A method for extracting mobile application network information based on heuristic dynamic analysis

Abstract

The present invention discloses a method for extracting network information of mobile applications based on heuristic dynamic analysis, and belongs to the field of network information security technology. The present invention solves the problem that it is difficult for traditional dynamic network analysis methods and static network analysis methods in the prior art to fully extract effective network feature information for APPs; the present invention obtains program source code by reverse engineering the apk file of the application to be analyzed, traverses the key positions related to network information in the obtained reverse results, extracts and outputs static heuristic information and static network feature data; generates original traffic based on random action clicks and control coordinates, and realizes real-time decryption of common protocol traffic through an agent-based method, extracts relevant protocol feature parameters in plaintext and ciphertext traffic to obtain dynamic network feature data, cleans static network string variable results and dynamic network analysis results, and outputs the final results. The present invention effectively improves the efficiency of traffic generation and analysis, and can be applied to APP testing.

Description

Technical Field

[0001] The present invention relates to a method for extracting mobile application network information, and in particular to a method for extracting mobile application network information based on heuristic dynamic analysis, and belongs to the technical field of network information security. Background Art

[0002] In the open environment of the Android operating system, users can freely install applications from various application stores and the Internet. However, the above-mentioned open characteristics do not impose too many restrictions and audits on the sources of applications. When users install applications, their security and reliability are often not guaranteed. For ordinary users, they basically do not have the ability to identify malicious behavior based on usage experience and security common sense. In the process of malicious behavior interaction, disguised communications such as overseas servers or malicious application servers often appear. Therefore, it is crucial for application managers and security analysts to analyze and monitor the network information of different functions of existing applications and make a rough assessment of application behavior based on such information.

[0003] In response to the above problems, the prior art generally uses multiple methods to test existing applications to evaluate their security, obtain the main functional content of the application and the network communication targets of each function, and detect the server address and network information corresponding to each function of the application; testing of mobile applications is divided into manual testing and automated testing. During manual testing, testers interact with the system as terminal users and interact with different functions in the system to obtain detailed security information of the application, and analyze the test results through appropriate methods. In automated testing, testers can write various test scripts or automated programs to find hidden relationships and detect all network information.

[0004] In the process of mobile application network information assessment, if the manual testing method is used, the security tester must download the application from the market and install it on the mobile device, use the mobile application for a long time and start the corresponding network analysis tool to obtain and analyze the network information of the mobile application service. However, more problems may arise in the process of manual testing. For example, the workload of manually analyzing a large number of APPs is large, which includes a series of cumbersome processes from registering an account to waiting for the application to be successful, then logging in and finally using it. In the analysis process, necessary information needs to be recorded, such as the main functions of the page, the characteristics of the application communication, and the corresponding packet capture tools are needed to capture and extract the application's traffic information. At the same time, manual testing requires a lot of manpower costs and has low reliability. Due to possible human errors, it is difficult to perform the test accurately every time, and the testing process is relatively inefficient. In addition, the application content will change with the update of the version. The content that has been tested before will also change accordingly after the subsequent version update. Under this premise, it is difficult to obtain the main network information of the APP through manual testing.

[0005] For the current automated testing of mobile applications, the key method of implementation is to test the application through static or dynamic clicks. At the same time, there are also some automated tests that combine the characteristics of static analysis and dynamic analysis methods to analyze APP features. However, the research goals of the above main testing methods are to observe whether the application can run stably during use, conduct real-time testing on possible problems in the software development process, and focus on the UI information and bug information of the page. There is a lack of mobile security testing tools for traffic and network information content extraction during the operation of mobile applications. Therefore, it is difficult to meet the automatic analysis needs of mobile application network information.

[0006] In this context, the present invention realizes the automatic extraction and analysis of network information of application functions through static reverse analysis or dynamic traffic automatic generation technology according to different analysis needs, and provides heuristic guidance for page clicks in the dynamic traffic generation process based on the application network information extracted by static analysis. In the process of APP dynamic analysis, the plaintext and ciphertext traffic obtained by application page exploration are combined to extract and analyze the effective information, ensuring the comprehensiveness of the results, and providing a technical feasibility basis for subsequent application behavior and threat information detection.

[0007] The current commonly used static analysis or dynamic analysis methods for extracting network feature information of APPs have the following problems:

[0008] 1. The effective information obtained during static network analysis is limited. The current mainstream method can only obtain static strings containing characteristic strings http or https, mainly including URLs and IP addresses, but lacks the acquisition of some special strings. There will be problems such as incomplete analysis results, failure to extract key IP information, and a large amount of junk data and duplicate data in the results. In addition, there is a lack of effective in-depth mining and utilization of statically written network information.

[0009] 2. The main problems with dynamic network analysis are low efficiency and few implementation methods. The main research focus of dynamic analysis test methods is to observe whether the application can run stably during use and analyze the UI information and bug information of the page. There are few mobile security testing tools for traffic and network. Existing testing tools often lack targetedness, low efficiency, and incomplete results when analyzing the network. There is also a lack of effective static information on the APP and the combination of encrypted traffic and plaintext. It is difficult to automatically obtain effective network information and targeted dynamic clicks and traffic generation for the APP as comprehensively as possible within a limited time.

[0010] In summary, there is a need for a mobile application network information extraction method that can automatically obtain valid network information, has complete analysis results, and eliminates duplicate and invalid data. Summary of the invention

[0011] A brief overview of the present invention is provided below in order to provide a basic understanding of certain aspects of the present invention. It should be understood that this overview is not an exhaustive overview of the present invention. It is not intended to identify key or important parts of the present invention, nor is it intended to limit the scope of the present invention. Its purpose is merely to present certain concepts in a simplified form as a prelude to a more detailed description discussed later.

[0012] In view of this, in order to solve the problem that traditional dynamic network analysis methods and static network analysis methods in the prior art are difficult to fully extract effective network feature information for APP, the present invention provides a mobile application network information extraction method based on heuristic dynamic analysis.

[0013] The technical solution is as follows: A method for extracting mobile application network information based on heuristic dynamic analysis, comprising the following steps:

[0014] S1. Input the name of the application to be analyzed and perform static network analysis on it, that is, reverse the apk file of the current application to obtain the program source code, traverse the key positions of the obtained reverse results, match the feature strings, and output the static network string variable results and static heuristic information;

[0015] S2. Perform dynamic network analysis on the application name to be analyzed, use the static heuristic information obtained from static analysis to generate traffic based on random actions and control coordinates, and obtain the original traffic ciphertext through automatic clicking;

[0016] S3. During the automatic clicking process, the original traffic ciphertext is decrypted in real time by setting up a middleman proxy method to obtain the traffic plaintext, and the original traffic ciphertext and traffic plaintext are analyzed by the feature extraction module at the same time to obtain the dynamic network analysis results;

[0017] S4. Perform data cleaning on the static network string variable results and dynamic network analysis results, and output the final results.

[0018] Furthermore, in S1, the static heuristic information mainly includes the function page for calling network-related variables. For static network analysis, the apk file is decoded by an existing reverse analysis tool to obtain the apk reverse result, and then the main types of code files in the apk reverse result engineering folder are matched and searched by regular expressions. Two types of results are obtained in the matching process, namely, static network string variables and static heuristic information required in the dynamic network analysis process;

[0019] In the process of obtaining the static network string variable results, the matched network information includes IP address, URL address, SNI address, Host address, network function and network library. The obtained static network string variable results are cleaned and the invalid information that meets the regular expression is deleted.

[0020] In the process of obtaining static heuristic information, the matched network information includes IP address, URL address, SNI address, Host address and the calling file where the caller of the network-related function is located.

[0021] Furthermore, in S2, the files with network behaviors and their corresponding interfaces are determined by extracting static heuristic information, and all controls on the current page are traversed by clicking through a traffic generation method based on random actions or a breadth-first traffic generation method based on control coordinates. The original traffic ciphertext captured by the device is obtained by an automated script while automatically clicking. After the current page is clicked, other interfaces with network behaviors are traversed for analysis.

[0022] Furthermore, in the S3, the automated script starts the traffic capture module while automatically clicking to obtain the traffic plaintext restored in real time based on the middleman agent, and extracts and combines the original traffic ciphertext and the real-time restored traffic plaintext with the APP-related protocol types and the valid network information types in the traffic plaintext through the parsing tool, records the commonly used transmission data types and requested network APIs in the traffic plaintext, and outputs them as the result of dynamic analysis.

[0023] Furthermore, the breadth-first traffic generation method comprises the following steps: setting the APP name and the number of click layers, the number of click layers comprising the number of breadth-first click layers and the number of depth-first click layers, after starting the APP and entering a new page, giving priority to clicking on unclicked controls, obtaining the coordinates of clickable controls in the page, and storing the hash value result of the current page position coordinate information;

[0024] After clicking to enter a new page, determine whether the current page has ended or reached the predetermined click depth. If the condition is met, return to the previous page. Otherwise, continue to click the unfinished button and increase the current page level by one layer.

[0025] If returning to the previous layer, it is necessary to determine whether the current page is the starting point of the page corresponding to the current network behavior. If it is the homepage of the page corresponding to the current network behavior and all clicks are completed, slide the current page down and click the coordinates of the unclicked controls. Repeat the above operations to make as many controls in the current page as possible be clicked;

[0026] If you enter a new page, continue to click or slide as described above to traverse the page content until the preset sliding depth is reached and all controls on the current page are clicked.

[0027] The beneficial effects of the present invention are as follows: the present invention optimizes the traditional mobile application network analysis method, and can extract effective information from the static reverse results of the APP to inspire the dynamic exploration process, so that the analysis details are more comprehensive and the efficiency of traffic generation is improved; the traffic generated by dynamic clicks, that is, dynamic network analysis, can also be processed to provide certain guidance for judging the code structure function of static network analysis; in the dynamic click process, the method of restoring plaintext by a middleman agent is combined to automatically parse and extract effective data from the plaintext and ciphertext content, so that the results of mobile application network information extraction are more comprehensive and specific than the existing methods; the present invention combines the characteristics of static analysis and dynamic analysis, and can provide corresponding solutions according to the different needs and scenarios of analysts, thereby realizing the automatic detection and analysis of the network service subject of the mobile application and improving the efficiency of traffic generation and analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0029] Figure 1 It is a flowchart of a method for extracting network information of mobile applications based on heuristic dynamic analysis;

[0030] Figure 2A schematic diagram of a flow chart of a dynamic network analysis embodiment;

[0031] Figure 3 A schematic diagram of a flow chart of an embodiment of a breadth-first random traffic generation method;

[0032] Figure 4 The figure is a flowchart of the dynamic plaintext and ciphertext data flow analysis method and content extraction. DETAILED DESCRIPTION

[0033] In order to make the technical solutions and advantages of the embodiments of the present invention more clearly understood, the exemplary embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than an exhaustive list of all the embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0034] refer to Figure 1-4 The present embodiment is described in detail, a method for extracting mobile application network information based on heuristic dynamic analysis, specifically comprising the following steps:

[0035] S1. Input the name of the application to be analyzed and perform static network analysis on it, that is, reverse the apk file of the current application to obtain the program source code, traverse the key positions of the obtained reverse results, match the feature strings, and output the static network string variable results and static heuristic information;

[0036] S2. Perform dynamic network analysis on the application name to be analyzed, use the static heuristic information obtained from static analysis to generate traffic based on random actions and control coordinates, and obtain the original traffic ciphertext through automatic clicking;

[0037] S3. During the automatic clicking process, the original traffic ciphertext is decrypted in real time by setting up a middleman proxy method to obtain the traffic plaintext, and the original traffic ciphertext and traffic plaintext are analyzed by the feature extraction module at the same time to obtain the dynamic network analysis results;

[0038] S4. Perform data cleaning on the static network string variable results and dynamic network analysis results, and output the final results;

[0039] Specifically, the main work of the present invention is to obtain and analyze resources in the mobile application network communication process, and the resources are as follows:

[0040] (1) URL (Uniform Resource Locator): A URL is a string used to identify and locate resources. Mobile applications use URLs to indicate the location of the resource to be requested.

[0041] (2) IP address (Internet Protocol address): An IP address is a digital label that uniquely identifies a device at the network layer;

[0042] (3) SNI (Server Name Indication): SNI is an extension of the TLS / SSL protocol and is used to specify the host name of the server to be connected when establishing an encrypted connection;

[0043] (4)Host: Host is a header field in the HTTP protocol, which is used to specify the host name of the server to be accessed;

[0044] The present invention uses static analysis and dynamic analysis in the analysis process. For static analysis of mobile applications, the current main work is to identify the characteristic strings and code structures of the application to analyze the application's usage behavior and some running characteristics without running the code. As a mobile security testing method, static analysis can be used to perform comprehensive security testing and evaluation of Android programs. Commonly used static analysis tools have been integrated into a variety of common mobile security testing tools and technologies, which can quickly and accurately discover and analyze security issues and vulnerabilities in applications;

[0045] Dynamic reverse analysis technology for mobile applications is a technology that monitors the internal running status and behavior of a program to discover problems, vulnerabilities, and security risks. It usually includes steps such as reverse engineering, setting breakpoints, running the program, and implementing tracking behavior. Since the program is actually run, dynamic reverse analysis technology can have a more comprehensive understanding of the program's behavior and status compared to static analysis technology, and can discover more problems and vulnerabilities. Dynamic reverse analysis technology plays an important role in ensuring software security and performance.

[0046] Furthermore, in S1, the static heuristic information mainly includes the function page for calling network-related variables. For static network analysis, the apk file is decoded by an existing reverse analysis tool to obtain the apk reverse result, and then the main types of code files in the apk reverse result engineering folder are matched and searched by regular expressions. Two types of results are obtained in the matching process, namely, static network string variables and static heuristic information required in the dynamic network analysis process;

[0047] In the process of obtaining the static network string variable results, the matched network information includes IP address, URL address, SNI address, Host address, network function and network library. The obtained static network string variable results are cleaned and the invalid information that meets the regular expression is deleted.

[0048] In the process of obtaining static heuristic information, the matched network information includes IP address, URL address, SNI address, Host address and the calling file where the caller of the network-related function is located;

[0049] Specifically, in the static network analysis, i.e. the static click phase, there are certain differences in the file types targeted during the matching process of the APP code obtained by different reverse tools. Taking the static engineering file obtained by the apktool tool as an example, the code of file types such as smali, txt, json, xml, and js are mainly matched;

[0050] Decoding the apk file can get the entire code of the APP. When a network information declaration appears in the code, a related network connection usually appears during the operation of the variable-related call page. Therefore, by analyzing the file location, it can be determined which page and which function called the network function to generate the corresponding traffic. Then, in the dynamic network analysis process, the above pages are analyzed in detail to avoid spending more time on click detection on some irrelevant pages. The results obtained by static analysis can be verified through dynamic analysis to extract the network features and behaviors related to the current static information. For example, in which network activity is the static analysis network address obtained to connect to generate traffic?

[0051] In the smali files obtained by reverse engineering of Android, taking http as an example, related requests mainly exist in the following network-related functions: HttpHost, HttpPost, HttpGet, HttpPut, HttpDelete, NameValuePair and HttpRequestBase, etc. In addition, there are other libraries and classes. For example, OkHttp and Retrofit can also be used for network communication in Android applications. After locating the file location where the above functions or static network string variables appear and the location of the caller, subsequent processing can be used to determine the functions with network activities and their corresponding Activities, and jump to the corresponding interface to generate the required traffic.

[0052] Furthermore, in S2, the files with network behaviors and their corresponding interfaces are determined by extracting static heuristic information, and all controls on the current page are clicked and traversed through a traffic generation method based on random actions or a breadth-first traffic generation method based on control coordinates. The original traffic ciphertext captured by the device ciphertext is obtained by an automated script while automatically clicking, and after the current page is clicked, other interfaces with network behaviors are traversed for analysis; specifically, while obtaining the static heuristic information, the file location information corresponding to a function or URL can also be obtained, and each variable or function is extracted, and the relationship between it and the Activity is called, and the Activity and page to which each file with network calls, i.e., network behaviors, belongs are analyzed;

[0053] In Android, there is a one-to-one or one-to-many relationship between Activity and page, that is, one Activity corresponds to one or more pages. You can directly jump to a page with a certain function by starting an Activity through the command line. After the page executes the relevant function, it often triggers the corresponding traffic. After determining the Activity to which the network information belongs, you can jump to its corresponding interface.

[0054] The correspondence between static heuristic information and activities and pages is mainly achieved by extracting keywords such as extends and interface to obtain the occurrence positions of the parent file of the current file or each function call, and traversing upward step by step until the name of an activity is included. At this point, the activity to which a file belongs and the page content can be basically determined. Then, the command to jump into an activity is executed through the command line script, and the related operations of automatic traffic generation are performed in combination with the page information.

[0055] In the process of automatic clicking, it is necessary to obtain the real-time generated network traffic for subsequent traffic content analysis. The encrypted generated traffic can be obtained through the packet capture command tcpdump or the packet capture program wireshark based on the hotspot connection. The automatic clicking and automatic packet capture are combined to realize automatic capture of traffic while clicking. Since the mobile phone has other system applications or some background applications running in addition to the current APP during the packet capture process, the traffic generated by them will affect the results. Therefore, the mobile terminal used to capture traffic can be left still for a period of time to generate system traffic. After generating enough time, the traffic generated by a certain APP is extracted and the traffic results generated by the system itself when no application to be tested is running are excluded. In this way, the traffic generated by the application is basically completely obtained, and the actual URL information, IP address, and SNI information of a certain APP are obtained.

[0056] refer to Figure 2 ,The dynamic network analysis is the heuristic dynamic clicking stage, and the ,extracted static heuristic information includes network function calling files, ,files where the calling network variables are located, static network ,variables files and network information reuse files;

[0057] Use random click methods to generate application traffic or use the Android automated testing framework UiAutomator to implement coordinate-based breadth-first traversal to generate traffic, and then use scripts to implement the automatic click exploration process of multiple APPs. In the process of automated traffic acquisition, configure the proxy tool mitmproxy in combination with the original ciphertext to achieve real-time restoration of ssl / tls ciphertext based on the proxy. Use the command line tcpdump to capture application data packets in real time, use the network packet parsing tool scapy to parse the obtained plaintext or ciphertext pcap packets, and output the final dynamic network analysis results.

[0058] Furthermore, in S3, the automated script starts the traffic capture module while automatically clicking to obtain the traffic plaintext restored in real time based on the middleman proxy through methods such as pre-certificate configuration, extracts and combines the protocol types related to the APP in the original traffic ciphertext and the real-time restored traffic plaintext and the valid network information types in the traffic plaintext through the parsing tool, records the commonly used transmission data types and request network APIs in the traffic plaintext, and outputs them as the result of dynamic analysis;

[0059] Specifically, in addition to obtaining the original traffic ciphertext, the present invention also restores the plaintext in the click process, automatically clicks to capture the encrypted traffic, i.e., the original traffic ciphertext, and realizes real-time restoration and analysis of the plaintext based on the proxy plug-in, so as to ensure the comprehensiveness of the final traffic result, i.e., the extracted network feature data, and extract the effective information of the plaintext corresponding to the traffic. Since most of the traffic in current mobile applications is encrypted traffic, decryption analysis of the ciphertext can effectively supplement the output result. The specific implementation method is to realize real-time restoration of the encrypted traffic plaintext through a tool based on a proxy middleman combined with a click system. The plug-in based on the proxy middleman needs to add the certificate of the mobile terminal during use. The plaintext data packet finally obtained will be stored in the PC or mobile terminal that controls the Android machine. The obtained plaintext and ciphertext are parsed through the pcap package to realize automatic restoration and content acquisition of various traffic. The analysis mainly extracts the original HTTP traffic and the decrypted HTTP traffic, the content of the HTTPS and DNS protocols, the SNI requested in the handshake phase of the TLS / SSL protocol, and the IP addresses of all traffic.

[0060] refer to Figure 4, during the traffic generation click operation, the original traffic and the traffic plaintext information based on proxy decryption are obtained. The valid information in the original traffic includes all URL, Host, and API information in the HTTP request and response, A record and CNAME record in the DNS resolution process, SNI information of the TLS / SSL protocol, and IP address information of all original traffic. The valid information in the traffic plaintext based on proxy decryption includes all URL, Host, and API network information in the request (request) and response (response) obtained by decryption of the HTTPS protocol. Dynamic traffic ciphertext feature extraction is performed on the original traffic ciphertext, and traffic decryption plaintext feature extraction is performed on the traffic plaintext based on proxy decryption to obtain the dynamic analysis result output.

[0061] Furthermore, the breadth-first traffic generation method comprises the following steps: setting the APP name and the number of click layers, the number of click layers comprising the number of breadth-first click layers and the number of depth-first click layers, after starting the APP and entering a new page, giving priority to clicking on unclicked controls, obtaining the coordinates of clickable controls in the page, and storing the hash value result of the current page position coordinate information;

[0062] After clicking to enter a new page, determine whether the current page has ended or reached the predetermined click depth. If the condition is met, return to the previous page. Otherwise, continue to click the unfinished button and increase the current page level by one layer.

[0063] If returning to the previous layer, it is necessary to determine whether the current page is the starting point of the page corresponding to the current network behavior. If it is the homepage of the page corresponding to the current network behavior and all clicks are completed, slide the current page down and click the coordinates of the unclicked controls. Repeat the above operations to make as many controls in the current page as possible be clicked;

[0064] If you enter a new page, continue to click or slide as above to traverse the page content until the preset sliding depth is reached and all controls on the current page are clicked;

[0065] Specifically, refer to Figure 3, the number of layers of breadth-first click is set to one layer. In order to ensure that the number of layers of click coverage is greater than five layers when the number of layers is depth-first clicked, the coordinates of unclicked controls are clicked first. The Android automated testing framework UiAutomator obtains page information and extracts valid information, that is, the bounds information in UiAutomator is filtered out, and the page hash value results are stored and clicked in sequence to determine whether the current page has ended or reached the predetermined depth. If so, return to the previous page. If not, continue to click the unfinished button, that is, the control, and the number of layers increases by one layer to determine whether the current page is the home page. If so, complete the current home page search. If not, continue to click the unfinished button and reduce the number of layers by one. When the current home page search is completed, slide to generate new unclicked coordinates, and finally complete the dynamic click of the current APP;

[0066] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative, not restrictive, with respect to the scope of the present invention, which is defined by the appended claims.

Claims

1. A method for extracting mobile application network information based on heuristic dynamic analysis, characterized in that: The following steps are involved: S1. Input the name of the application to be analyzed and perform static network analysis on it, that is, reverse the apk file of the current application to obtain the program source code, traverse the key positions of the obtained reverse results, match the feature strings, and output the static network string variable results and static heuristic information; S2. Perform dynamic network analysis on the application name to be analyzed, use the static heuristic information obtained from static analysis to generate traffic based on random actions or control coordinates, and obtain the original traffic ciphertext through automatic clicking; S3. During the automatic clicking process, the original traffic ciphertext is decrypted in real time by setting up a middleman proxy method to obtain the traffic plaintext, and the original traffic ciphertext and traffic plaintext are analyzed by the feature extraction module at the same time to obtain the dynamic network analysis results; S4. Perform data cleaning on the static network string variable results and dynamic network analysis results, and output the final results; In S1, the static heuristic information includes a function page that calls network-related variables. For static network analysis, the apk file is decoded by an existing reverse analysis tool to obtain the apk reverse result, and then the main types of code files in the apk reverse result engineering folder are matched and searched by regular expressions. Two types of results are obtained in the matching process, namely, static network string variables and static heuristic information required in the dynamic network analysis process; In S2, the files with network behaviors and their corresponding interfaces are determined by extracting static heuristic information, and all controls on the current page are traversed by clicking through a traffic generation method based on random actions or a breadth-first traffic generation method based on control coordinates. The original traffic ciphertext captured by the device ciphertext is obtained by an automated script while the click is automatically performed, and after the current page is clicked, other interfaces with network behaviors are traversed for analysis; In the S3, the automated script starts the traffic capture module while automatically clicking to obtain the traffic plaintext restored in real time based on the middleman agent, and extracts and combines the original traffic ciphertext and the real-time restored traffic plaintext with the APP-related protocol types and the valid network information types in the traffic plaintext through the parsing tool, records the commonly used transmission data types and requested network APIs in the traffic plaintext, and outputs them as the result of dynamic analysis.

2. According to claim 1, a method for extracting mobile application network information based on heuristic dynamic analysis is characterized in that: In said S1, in the process of obtaining the static network string variable result, the matched network information includes IP address, URL address, SNI address, Host address, network function and network library, and the obtained static network string variable result is cleaned to delete the invalid information that conforms to the regular expression; In the process of obtaining static heuristic information, the matched network information includes IP address, URL address, SNI address, Host address and the calling file where the caller of the network-related function is located.

3. According to claim 2, a method for extracting mobile application network information based on heuristic dynamic analysis is characterized in that: The breadth-first traffic generation method comprises the following steps: setting an APP name and a click layer number, the click layer number comprising a breadth-first click layer number and a depth-first click layer number, and after starting the APP and entering a new page, giving priority to clicking on unclicked controls, obtaining the coordinates of clickable controls in the page, and storing a hash value result of the current page position coordinate information; After clicking to enter a new page, determine whether the current page has ended or reached the predetermined click depth. If the condition is met, return to the previous page. Otherwise, continue to click the unfinished button and increase the current page level by one layer. If returning to the previous layer, it is necessary to determine whether the current page is the starting point of the page corresponding to the current network behavior. If it is the homepage of the page corresponding to the current network behavior and all clicks are completed, slide the current page down and click the coordinates of the control that has not been clicked. Repeat the above operations to make the control in the current page be clicked; If you enter a new page, continue to click or slide as described above to traverse the page content until the preset sliding depth is reached and all controls on the current page are clicked.

Images