A byte-level Android application privacy leakage static detection method and system

Abstract

The application belongs to the technical field of Android application privacy leakage static detection, and discloses a byte-level Android application privacy leakage static detection method and system, unpacks and decompiles an Android APK file, obtains an AndroidManifest.xml file and a Smali file set, and analyzes four components and sensitive permission information related to the APK through a Parser module; the four components, the sensitive permission information, pre-designed SourceAPI rules and SinkAPI rules are input into a Matcher module to obtain a Smali code set to be analyzed. The application proposes a static taint analysis method for byte-level Smali code of Android, which effectively solves problems such as flow sensitivity, method name duplication, ICC and register taint label propagation and tracking in byte-level static taint analysis, improves analysis efficiency and accuracy, and guarantees scalability.

Description

Technical Field

[0001] This invention belongs to the field of static detection technology for privacy leaks in Android applications, and particularly relates to a byte-level static detection method for privacy leaks in Android applications. Background Technology

[0002] Static taint analysis typically involves decompiling Android application package (APK) files and analyzing the decompiled code. In Android's unique execution environment, confirming the call order between methods and analyzing data flow within methods are key aspects of taint propagation rule design. Method execution depends on user interface events, Inter-Component Communication (ICC), and the application lifecycle; these are some of the key challenges in Android static taint analysis. Specifically, static taint analysis first defines the source point (the location where the Application Programming Interface (API) accesses contact data) and the sink point (the location where the API sends data outside the system). It then analyzes for the existence of sensitive data flows from the source point to the sink point based on taint propagation rules. Based on this result, it can be analyzed whether the target APK leaks sensitive information. Existing static taint analysis often combines call graphs (CG) or control flow graphs (CFG) to evaluate applications and identify potential malicious data flows. Androguard, a basic static taint analysis tool from Google, can be used to analyze the control flow in API files to determine the existence of source-to-sink data flows. Similarly tracking privacy acquisition and transmission behaviors, FlowDroid, combined with CG, performs precise modeling of the Android lifecycle, correctly handling multiple entry points, asynchronous component execution, and callback issues. Its sensitivity to context, streams, fields, and objects reduces false positives. DroidSafe, through precise analysis stub technology combined with CFG to analyze code and its semantics, enables effective code analysis.

[0003] The above approach performs static analysis on Jimple, a three-address code that is easy to analyze, either from source code or after decompilation. Jimple is a relatively high-level intermediate representation within the Soot framework, and therefore loses some low-level details, leading to inaccurate analysis results. While Jimple-based static taint analysis is easy to perform, its inherent accuracy limitations result in low coupling when combined with dynamic analysis for the purpose of improving accuracy. Smali-based byte-level static taint analysis can effectively provide the location of the target method and target parameter register for dynamic analysis, offering better scalability. This method improves analysis efficiency and accuracy while addressing flow sensitivity, ICC issues, and code coverage.

[0004] Based on the above analysis, the problems and shortcomings of the existing technology are as follows:

[0005] Static analysis is performed on Jimple, a three-address code that is easy to analyze, either from source code or after decompilation. Jimple is a relatively high-level intermediate representation of the Soot framework, which may lose some low-level details, leading to inaccurate analysis results. While static taint analysis based on Jimple is easy to perform, its inherent accuracy limitations result in low coupling when combined with dynamic analysis to improve accuracy. Summary of the Invention

[0006] To address the problems existing in the prior art, this invention provides a byte-level static detection method for privacy leaks in Android applications.

[0007] This invention is implemented as follows: A byte-level static detection method for privacy leaks in Android applications includes:

[0008] Step 1: Extract AndroidManifest.xml and Dex files from the AndroidAPK file, and decompile the Dex file to generate the Smali file set to be analyzed;

[0009] Step two: The Parser module parses the four main components and permission information from the AndroidManifest.

[0010] Step 3: The Matcher module matches the Smali code set based on the parsed component information and permission information. It compares the parsed permissions with sensitive permission rules and matches them with the Smali code. It also matches the Smali code with Source sensitive API rules and Sink sensitive API rules to narrow down the range of Smali code sets to be analyzed.

[0011] Step 4: The Smali code set to be analyzed is transferred to the Builder module. Based on the Smali method call instructions and the characteristics of data transfer between Smali components, the control flow graph between the method and the instruction nodes within the method is constructed according to the Smali CFG construction algorithm.

[0012] Step 5: Input the constructed CG and CFG into the STA module to complete the tracing of the taint marker register according to the taint analysis propagation algorithm and the taint register data flow equation. When a leak exists, output the method call sequence.

[0013] Furthermore, in step one, the input APK file is decompressed, and the AndroidManifest.xml file and Dex type files ending with the .dex suffix are extracted from it; the Dex file is decompiled using baksmali.jar, the decompiled file is output to a specified path, and the AndroidManifest.xml file is converted into an AndroidManifest.txt file using AXMLPrinter.jar.

[0014] Furthermore, in step two, the Parser module extracts information about the four major components from the AndroidManifest.xml file based on the tag values ​​activity, service, receiver, and provider. It also extracts the permission information involved in the APK based on the tag value uses-permission. Finally, it compares the android:name value in the action tag of the intent-filter tag under the activity tag with android.intent.action.MAIN to extract the application's entry activity.

[0015] Furthermore, in step three, the Matcher module first filters the Smali file code paths corresponding to the components based on the component information parsed by the Parser and the decompiled Smali code set. Then, it matches the extracted permissions with sensitive permissions, matches the Smali representation of sensitive permissions existing in the application with the code set, and filters the corresponding Smali file code paths. Next, it matches the Smali code set with the Smali representation in the Source sensitive API rules and Sink sensitive API rules respectively to obtain the corresponding Smali file code paths. The Source sensitive API rule is the API for obtaining sensitive information from the user's address book, and the Sink sensitive API rule is the API for leaking information to the outside world.

[0016] Furthermore, in step four, the Smali code set to be analyzed is transferred to the Builder module to construct the method call graph, which includes method call graph construction and ICC problem handling.

[0017] Furthermore, in step four, a control flow graph is constructed based on the instruction sequence within the method in the smali code set using the CFG construction algorithm. The smali code instruction sequence is divided into labeled instructions and ordinary instructions. The algorithm continuously extracts instruction generation nodes from the instruction sequence and generates edges from their predecessor nodes to their successor nodes. When a jump statement is analyzed, an edge is generated from the jump statement node to the node to be jumped to.

[0018] In step five, the constructed CG and CFG are input into the STA module to trace the taint registers according to the taint analysis propagation algorithm and data flow equation.

[0019] Another objective of this invention is to provide a byte-level Android application privacy leakage static detection system, comprising:

[0020] The decompilation module is used to extract AndroidManifest.xml and Dex files from AndroidAPK files, and decompile the Dex files to generate a set of Smali files to be analyzed;

[0021] The parsing module is used by the Parser module to parse the four main components and permission information from the AndroidManifest.

[0022] The comparison module is used by the Matcher module to match the Smali code set with the parsed component information and permission information. It compares the parsed permissions with sensitive permission rules and matches them with the Smali code; it also matches the Smali code with Source sensitive API rules and Sink sensitive API rules to narrow down the range of Smali code sets to be analyzed.

[0023] The Builder module is used to transfer the Smali code set to be analyzed to the Builder module, build the CG between the Smali method call instructions and the characteristics of Smali data transfer between components, and build the control flow graph between the instruction nodes within the Builder method according to the Smali CFG construction algorithm;

[0024] The tracing module is used to input the constructed CG and CFG into the STA module to complete the tracing of the taint marker register according to the taint analysis propagation algorithm and the taint register data flow equation. When a leak exists, it outputs the method call sequence.

[0025] Another object of the present invention is to provide a computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the steps of the byte-level Android application privacy leakage static detection method.

[0026] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the byte-level Android application privacy leakage static detection method.

[0027] Another objective of this invention is to provide an information data processing terminal for implementing the byte-level Android application privacy leakage static detection system.

[0028] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0029] First, this invention discloses a byte-level static detection method for Android privacy information leakage, used to detect the leakage of contact privacy information in Android APKs. The method includes: unpacking and decompiling the Android APK file to obtain the AndroidManifest.xml file and a set of Smali files; parsing the four major components and sensitive permission information involved in the APK using the Parser module; inputting the parsed four major components, sensitive permission information, and the SourceAPI and SinkAPI rules proposed in this invention into the Matcher module to narrow the analysis scope and obtain the Smali code set to be analyzed; inputting the code set to be analyzed into the Builder to construct the CG between methods based on method call instructions and data transfer between components, and constructing the CFG within methods according to the CFG construction algorithm; then inputting the CG between methods and the CFG within methods into the STA module, and performing taint register tracking through data flow entity recognition, data flow equations, taint analysis propagation rules, and static taint register propagation algorithms; when sensitive information leakage exists, returning the tainted method call sequence to detect whether a privacy leakage vulnerability exists. This invention proposes a static taint analysis method for Android byte-level Smali code. This method effectively solves problems such as flow sensitivity, method name conflicts, ICC and register taint mark propagation and tracking in byte-level static taint analysis, while improving analysis efficiency and accuracy and ensuring scalability.

[0030] Secondly, this invention discloses a byte-level static detection method for Android privacy information leakage, which can effectively detect whether an Android application has contact privacy information leakage. When information leakage is detected, the method sequence through which the leaked data stream flows is returned. The following is a description of the advantages of each of the optimized techniques:

[0031] 1. Design source sensitive permission rules, source sensitive API rules, and sink sensitive API rules. Through a comparison module, compare the Smali file set with these rules, and compare the Smali files with the information of the four major components parsed from the AndroidManifest.xml file. This narrows down the scope of analysis, ensuring code coverage while avoiding incomplete analysis. In other words, while narrowing the scope of analysis, it maximizes the coverage of the path of tainted data flow propagation, and improves analysis efficiency.

[0032] 2. A method for constructing Smali call graphs (CG) and Smali control flow graphs (CFG) was proposed. The proposed method solves the problem of ICC data flow propagation in Smali bytecode analysis, solves the flow sensitivity problem and ICC problem, and ensures the accuracy of Smali code modeling.

[0033] 3. A tainted data stream equation and a tainted propagation algorithm are proposed. The combination of the two enables the detection of sensitive data stream leakage in the tracking module, ensuring the accuracy of tainted data stream detection. At the same time, it provides an interface for combining with dynamic analysis technology to improve accuracy, and has scalability.

[0034] Third, as supporting evidence of the inventiveness of this invention, it is also reflected in the following important aspects:

[0035] (1) The expected benefits and commercial value of the technical solution of this invention after transformation are as follows:

[0036] This invention can improve application security by identifying and analyzing potential vulnerabilities and security risks in the code, effectively reducing the risk of malware attacks and protecting users' personal information and device security. This technology can help developers discover and resolve security issues in the early stages of application development, thereby reducing the cost and time required to fix vulnerabilities later. At the same time, it provides an interface for combining Android with dynamic taint analysis technology, and has good scalability.

[0037] (2) The technical solution of this invention fills a technical gap in the industry both domestically and internationally:

[0038] This invention provides a byte-level static taint detection method for Android applications. Existing Android static taint analysis methods are mostly based on Jimple, a relatively high-level, easily analyzable three-address code that serves as an intermediate representation within the Soot framework, thus losing some low-level details and leading to inaccurate analysis results. While Jimple-based static taint analysis is easy, it has limitations in accuracy. When combined with dynamic taint analysis methods, the relationship between Jimple-based static and dynamic taint analysis is merely a sequential execution order, resulting in low coupling. This invention's byte-level static taint analysis method can effectively couple with dynamic taint analysis methods, providing the instrumentation location and the method call sequence in Smali.

[0039] Fourth, the technical problems of existing technologies:

[0040] Existing Android application privacy leak detection technologies mainly face the following technical challenges:

[0041] 1. Accuracy issues: Many existing methods rely on coarse static analysis techniques, which may fail to accurately identify complex data and control flows, leading to missed and false alarms.

[0042] 2. Efficiency issues: In-depth static analysis often requires a lot of computing resources and time, especially when analyzing large applications, which is inefficient.

[0043] 3. Insufficient context sensitivity: Existing technologies often ignore the specific circumstances of the application context and execution environment, which may lead to inaccurate analysis results.

[0044] 4. Lack of dynamic behavior analysis: Traditional static analysis cannot simulate the dynamic behavior of actual runtime, such as dynamically loaded code and runtime reflection, which limits the comprehensiveness of detection.

[0045] To address the above problems, the following technical solutions are proposed:

[0046] 1. Fine-grained code analysis:

[0047] - Extract key components and permission information from APK files and generate Smali files through decompilation, which provides a foundation for fine-grained code analysis.

[0048] - The Parser module is used to parse the four major components and permission information from AndroidManifest.xml, ensuring the comprehensiveness and accuracy of the analysis.

[0049] 2. Efficient matching and optimization pruning strategies:

[0050] The Matcher module not only matches permission and sensitive permission rules, but also matches Smali code with sensitive API rules. By optimizing pruning strategies, it reduces the amount of code to be analyzed and improves analysis efficiency.

[0051] 3. Construct a detailed control flow and call graph:

[0052] The Builder module constructs inter-method call graphs (CG) and control flow graphs (CFG) based on Smali method call instructions and data transfer characteristics between components, providing necessary structural information for in-depth analysis.

[0053] 4. Advanced stain analysis technology:

[0054] The -STA module uses taint analysis propagation algorithms and data flow equations to track taint-marked registers, enabling it to accurately identify potential privacy leakage paths.

[0055] The implementation of this technical solution has brought about the following significant technological advancements:

[0056] 1. Improve detection accuracy: Through fine-grained analysis and context-sensitive taint tracking, it can more accurately identify real privacy breaches and reduce false positives and false negatives.

[0057] 2. Optimized performance and efficiency: Through optimized pruning of target blocks and effective matching strategies, the efficiency of analysis is significantly improved, enabling even large applications to complete the analysis within a reasonable time.

[0058] 3. Enhance application security: This method can identify and report complex privacy breach paths, providing developers with powerful tools to enhance application security.

[0059] 4. Adaptive to dynamic behavior analysis: Although it is a static analysis method, it enhances the comprehensiveness of the analysis by simulating dynamic behaviors (such as reflection and dynamic loading).

[0060] This invention provides an efficient and accurate static detection method for privacy leaks in Android applications at the byte level, which can effectively solve the shortcomings of existing technologies in terms of accuracy, efficiency, context sensitivity, and dynamic behavior analysis. Attached Figure Description

[0061] Figure 1 This is a flowchart of a byte-level Android application privacy leakage static detection method provided in an embodiment of the present invention.

[0062] Figure 2 This is a block diagram of the byte-level Android application privacy leakage static detection system provided in an embodiment of the present invention.

[0063] Figure 3 This is an overall framework diagram of the byte-level Android application privacy leakage static detection system provided in the embodiments of the present invention.

[0064] Figure 4 This is a diagram of the CFG control flow graph construction algorithm provided in an embodiment of the present invention.

[0065] Figure 5 This is a diagram of the taint analysis algorithm provided in an embodiment of the present invention. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0067] like Figure 1 As shown, the static detection method for privacy leakage in byte-level Android applications provided by this embodiment of the invention includes the following steps:

[0068] S101 extracts AndroidManifest.xml and Dex files from Android APK files, and decompiles the Dex files to generate a set of Smali files to be analyzed;

[0069] S102, the Parser module parses the four major components and permission information from the AndroidManifest;

[0070] S103, the Matcher module matches the Smali code set based on the parsed component information and permission information, compares the parsed permissions with sensitive permission rules, and matches them with the Smali code; it also matches the Smali code with Source (leaking source) sensitive API rules and Sink (convergence point) sensitive API rules to narrow down the range of Smali code sets to be analyzed.

[0071] S104, The Smali code set to be analyzed is transferred to the Builder module. Based on the Smali method call instructions and the characteristics of Smali data transfer between components, the control flow graph between the method and the instruction nodes within the method is constructed according to the Smali CFG construction algorithm.

[0072] S105 inputs the constructed CG and CFG into the STA module to complete the tracing of the taint marker register according to the taint analysis propagation algorithm and the taint register data flow equation. When a leak exists, the method call sequence is output.

[0073] In S101 of this embodiment of the invention, the input APK file is decompressed, and the AndroidManifest.xml file and the Dex type file ending with the .dex suffix are extracted from it; the Dex file is decompiled using baksmali.jar, the decompiled file is output to a specified path, and the AndroidManifest.xml file is converted into an AndroidManifest.txt file using AXMLPrinter.jar.

[0074] In S102 of this embodiment of the invention, the Parser module extracts information about the four major components from the AndroidManifest.xml file based on the tag values ​​activity, service, receiver, and provider. It also extracts the permission information involved in the APK based on the tag value uses-permission. Finally, it compares the android:name value in the action tag of the intent-filter tag under the activity tag with android.intent.action.MAIN to extract the application's entry activity.

[0075] In S103 of this embodiment of the invention, the Matcher module first filters the Smali file code paths corresponding to the components based on the component information parsed by the Parser and the decompiled Smali code set. Then, it matches the extracted permissions with sensitive permissions, matches the Smali representation of the sensitive permissions existing in the application with the code set, and filters the corresponding Smali file code paths. Next, it matches the Smali code set with the Smali representation in the Source sensitive API rule and the Sink sensitive API rule respectively to obtain the corresponding Smali file code paths. The Source sensitive API rule is the API for obtaining sensitive information from the user's address book, and the Sink sensitive API rule is the API for leaking information to the outside world.

[0076] In S104 of the embodiment of the present invention, the Smali code set to be analyzed is transmitted to the Builder module to construct a call graph between methods, including method call graph construction and ICC problem handling.

[0077] In S104 of the present invention, a control flow graph is constructed according to the instruction sequence within the method of the smali code set using the CFG construction algorithm. The smali code instruction sequence is divided into labeled instructions and ordinary instructions. The algorithm continuously extracts instruction generation nodes from the instruction sequence and generates edges from their predecessor nodes to their successor nodes. When a jump statement is analyzed, an edge is generated from the jump statement node to the statement node to be jumped to.

[0078] In S105, the constructed CG and CFG are input into the STA module to trace the taint registers according to the taint analysis propagation algorithm and data flow equation.

[0079] like Figure 2 As shown in the figure, a byte-level Android application privacy leakage static detection system provided by an embodiment of the present invention includes:

[0080] The decompilation module is used to extract AndroidManifest.xml and Dex files from Android APK files, and decompile the Dex files to generate a set of Smali files to be analyzed;

[0081] The parsing module is used by the Parser module to parse the four main components and permission information from the AndroidManifest.

[0082] The comparison module is used by the Matcher module to match the Smali code set with the parsed component information and permission information. It compares the parsed permissions with sensitive permission rules and matches them with the Smali code; it also matches the Smali code with Source sensitive API rules and Sink sensitive API rules to narrow down the range of Smali code sets to be analyzed.

[0083] The Builder module is used to transfer the Smali code set to be analyzed to the Builder module, build the CG between the Smali method call instructions and the characteristics of Smali data transfer between components, and build the control flow graph between the instruction nodes within the Builder method according to the Smali CFG construction algorithm;

[0084] The tracing module is used to input the constructed CG and CFG into the STA module to complete the tracing of the taint marker register according to the taint analysis propagation algorithm and the taint register data flow equation. When a leak exists, it outputs the method call sequence.

[0085] An embodiment of the present invention provides a computer device, the computer device including a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the processor performs the steps of the byte-level Android application privacy leakage static detection method.

[0086] This invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor performs the steps of the byte-level Android application privacy leakage static detection method.

[0087] This invention provides an information data processing terminal, which is used to implement the byte-level Android application privacy leakage static detection system.

[0088] Specific implementation of the present invention:

[0089] This invention provides a byte-level static detection method for privacy leaks in Android applications. This method improves analysis efficiency and accuracy while ensuring scalability, addressing issues related to stream sensitivity, ICC (Independent Code Crack) errors, and code coverage. The overall framework is as follows: Figure 3 This includes the following steps:

[0090] Step 1: Extract AndroidManifest.xml and Dex files from the Android APK file, and decompile the Dex file to generate the Smali file set to be analyzed;

[0091] Step two: The Parser module parses the four main components and permission-related information from the AndroidManifest.

[0092] Step 3: The Matcher module matches the Smali code set based on the parsed component information and permission information. It compares the parsed permissions with sensitive permission rules and matches them with the Smali code. At the same time, it matches the Smali code with the Source sensitive API rules and the Sink sensitive API rules to narrow down the range of Smali code sets to be analyzed.

[0093] Step 4: The Smali code set to be analyzed is transferred to the Builder module. Based on the Smali method call instructions and the characteristics of data transfer between Smali components, the control flow graph between the method and the instruction nodes within the method is constructed according to the Smali CFG construction algorithm.

[0094] Step 5: Input the constructed CG and CFG into the STA module. Based on the taint analysis propagation algorithm and taint register data flow equation, the taint marker register is traced. When a leak is found, the method call sequence is output.

[0095] Figure 4 This is a diagram of the CFG control flow graph construction algorithm provided in an embodiment of the present invention.

[0096] Figure 5 This is a diagram of the taint analysis algorithm provided in an embodiment of the present invention.

[0097] In step one of the embodiments of the present invention, the input APK file is decompressed, and the AndroidManifest.xml file and a Dex type file ending with the .dex suffix are extracted from it. The Dex file is decompiled using baksmali.jar, and the decompiled file is output to a specified path. The AndroidManifest.xml file is converted into an AndroidManifest.txt file using AXMLPrinter.jar.

[0098] In step two of the embodiments of the present invention, the Parser module extracts information about the four major components from the AndroidManifest.xml file based on the tag values ​​activity, service, receiver, and provider. It also extracts the permission information involved in the APK based on the tag value uses-permission. Finally, it compares the android:name value in the action tag of the intent-filter tag under the activity tag with android.intent.action.MAIN to extract the application's entry activity.

[0099] In step three of this embodiment, the Matcher module first filters the Smali file code paths corresponding to the components based on the component information parsed by the Parser and the decompiled Smali code set. Then, it matches the extracted permissions with sensitive permissions, matches the Smali representations of sensitive permissions in the application with the code set, and filters the corresponding Smali file code paths. Next, it matches the Smali code set with the Smali representations in the Source sensitive API rules and the Sink sensitive API rules respectively to obtain the corresponding Smali file code paths. The Source sensitive API rules are APIs that obtain sensitive information from the user's address book, and the Sink sensitive API rules are APIs that leak information to the outside world. The specific rule definitions are as follows:

[0100] Source API rules:

[0101]

[0102] Sink API rules:

[0103]

[0104] The Sink sensitive API rules mainly target the following three types:

[0105] (1) Internet services

[0106] Sending data to the outside world via the network through Internet-related services, in the Android platform, mainly includes the HttpURLConnection method, HttpClient method, Volley method, WebSocket method, and OkHttp / OkHttp3 library;

[0107] (2) SMS service

[0108] Sending data to the outside world via SMS service on the Android platform mainly includes sending SMS messages using the sendTextMessage method in the SmsManager class or calling internal methods through reflection.

[0109] (3) External storage and logs

[0110] The system records users' private information while using the program and writes it to a log file. Malicious applications can then read this file and transmit the data to the outside world through methods such as SMS leaks and network leaks, causing privacy leaks. In the Android platform, this is mainly achieved by using the Log series methods, FileWriter methods, the combination of BufferedWriter and FileWriter, FileOutputStream methods, and OutputStream methods.

[0111] In step four of this embodiment of the invention, the Smali code set to be analyzed is transferred to the Builder module to construct a method call graph, which includes method call graph construction and ICC problem handling.

[0112] (1) Method call graph construction

[0113] First, extract the class name and the analyzed method name from the corresponding Smali file. When the method contains invoke-, use regular expressions to find the method pointed to by the method call instruction. Store the class name + method name as the key and the called method as the value in a hash table.

[0114] (2) ICC problem handling

[0115] In Android, when using the `setClass` method and instantiating an Intent with parameters, the calling and called components are typically passed as the second and third parameters, respectively, and finally passed through the `startActivity` method. When the back-analyzed instruction includes `Landroid / content / Intent; ->` <init>When Landroid / content / Intent;->setClass is called, forward analysis is performed to find the method name corresponding to the register at the second and third positions in the method call instruction. Then, the calling method is used as the key and the called method is used as the value and stored in the hash table.

[0116] The hash tables of the two processes mentioned above are merged, and then the graph is connected end-to-end through the GraphStream library, which is the method call graph.

[0117] In step four of this embodiment of the invention, a control flow graph is constructed based on the instruction sequence within the method in the smali code set using the CFG construction algorithm, such as... Figure 2 The Smali code instruction sequence is divided into labeled instructions and ordinary instructions. The algorithm continuously extracts instructions from the instruction sequence to generate nodes and generates edges from their predecessor nodes to their successor nodes. When a jump statement is analyzed, an edge is generated from the jump statement node to the node to be jumped to. To prevent duplicate edges and nodes, the algorithm checks the nodes and edges before generation. The processing of jump statement nodes is mainly divided into the following three categories:

[0118] (1) if type

[0119] For if type jump instructions, use whitespace characters as separators. When the if instruction ends with 'z', extract the second parameter after the instruction as the jump address; otherwise, extract the third parameter after the instruction as the jump node.

[0120] (2) goto type

[0121] For goto type jump instructions, separate them by whitespace characters and extract the first parameter after the goto instruction as the jump node;

[0122] (3) Packed-switch type

[0123] For jump instructions of type packed-switch, separate them by whitespace characters, extract the label parameter at the second position after the packed-switch instruction, then read the instruction position where the label parameter is located, read the label nodes between .packed-switch and .endpacked-switch in the next line, generate these nodes and generate the edges of the jump instructions to these nodes in sequence.

[0124] In step five of this embodiment of the invention, the constructed CG and CFG are input into the STA module to trace the taint registers according to the taint analysis propagation algorithm and data flow equation. This mainly includes three parts:

[0125] (1) Data Stream Entity Recognition

[0126] For the data stream entity to be analyzed for taint propagation, i.e., the registers in the method, `.registersLength` stores the number of registers in that method as `registersLength`. Under `.registers`, all formal parameters used by functions in `.param` are declared. The formal parameter value can be obtained by calculating the number of parameter registers, denoted as `parameterRegistersLength`. The number of local registers is calculated differently for static and non-static methods:

[0127] When a function's .method class contains the static identifier, localRegistersLength = registersLength - parameterRegistersLength. LocalRegistersLength is denoted as l1, and parameterRegistersLength as l2, generating a local register array of length l1. and a parameter register array of length l2

[0128] When the `.method` attribute of a function does not contain the `static` flag, `localRegistersLength = registersLength - parameterRegistersLength - 1`, `l_1 = localRegistersLength`, and `l2 = parameterRegistersLength + 1`, and corresponding local register arrays are generated respectively. and parameter register array

[0129] In Smali code, when only `.registers` is declared without `.param`, a local array of length `registersLength` and a formal parameter set `V = {v1, v2, ..., v...}` are generated. registersLength } and P = {p1, p2, ..., p registersLength }

[0130] (2) Data Flow Equations

[0131] In CFG, a sequence of tainted registers before and after each instruction node is generated, representing the pre-execution and post-execution phases. First, let's explain some function definitions:

[0132]

[0133]

[0134]

[0135]

[0136] Its `TaintedGen` generates tainted registers, `TaintedKill` ​​deletes tainted registers, `TaintedIn` is the sequence of tainted registers before node execution, and `TaintedOut` is the sequence of tainted registers after node execution. Different `TaintedGen` and `TaintedKill` ​​methods are executed for different Smali instruction types, according to the following rules:

[0137]

[0138] (3) Imperfection propagation algorithm

[0139] The taint propagation algorithm tracks taint registers by combining data flow equations and outputs the taint propagation sequence, such as... Figure 3 This includes the following steps:

[0140] Step 1: Before execution begins, initialize an empty method call stack (callStack), a method call sequence (visitedMethodList), a CG node set (W), a visited method node set (visitedMethods), an empty control flow graph set (M) (used to store the generated control flow graph), and a location set containing all Source API locations parsed by the Parser, where location := {loc1, loc2, ..., loc...} n }, each loc i Indicates the location of each leaked source;

[0141] Step 2, iterate through each loc i During iteration, obtain the loc value. i The corresponding register assigned by the Source API is then used to trace the tainted data stream of that register;

[0142] Step 3: When tracing tainted data flow, first determine whether the current method belongs to visitedMethods. If so, return. Otherwise, add the current method to the sequence of visited methods and construct the control flow graph of the current method based on the control flow graph.

[0143] Step 4: Traverse each instruction node in the control flow graph. When selecting a node to traverse, if there is only one outgoing edge, select the node pointed to by the outgoing edge. When there are two outgoing edges, if the number of visited nodes in the pointed-to nodes is 1, backtrack to the visited node and delete the edge from that node to the visited node; if the number of visited nodes in the pointed-to nodes is 0, select the non-labeled node from the two nodes to traverse. After selecting the node, determine the node type.

[0144] Step 5: Based on Step 4, when the instruction node is a method call instruction, extract the method pointed to by that node, extract the register passed to the instruction, find the intersection of the passed register and the tainted register, and push the current control flow graph onto the call stack when the intersection is not empty. Then, recursively execute Step 3, passing the tainted register and the called method. After the recursive execution ends, pop the call stack and generate the registers before and after the instruction node and the tainted register according to the following sequence: TaintedIn(s):=∩ s'∈pred(s) TaintedOut(s'); TaintedOut(s) := TaintedGen(s)∪TaintedIn(s)-TaintedKill(s)), after execution, return to step four;

[0145] Step six, based on step four, when the instruction node is a sink node, set the sink register as the register for instruction assignment, and execute the following sequence to generate the registers before and after the instruction node and the tainted register, TaintedIn(s): = ∩ s'∈pred(s) Taintedout(s'); TaintedOut(s) := TaintedGen(s) ∪ (TaintedIn(s) - TaintedKill(s)), after generation, take the intersection of the tainted register and the tainted register before the execution of the instruction. If the set is not empty, return the tainted method call sequence; otherwise, return to step four.

[0146] Step six, based on step four, if the instruction node is not in steps five and six, execute the following sequence: TaintedIn(s): = ∩ s'∈pred(s) TaintedOut(s'); TaintedOut(s) := TaintedGen(s) ∪ (TaintedIn(s) - TaintedKill(s)), and after execution, return to step four.

[0147] In addition, this application also provides an application-level byte-level Android application privacy leakage detection system and system virtualization software, including interconnected microprocessors and memory, wherein the microprocessors are programmed or configured to execute the aforementioned byte-level Android application privacy leakage static detection method.

[0148] This application embodiment also provides a storage medium storing a computer program, which, when run on a computer, causes the computer to execute the above-described byte-level Android application privacy leakage static detection method.

[0149] This application embodiment also provides a computer device, including a general-purpose memory and a processor. The memory is electrically connected to the processor, and the memory stores a computer program. The processor executes the above-described byte-level Android application privacy leakage static detection method by calling the computer program stored in the memory.

[0150] It should be noted that the byte-level static privacy leakage detection method for Android applications employed in this invention extracts and parses the four major components and permission-related information from a packaged APK file. The parsed information is then compared with Source and Sink rules using a Matcher to narrow down the scope of the Smali code to be analyzed. The method call graph and control flow graph within the Smali code to be analyzed are constructed to resolve issues between ICC components. The constructed CG and CFG are then analyzed using data flow equations and taint analysis propagation algorithms to obtain privacy leakage detection results. This invention effectively ensures code coverage while improving operational efficiency and analysis accuracy. It also provides a bridge for dynamic and static taint analysis.

[0151] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0152] II. Application Examples. To demonstrate the inventiveness and technical value of the present invention, this section provides application examples of the technical solution on specific products or related technologies.

[0153] This invention performs vulnerability mining on the standard APK set of Droidbench 2.0. First, the invention reads the APK program according to the path, then automatically unpacks it, extracting the Dex file and AndroidManifest.xml file. The Dex file is then decompiled into a Smali file. Next, the data is input into the parsing module to parse the AndroidManifest.xml file, extracting information on the four main components and related static registration permission information. In the comparison module, the static registration permission information is compared with sensitive permissions, the Source sensitive API rules and Sink sensitive API rules are compared with the Smali file, and the information on the four main components is compared with the content of the Smali file, narrowing down the scope of analysis and extracting the path of the Smali file to be analyzed.

[0154] After the comparison is completed, the method call instruction characteristics of all Smali files to be analyzed are analyzed, and the inter-method CG and intra-method CFG are constructed. At the same time, the CG is modified according to the characteristics between components to generate CG with inter-component edges.

[0155] Finally, after the construction is complete, the taint propagation algorithm traverses each node of the CG and each node of the CFG, starting from the initial method. Recursion is used between methods, while non-recursion is used within each method to generate the pre-instruction taint register sequence and the post-instruction taint register sequence for each node according to the taint data flow equation. The presence of privacy information leakage vulnerabilities is detected by checking whether there is data flow from the Source node to the Sink node.

[0156] III. Evidence of the Relevant Effects of the Embodiments. The embodiments of the present invention have achieved some positive effects during research and development or use, and indeed possess significant advantages compared to existing technologies. The following description, in conjunction with data, charts, and other materials from the experimental process, illustrates these advantages.

[0157] This invention designs Source sensitive permission rules, Source sensitive API rules, and Sink sensitive API rules. Through a comparison module, it compares the Smali file set with these rules and compares the Smali files with the four major component information parsed from the AndroidManifest.xml file, narrowing the scope of analysis. This ensures code coverage while avoiding incomplete analysis; that is, while narrowing the analysis scope, it maximizes coverage of the tainted data flow propagation path, thus improving analysis efficiency. It proposes a Smali Call Graph (CG) construction method and a Smali Control Flow Graph (CFG) construction method, addressing the ICC data flow propagation problem in Smali bytecode analysis. This solves the flow sensitivity problem and the ICC problem, ensuring the accuracy of Smali code modeling. It proposes a tainted data flow equation and a tainted propagation algorithm. Combining these two, the tracing module detects sensitive data flow leakage, ensuring the accuracy of tainted data flow detection. It also provides an interface for combining with dynamic analysis techniques to improve accuracy, exhibiting scalability.

[0158] Based on experimental test results, the system can effectively automate the entire analysis process, including decompilation, parsing, comparison, construction, and tracing modules, outputting the analysis process and results to the console. Testing showed that the average analysis time for a 6.5MB application was 17,486 milliseconds, a 243.13% improvement in time efficiency compared to the 60,000 milliseconds required for a single application analysis by T-Recs and TaintDroid.

[0159] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.< / init>

Claims

1. A static detection method for privacy leaks in byte-level Android applications, characterized in that, Includes the following steps: Step 1: Extract AndroidManifest.xml and Dex files from the Android APK file, and decompile the Dex file to generate the Smali file set to be analyzed; Step two: The Parser module parses the four main components and permission information from the AndroidManifest. Step 3: The Matcher module matches the Smali code set based on the parsed component information and permission information. It compares the parsed permissions with sensitive permission rules and matches them with the Smali code. It also matches the Smali code with Source sensitive API rules and Sink sensitive API rules to narrow down the scope of the Smali code set to be analyzed. Source sensitive API rules are APIs that obtain sensitive information from the user's address book, and Sink sensitive API rules are APIs that leak information to the outside world. Step 4: The Smali code set to be analyzed is transferred to the Builder module. Based on the Smali method call instructions and the characteristics of data transfer between Smali components, a call graph between methods is constructed. Based on the Smali control flow graph construction algorithm, a control flow graph between instruction nodes within the method is constructed. Step 5: Input the constructed call graph and control flow graph into the STA module. Based on the taint analysis propagation algorithm and taint register data flow equation, complete the tracing of taint marker registers. When a leak exists, output the method call sequence. In step one, the input APK file is decompressed, and the AndroidManifest.xml file and Dex type files ending with the .dex suffix are extracted from it; the Dex file is decompiled using baksmali.jar, the decompiled file is output to the specified path, and the AndroidManifest.xml file is converted into an AndroidManifest.txt file using AXMLPrinter.jar; In step two, the Parser module extracts information about the four major components from the AndroidManifest.xml file based on the tag values ​​activity, service, receiver, and provider. It also extracts the permission information involved in the APK based on the tag value uses-permission. Finally, it compares the android:name parameter in the action tag of the intent-filter tag under the activity tag with android.intent.action.MAIN to extract the application's entry activity. In step three, the Matcher module first filters the Smali file code paths corresponding to the components based on the component information parsed by the Parser and the decompiled Smali code set. Then, it matches the extracted permissions with sensitive permissions, matches the Smali representation of the sensitive permissions in the application with the code set, filters the corresponding Smali file code paths, and then matches the Smali code set with the Smali representation in the Source sensitive API rules and Sink sensitive API rules respectively to obtain the corresponding Smali file code paths. In step four, a control flow graph is constructed based on the instruction sequence within the method in the Smali code set using a control flow graph construction algorithm. The instruction sequence within the method in the Smali code set is divided into labeled instructions and ordinary instructions. The control flow graph construction algorithm continuously extracts instruction generation nodes from the instruction sequence and generates edges from their predecessor nodes to their successor nodes. When a jump statement is analyzed, an edge is generated from the jump statement node to the node to be jumped to. In step five, the constructed call graph and control flow graph are input into the STA module to trace the tainted registers according to the taint analysis propagation algorithm and data flow equations.

2. The byte-level Android application privacy leakage static detection method according to claim 1, characterized in that, In step four, the Smali code set to be analyzed is transferred to the Builder module to construct the method call graph, which includes method call graph construction and handling of inter-component communication issues.

3. A byte-level Android application privacy leakage static detection system implementing the byte-level Android application privacy leakage static detection method as described in any one of claims 1-2, characterized in that, The byte-level Android application privacy leakage static detection system includes: The decompilation module is used to extract AndroidManifest.xml and Dex files from Android APK files, and decompile the Dex files to generate a set of Smali files to be analyzed; The parsing module is used by the Parser module to parse the four main components and permission information from the AndroidManifest. The comparison module is used by the Matcher module to match the Smali code set with the parsed component information and permission information. It compares the parsed permissions with sensitive permission rules and matches them with the Smali code; it also matches the Smali code with Source sensitive API rules and Sink sensitive API rules to narrow down the range of Smali code sets to be analyzed. The Builder module is used to construct the call graph between methods based on the Smali code set to be analyzed and the characteristics of data transfer between Smali components, and to construct the control flow graph between instruction nodes within the method based on the Smali control flow graph construction algorithm. The tracing module is used to input the constructed call graph and control flow graph into the STA module to complete the tracing of taint marker registers based on the taint analysis propagation algorithm and taint register data flow equation. When a leak exists, it outputs the method call sequence.

4. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, causes the processor to perform the steps of the byte-level Android application privacy leakage static detection method as described in any one of claims 1-2.

5. A computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the byte-level Android application privacy leakage static detection method as described in any one of claims 1-2.

6. An information data processing terminal, characterized in that, The information data processing terminal is used to implement the byte-level Android application privacy leakage static detection system as described in claim 3.

Images