccurate. Therefore, designing a method to improve the accuracy of software detection has become a pressing technical problem in this field.

[0046] This application provides a software detection method based on the relationship of sensitive information flow. The flowchart of the method is as follows: Figure 1 As shown, it includes the following steps:

[0047] S10: Perform group analysis on all sensitive API call sequences in the sensitive API call sequence set through dynamic programming to obtain continuous common subsequences of the corresponding groups; wherein, the group analysis is to randomly select two sensitive API call sequences from the sensitive API call sequence set for analysis.

[0048] The set of sensitive API call sequences in the software under test is defined as the sensitive API call sequence set. For example, if the sensitive API call sequence set is defined as FS, then FS = [F1, F2, ..., F...]. n-1 ,F n ], where F n Let n be the nth sensitive API call sequence. Then, by combining all sensitive API call sequences in the set using the combination formula, we obtain the nth sensitive API call sequence. A group of sensitive API call sequences.

[0049] In set FS, if there exists F pub F i and F j F pub =F i ∩F j , where F pub If it is still a continuous sequence of API calls, then it is called F. pub For sequence F i and F j A continuous common subsequence. Simultaneously determine sequence F. i and F j It has a sensitive API call sequence relationship; conversely, if it does not meet the above requirements, then sequence F... i and F j There are no common subsequences, and therefore no sensitive API call sequence relationship. For ease of understanding, i and j are defined as two different sensitive API call sequences, which have no sequential relationship at the character level. The API mentioned in step S10 refers to the Application Programming Interface, and for ease of reading, it will be referred to as API for short.

[0050] S20. Based on the continuous common subsequences corresponding to the current sensitive API call sequence group and the preset sensitive API call sequence relationship rules, obtain the sensitive API call sequence relationship.

[0051] The preset rules for the sequence of sensitive API calls are as follows:

[0052] First, let |F| denote the length of the sensitive API call sequence F. In the set FS, if F exists... i and F j F = F i Fj F i F j F represents i and F j The connection F has a length of |F|. i |+|F j |, where F i For the prefix of F, denoted as F j It is a suffix for F, denoted as

[0053] In |F i |≤|F j In the case of |, the relationship between sensitive APIs is defined as follows:

[0054] (1) If |F pub |<|F i |, and Then F is called i and F j There is a convergence relationship.

[0055] (2) If |F pub |<|F i |, and Then F is called i and F j There is a dispersed relationship.

[0056] (3) If |F pub |=|F i |, i.e., F i It is F j A continuous subsequence of F is called F. i Included in F j ,Right now Its meaning represents F i Appearing in F j During the execution of F i and F j There is an inclusion relationship.

[0057] (4) If Where n > 1, m < |F j At this time Then F is called i and F j There is a sequential relationship.

[0058] (5) If |F pub |<|F i |,F pub =F i [n...n+|F pub |]=Fj [m...m+|F pub |], where n>1, m>1, and F at this time pub There may be multiple such relationships, so they are uniformly expressed as non-specific cross relationships.

[0059] Obtain the sensitive API call sequence relationship of the current sensitive API call sequence group with continuous common subsequences.

[0060] S30 uses machine learning to detect the software based on the sequence relationships of all sensitive API calls corresponding to the software under test.

[0061] The sequence of sensitive API calls is stored in a pre-defined matrix feature vector, and the matrix is ​​then input into a machine learning model for malware detection.

[0062] As can be seen, the proposed solution utilizes continuous common subsequences to obtain the sequence relationship of sensitive API calls, which reduces the possibility of false alarms when using machine learning to detect software and improves the accuracy of software detection.

[0063] In some specific embodiments, such as Figure 2 Another method flowchart of the software detection method based on sensitive information flow relationship provided in the embodiments of this application is shown. Step S10 includes steps S101, S102, and S103:

[0064] S101, by performing group analysis on all sensitive API call sequences in the sensitive API call sequence set through dynamic programming, a preliminary relationship of sensitive API call sequences is obtained.

[0065] Dynamic programming is used for grouping analysis, which is computationally efficient and requires less computation. It yields preliminary sensitive API call sequence relationships, which, unlike the actual sensitive API call sequence relationships, merely reflect the mathematical relationships between API call sequences. For example, the relationship is obtained by comparing the prefixes and suffixes of two sequences.

[0066] S102, based on the preliminary sensitive API call sequence relationship, determine whether there is a continuous common subsequence in the current sensitive API call sequence group.

[0067] Dynamic programming is used to determine the relationships between APIs and to find the continuous common subsequence between any two sensitive API call sequences. The state transition formula is shown in formula (1), where C[n][m] represents the length of the continuous common subsequence in a certain state, and F... i and F j Let i and j represent the sensitive API call sequences. From formula (1), it can be seen that this method decomposes a problem into subproblems and then solves them recursively. When F... i [n-1]=Fj When [m-1], the subproblem becomes solving F. i [1...n-1] and F j The optimal solution to the entire problem is the optimal solution to the last subproblem, obtained by finding the continuous common subsequence of [1...m]. Using a pre-defined algorithm, this is applied to the two sensitive API call sequences F. i and F j F is judged and compared sequentially through a loop. i The nth API call and F j If the m-th API call is the same, then the length of the current common contiguous subsequence |F is determined. pub Increment by 1 and record the current F. pub The first element in sequence F i and F j The position index in the middle.

[0068]

[0069] S103, if it exists, mark the combination method of the corresponding continuous common subsequence with the current sensitive API call sequence group to obtain the continuous common subsequence of the corresponding group.

[0070] After the last iteration in step S102 ends, if |F pub If the value of | is not 0, then use the index and |F pub The value of | was extracted to F i and F j The continuous common subsequences are obtained. The continuous common subsequence F is obtained. pub Then, the relation characteristics can be obtained further based on the formal description of the defined relation.

[0071] In some specific embodiments, such as Figure 2 Another method flowchart of the software detection method based on sensitive information flow relationship provided in the embodiment of this application is shown. Step S30 includes step S301, in which each API in the continuous public subsequence is classified according to a preset mapping dictionary before the software to be detected is detected by machine learning; the mapping dictionary has six API categories and there is a corresponding relationship between them.

[0072] Among them, the sensitive API call sequence F=<SOURCE,A1,A2,...,A n-1 A n The sequence, SINK>, consists of several API functions, where SOURCE is the taint propagation source, SINK is the taint convergence point, and A... n This indicates the nth API call function in the sequence.

[0073] In some specific embodiments, such as Figure 2 The flowchart of another method for software detection based on sensitive information flow relationship provided in the embodiments of this application is shown. Step S30 includes step S302, where step S302 is a further classification of step S301.

[0074] When an API in a sensitive API call sequence can be mapped to a category in the mapping dictionary, the value at the position in the tuple corresponding to the current API is set to 1; wherein the tuple is a six-tuple defined according to the six API categories in the mapping dictionary;

[0075] The tuples corresponding to all APIs in the software to be tested are merged into a matrix vector.

[0076] These API categories are defined as six-tuples: ACV = [NETWORK, LOCATION, ACCOUNT, DATA_PERSISTENCE, INFORMATION, INTENT]. A mapping dictionary Dict between APIs and API categories is established. When an API in the sequence maps to a category in the API category mapping table (Table 1), the value at that position in the ACV tuple is set to 1.

[0077] Table 1 API Category Mapping Table

[0078]

[0079] In some specific embodiments, such as Figure 2 Another method flowchart of the software detection method based on sensitive information flow relationship provided in the embodiment of this application is shown. Step S30 includes step S303, after merging all six-tuples corresponding to the software to be detected into a matrix vector, the corresponding sensitive API call sequence relationship and continuous common subsequence are concatenated into the matrix vector so as to detect the software to be detected by machine learning.

[0080] First, initialize the tuple ACV to [0,0,0,0,0,0]. Then, iterate through each API in the continuous common subsequence, find its mapping in the dictionary Dict, and assign the value 1 to the corresponding position of the mapped API category in the ACV tuple. Finally, concatenate and fuse the relation feature Re obtained in the previous stage and the continuous common subsequence feature ACV, and store it in the feature vector EM so that it can be used for detection by the software to be detected through machine learning later.

[0081] In some specific embodiments, such as Figure 2The flowchart of another method for software detection based on sensitive information flow relationship provided in the embodiments of this application shows that before step S10, step S02 is included, which determines whether the transmission of sensitive API call sequence in variables is meaningful information. If the information is meaningless, the current sensitive API call sequence is ignored.

[0082] If, during transmission, for example, the sequence str→intent→paramIntent→paramString is transmitted within a variable, and the value corresponding to secret is assigned null or other irrelevant information within this sequence, then although the API call sequence calls a sensitive API, it doesn't transmit any meaningful information. Further analysis of this API call sequence would then be meaningless. Therefore, analyzing the transmission of sensitive information within variables is crucial for filtering API call sequences that actually transmit sensitive information, thereby improving the accuracy of the analysis and reducing the amount of data to be analyzed.

[0083] In some specific embodiments, such as Figure 2 Another method flowchart of the software detection method based on sensitive information flow relationship provided in the embodiments of this application is shown. Before step S02, step S01 is included to obtain the sensitive API call sequence set of the software to be detected; wherein, the sensitive API call sequence set is composed of multiple sensitive API call sequences.

[0084] The software under test needs to call the API to invoke system functions and obtain device information.

[0085] For example, in SendSMS.apk, the Onclick() method in the Button1Listener class retrieves the device's International Mobile Subscriber Identity (IMSI) information by calling android.telephony.TelephonyManager, assigns it to the string str, stores it in a key-value pair with the key "secret," and finally calls android.util.Log to write it to the log file. Therefore, this class contains a sensitive information propagation path from the Sources point to the Sinks point: android.telephony.TelephonyManager:getDeviceId() → android.util.Log:i(). Integrating these paths yields a set of sensitive API call sequences.

[0086] Scene 1:

[0087] like Figure 3The application scenario diagram of the software detection method based on sensitive information flow relationships provided in the embodiments of this application is shown. Taking an APK file as an example, firstly, sensitive API call sequences are extracted using step S10, and then preliminary variable analysis is performed to obtain preliminary sensitive API call sequence relationships. Then, Algorithm 1 is used to analyze the sensitive API call sequence relationships. Algorithm 1 is as follows:

[0088] Algorithm 1 Sensitive API Call Sequence Relationship Analysis

[0089] Input: A set of sensitive API call sequences FS = [F1, F2, ..., F n-1 ,F n ]

[0090] Output: Relationship characteristics Re and continuous common subsequences F between all sensitive API call sequences pub

[0091]

[0092]

[0093]

[0094] Obtain continuous common subsequence F pub Then, the relation characteristics can be obtained further based on the formal description of the defined relation.

[0095] Among them, such as Figure 4 The example diagram of sensitive API call sequence relationships provided in this application illustrates the convergence and serial relationships. Figure 4 The leftmost position in the middle represents a convergent relationship, while the whole represents a sequential relationship.

[0096] After obtaining the relation features, feature fusion is performed. As shown in Algorithm 2, the tuple ACV is first initialized to [0,0,0,0,0,0]. Then, each API in the continuous common subsequence is traversed to find its mapping in the dictionary Dict. The corresponding position of the mapped API category in the ACV tuple is then assigned a value of 1. Finally, the relation features Re and the continuous common subsequence features ACV obtained in the previous stage are concatenated and fused, and stored in the feature vector EM.

[0097] Algorithm 2 Feature Fusion

[0098] Input: A continuous common subsequence F of each sensitive API call sequence pub The relation matrix Re of sensitive API call sequences, the API category mapping dictionary Dict, and ACV = [0,0,0,0,0,0]

[0099] Output: Feature vector EM

[0100]

[0101] like Figure 5 As shown in the matrix vector diagram of tuple fusion provided in the embodiments of this application, the data collected in the feature extraction stage will be represented as matrix EM. ij Indicates the sensitive API call sequence F i and F j The fused feature vector matrix is ​​then used. Finally, the matrix is ​​fed into a machine learning model for malware detection.

[0102] Based on the software detection method based on sensitive information flow relationships provided in the above embodiments, this application provides a system for performing the above-described software detection based on sensitive information flow relationships. A schematic diagram of the structure of this software detection system based on sensitive information flow relationships is shown below. Figure 6 As shown, the software detection system based on sensitive information flow relationships includes a group analysis module, a relationship acquisition module, and a software detection module;

[0103] The grouping analysis module 10 is used to perform grouping analysis on all sensitive API call sequences in the sensitive API call sequence set through dynamic programming to obtain continuous common subsequences of the corresponding groups; wherein, the grouping analysis is to analyze the sensitive API call sequences of any two sensitive API call sequence sets.

[0104] In set FS, if there exists F pub F i and F j F pub =F i ∩F j , where F pub If it is still a continuous sequence of API calls, then it is called F. pub For sequence F i and F j A continuous common subsequence. Simultaneously determine sequence F. i and F j It has a sensitive API call sequence relationship; conversely, if it does not meet the above requirements, then sequence F... i and F j There are no common subsequences, and therefore no sensitive API call sequence relationship. For ease of understanding, i and j are defined as two different sensitive API call sequences, which do not have an order relationship at the character level.

[0105] The relationship acquisition module 20 is used to obtain the sensitive API call sequence relationship based on the continuous common subsequences corresponding to the current sensitive API call sequence group and the preset sensitive API call sequence relationship rules.

[0106] Obtain the sensitive API call sequence relationship of the current sensitive API call sequence group with continuous common subsequences.

[0107] The software detection module 30 is used to detect the software under test by using machine learning based on the sequence relationship of all sensitive API calls corresponding to the software under test.

[0108] The sequence of sensitive API calls is stored in a pre-defined matrix feature vector, and the matrix is ​​then input into a machine learning model for malware detection.

[0109] In some specific embodiments, the grouping analysis module 10 is specifically used for:

[0110] By using dynamic programming to group and analyze all sensitive API call sequences in the sensitive API call sequence set, a preliminary relationship of sensitive API call sequences can be obtained.

[0111] Using dynamic programming for grouping analysis is computationally efficient and requires minimal computation. It yields a preliminary relationship of sensitive API call sequences, which differs from the actual sensitive API call sequence relationship; it merely reflects the mathematical relationships within the API call sequences.

[0112] Based on the preliminary sensitive API call sequence relationship, determine whether the current sensitive API call sequence group has a continuous common subsequence.

[0113] Use dynamic programming to determine the relationships between APIs and solve for the continuous common subsequences between any two sensitive API call sequences.

[0114] If it exists, mark the combination method of the corresponding continuous common subsequence with the current sensitive API call sequence group to obtain the continuous common subsequence of the corresponding group.

[0115] Obtain continuous common subsequence F pub Then, the relation characteristics can be obtained further based on the formal description of the defined relation.

[0116] In some specific embodiments, the software detection system based on sensitive information flow relationships further includes: classifying each API in a continuous public subsequence according to a preset mapping dictionary before detecting the software to be detected through machine learning; the mapping dictionary has six API categories and there is a corresponding relationship between them.

[0117] Among them, the sensitive API call sequence F=<SOURCE,A1,A2,...,A n-1 A n The sequence, SINK>, consists of several API functions, where SOURCE is the taint propagation source, SINK is the taint convergence point, and A... nThis indicates the nth API call function in the sequence.

[0118] In some specific embodiments, the software detection system based on sensitive information flow relationships further includes:

[0119] When an API in a sensitive API call sequence can be mapped to a category in the mapping dictionary, the value at the position in the tuple corresponding to the current API is set to 1; wherein the tuple is a six-tuple defined according to the six API categories in the mapping dictionary;

[0120] The tuples corresponding to all APIs in the software to be tested are merged into a matrix vector.

[0121] These API categories are defined as six-tuples: ACV = [NETWORK, LOCATION, ACCOUNT, DATA_PERSISTENCE, INFORMATION, INTENT]. A mapping dictionary Dict between APIs and API categories is established. When an API in the sequence maps to a category in the API category mapping table, the value at that position in the ACV tuple is set to 1.

[0122] In some specific embodiments, the software detection system based on sensitive information flow relationships further includes: after merging all six-tuples corresponding to the software to be detected into a matrix vector, concatenating the corresponding sensitive API call sequence relationships and continuous common subsequences into the matrix vector, so as to detect the software to be detected through machine learning.

[0123] First, initialize the tuple ACV to [0,0,0,0,0,0]. Then, iterate through each API in the continuous common subsequence, find its mapping in the dictionary Dict, and assign the value 1 to the corresponding position of the mapped API category in the ACV tuple. Finally, concatenate and fuse the relation feature Re obtained in the previous stage and the continuous common subsequence feature ACV, and store it in the feature vector EM so that it can be used for detection by the software to be detected through machine learning later.

[0124] In some specific embodiments, the software detection system based on sensitive information flow relationships further includes:

[0125] The judgment module is used to determine whether the sensitive API call sequence transmitted in variables is meaningful information. If the information is meaningless, the current sensitive API call sequence is ignored.

[0126] If, during transmission, for example, the sequence str→intent→paramIntent→paramString is transmitted within a variable, and the value corresponding to secret is assigned null or other irrelevant information within this sequence, then although the API call sequence calls a sensitive API, it doesn't transmit any meaningful information. Further analysis of this API call sequence would then be meaningless. Therefore, analyzing the transmission of sensitive information within variables is crucial for filtering API call sequences that actually transmit sensitive information, thereby improving the accuracy of the analysis and reducing the amount of data to be analyzed.

[0127] In some specific embodiments, the software detection system based on sensitive information flow relationships further includes:

[0128] The information acquisition module is used to acquire a set of sensitive API call sequences of the software to be tested; wherein, the set of sensitive API call sequences consists of multiple sensitive API call sequences.

[0129] The software under test needs to call the API to invoke system functions and obtain device information.

[0130] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0131] The solution provided in this application has been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A software detection method based on the relationship of sensitive information flow, characterized in that, The method includes: Dynamic programming is used to perform group analysis on all sensitive API call sequences in the sensitive API call sequence set to obtain continuous common subsequences of the corresponding groups; wherein, the group analysis involves arbitrarily selecting two sensitive API call sequences from the sensitive API call sequence set for analysis. Based on the continuous common subsequences corresponding to the current sensitive API call sequence group and the preset sensitive API call sequence relationship rules, the sensitive API call sequence relationship is obtained; When an API in a sensitive API call sequence can be mapped to a category in the mapping dictionary, the value at the position in the tuple corresponding to the current API is set to 1; wherein the tuple is a six-tuple defined according to the six API categories in the mapping dictionary; the mapping dictionary has six API categories, and there is a correspondence between them and the APIs; Merge the tuples corresponding to all APIs in the software to be tested into a single matrix vector; The corresponding sensitive API call sequence relationships and continuous common subsequences are concatenated into the matrix vector so that the software to be detected can be detected by machine learning. Based on the sequence relationships of all sensitive API calls corresponding to the software under test, machine learning is used to detect the software.

2. The method according to claim 1, characterized in that, The method involves using dynamic programming to group and analyze all sensitive API call sequences in the sensitive API call sequence set, obtaining continuous common subsequences for each group, including: By using dynamic programming to group and analyze all sensitive API call sequences in the sensitive API call sequence set, a preliminary relationship between sensitive API call sequences is obtained. Based on the preliminary sensitive API call sequence relationship, determine whether the current sensitive API call sequence group has a continuous common subsequence; If it exists, mark the combination method of the corresponding continuous common subsequence with the current sensitive API call sequence group to obtain the continuous common subsequence of the corresponding group.

3. The method according to claim 1, characterized in that, Before performing grouping analysis on all sensitive API call sequences in the sensitive API call sequence set using dynamic programming, the following steps are also included: When determining whether the sensitive API call sequence is transmitted in a variable, it is important to check if the information is meaningful. If the information is meaningless, the current sensitive API call sequence is ignored.

4. The method according to claim 3, characterized in that, Before determining whether the transmission of a sensitive API call sequence in variables constitutes meaningful information, the following steps are also included: Obtain a set of sensitive API call sequences of the software to be detected; wherein, the set of sensitive API call sequences consists of multiple sensitive API call sequences.

5. A software detection system based on the relationship of sensitive information flow, characterized in that, The system, which is used in electronic devices, includes a grouping analysis module, a relationship acquisition module, and a software detection module. The grouping analysis module is used to perform grouping analysis on all sensitive API call sequences in the sensitive API call sequence set through dynamic programming to obtain continuous common subsequences of the corresponding groups; wherein, the grouping analysis involves randomly selecting two sensitive API call sequences from the sensitive API call sequence set for analysis; The relationship acquisition module is used to obtain the sensitive API call sequence relationship based on the continuous public sub-sequences corresponding to the current sensitive API call sequence group and the preset sensitive API call sequence relationship rules; The API classification module is used to assign the value of the position in the tuple corresponding to the current API to 1 when an API in the sensitive API call sequence can be mapped to a certain category in the mapping dictionary; wherein the tuple is a six-tuple defined according to the six API categories in the mapping dictionary; the mapping dictionary has a total of six API categories, and there is a correspondence between them and the APIs; Merge the tuples corresponding to all APIs in the software to be tested into a single matrix vector; The corresponding sensitive API call sequence relationships and continuous common subsequences are concatenated into the matrix vector so that the software to be detected can be detected by machine learning. The software detection module is used to detect the software under test by using machine learning based on the sequence relationship of all sensitive API calls corresponding to the software under test.

6. The system according to claim 5, characterized in that, The grouping analysis module is specifically used for: By using dynamic programming to group and analyze all sensitive API call sequences in the sensitive API call sequence set, a preliminary relationship between sensitive API call sequences is obtained. Based on the preliminary sensitive API call sequence relationship, determine whether the current sensitive API call sequence group has a continuous common subsequence; If it exists, mark the combination method of the corresponding continuous common subsequence with the current sensitive API call sequence group to obtain the continuous common subsequence of the corresponding group.

Images