An Android application component analysis method based on configuration fuzzy matching

Abstract

The application discloses an Android application component analysis method based on configuration fuzzy matching. When mobile application software is analyzed, it is a time-consuming and laborious thing to extract third-party components. The application realizes static analysis on APK components and hard-coded key conditions by searching and extracting configuration files and codes which may appear SDK information and filtering the results based on feature library fuzzy matching.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network security, and particularly relates to an Android application component analysis method based on configuration fuzzy matching. BACKGROUND

[0002] Android third-party library is a toolkit developed by third-party service companies such as advertisers, payment companies, social platforms, push platforms and map service providers for the convenience of App developers to use their services, including advertising, payment, statistics, social, push, map and other categories. More and more Apps enrich their own functions by integrating third-party libraries. However, the introduction of third-party libraries may introduce security problems such as security vulnerabilities and privacy abuse while providing function support for Apps. Therefore, APP component analysis is increasingly valued by security researchers and software analysis institutions.

[0003] Currently, there are tools such as libradar, Literadar and Libscout based on multi-level clustering hash feature fingerprint library matching, which can identify some SDKs in the feature library. However, the above tools need a large number of samples for modeling, cannot detect unknown SDK information, and cannot extract version, developer key and other information.

[0004] Therefore, it is of great significance to design and implement a method that can quickly extract third-party library information and developer keys in Apps for software supply chain analysis. SUMMARY

[0005] The application aims at the deficiencies of the prior art, and provides an Android application component analysis method based on configuration fuzzy matching.

[0006] The application aims at the deficiencies of the prior art, and provides an Android application component analysis method based on configuration fuzzy matching.

[0007] (1) Preprocessing stage: decompressing the Android installation package, decompiling the dex bytecode, loading the keyword set S k , feature library S p and compiling version information cleaning regular set C v ;

[0008] (2) Configuration extraction stage: using the keyword set S k to extract information from the configuration file, decompiled source code and dynamic library, and obtaining the extracted information I;

[0009] (3) Data cleaning stage: using the feature library S pThe extracted information I is subjected to fuzzy matching, and filtering is performed according to the matching degree.

[0010] Further, in step (1), the feature library S p A suffix automaton of the fuzzy matching template set needs to be constructed so as to control the matching time within an acceptable range.

[0011] Further, the step (2) specifically comprises the following steps:

[0012] (2.1) using the keyword set S k Filter the configuration file, extract all SDK names and key names contained in the key-value pairs of the configuration file to form a set S: wherein x i represents any one SDK name, y i represents the key name corresponding to the SDK name, and all SDK versions contained in the key-value pairs of the configuration file are extracted as a set V dv : V dv = [v1…v j …v N ], wherein v j represents any one SDK version; all strings and integer references are obtained in this process and are dereferenced through the resource file;

[0013] Find the tag in the xml structure corresponding to each SDK name x i in the set S under the res / values folder, find the value corresponding to x i as the dereferenced name x i ′ by reading the attributes of the tag, and obtain the set V s : V s = [x′1 … x′ i … x′ N ];

[0014] Find the tag in the xml structure corresponding to each SDK version v dv in the set V j under the res / values folder, find the value corresponding to v j as the dereferenced version v′ j by reading the attributes of the tag, and obtain the set V v : V v = [v1′…v′ j …v′ N ];

[0015] (2.2) Traverse all public static String definition statements of the decompiled source code, extract the initialization value of the code coding of each public static String definition statement as a set V c ;

[0016] (2.3) Extract the library name, exported function and string information of the dynamic library as a set S d ;

[0017] (2.4) The extracted set S, set V dv , set V s , set V v , set V c and set S d are extracted as information I.

[0018] Further, the step (3) specifically comprises the following sub-steps:

[0019] (3.1) Remove meaningless results with the same SDK name and key name in set S, to obtain a cleaned set

[0020] (3.2) Perform fuzzy matching based on the longest common substring between set V s , set V c and set S d and feature library S p , and consider that the matching is successful when the matching length is greater than x characters or y% of the total length of the target string;

[0021] (3.3) According to the version information cleaning rule set C v , perform regular replacement on the field value of each dereferenced version in set V v to generate normalized version information.

[0022] Further, in step (1), the loaded compiled version information cleaning regular rule set C v is sourced from, but not limited to, Maven warehouse and national SDK management service platform, and the SDK name and manufacturer need to be converted into pinyin, English and English abbreviation respectively and added to the feature library.

[0023] The beneficial effects of the present application are:

[0024] 1) The SDK version information, developer identification and key information can be extracted;

[0025] 2) The SDK information of unknown feature library can be extracted. BRIEF DESCRIPTION OF DRAWINGS

[0026] Figure 1A method flow chart of an Android application component analysis method based on configuration fuzzy matching;

[0027] Figure 2 A flow chart of an Android application component analysis method based on configuration fuzzy matching;

[0028] Figure 3 A schematic diagram of an example of resolving AndroidManifest cross-references;

[0029] Figure 4 A schematic diagram of an example of extracting decompiled source code information. DETAILED DESCRIPTION

[0030] In order to make the objects, technical solutions and advantages of the present application clearer, further detailed description will be given to the present application in combination with the drawings and embodiments, and it should be understood that the specific embodiments described herein are only used to explain the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0031] The Android application component analysis method based on configuration fuzzy matching provided by the present application can effectively extract SDK name, version, developer key and other information by collecting APK configuration files, code hard-coded data and performing fuzzy matching with a feature library.

[0032] Embodiment 1

[0033] As shown in Figure 1 and Figure 2 , the present application provides an Android application component analysis method based on configuration fuzzy matching, comprising the following steps:

[0034] (1) Preprocessing stage: decompressing an Android installation package, decompiling dex bytecode, and loading a keyword set S k , a feature library S p and a compiled version information cleaning regular rule set C v .

[0035] In step (1), after loading the feature library S p , a suffix automaton of a fuzzy matching template set needs to be constructed so as to control the matching time within an acceptable range.

[0036] The construction algorithm pseudo code of the multi-template substring suffix automaton is as follows:

[0037] Input: T: all template strings

[0038] Output: AM: automaton for matching substring

[0039] M <- "$".join(T)

[0040] AM <- SuffirAutomaton.build(M)

[0041]

[0042] where T is all template strings, and AM is the built automaton.

[0043] (2) Configuration extraction phase: using a keyword set S k Extract information I from the configuration file, decompiled source code, and dynamic library.

[0044] This embodiment selects the case where the APP_KEY field in AndroidManifest.xml uses @strings for cross-referencing to introduce the dereferencing process, as shown in Figure 3 ; and selects an example of a code hard-coded version information to introduce information extraction, as shown in Figure 4 .

[0045] The step (2) specifically includes the following steps:

[0046] (2.1) Using a keyword set S k Filter the configuration file to extract all SDK names and key names contained in the key-value pairs of the configuration file to form a set S: where x i represents any SDK name, y i represents the key name corresponding to the SDK name, and all SDK versions contained in the key-value pairs of the configuration file are extracted as a set V dv : V dv = [v1…v j …v N ], where v j represents any SDK version; all string and integer references are obtained in this process and are dereferenced through resource files.

[0047] Find the tag in the xml structure corresponding to each SDK name x i in the set S under the res / values folder, find the value corresponding to x i as the dereferenced name x i ′ by reading the attributes of the tag, and obtain a set V s : V s = [x1′…x i ′…x′ N ].

[0048] And by searching for collection V in the res / values / folder dv Each SDK version v j The corresponding XML structure tags are found by reading the tag attributes. j The corresponding value is used as the dereferenced version v′ j The set V is obtained. v V v =[v1′…v′ j …v′ N ].

[0049] (2.2) Traverse all public static String definition statements in the decompiled source code and extract the initialization value of the code encoding of each public static String definition statement as a set V. c .

[0050] (2.3) Extract the library name, exported functions, and string information of the dynamic library as a set S. d .

[0051] (2.4) Extract the sets S and V. dv Set V s Set V v Set V c and set S d As extracted information I.

[0052] Following the method described in (2), in Figure 4 After detecting the `@strings` keyword, the `res / values / string.xml` file is parsed, and the value `B7BK6AFFFF6AKA` of the `si_appkey` field is substituted into the original key-value pair. Then, the value "OPPO" is extracted from the key name `OPPO_APP_KEY` and matched against the feature library. For Figure 4 In this case, after extracting the hard-coded version based on the variable name VERSION in the code segment, normalized output will be generated through regular expression replacement.

[0053] (3) Data cleaning stage: using feature library S p The extracted information I is subjected to fuzzy matching, and then filtered based on the degree of matching.

[0054] Step (3) specifically includes the following sub-steps:

[0055] (3.1) Remove meaningless results with the same SDK name and key name from set S to obtain the cleaned set.

[0056] (3.2) For set V s, set V c and set S d and feature library S p The fuzzy matching based on the longest common substring is performed on the feature library S, and a successful match is considered when the matching length is greater than x characters or y% of the total length of the target string. Wherein, x and y are matching thresholds, and usually x=7 and y=70.

[0057] (3.3) Cleaning the rule set C according to version information v The field value of each dereferenced version in set V v is subjected to regular replacement to generate normalized version information.

[0058] Specifically, according to the method described in step (3), LibGaodeMap.so will match the feature library Gaode, and the matching length is greater than 70% of the full name, so it is considered to be a successful match. Liba.so can match the substring "a" of baidu, but since the matching length is less than 4, it is considered to be a failed match. Invalid results such as "APP_KEY" = "app_key" with the same key name will be discarded.

[0059] Load the compiled version information cleaning regular rule set C v The sources include but are not limited to Maven repository and national SDK management service platform, and the SDK name and manufacturer need to be converted into pinyin, English, and English abbreviation respectively and added to the feature library.

[0060] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for analyzing the components of an Android application based on configuration fuzzy matching, characterized in that, Includes the following steps: (1) Preprocessing stage: Decompress the Android installation package, decompile the dex bytecode, and obtain the decompiled source code; Load keyword collection Feature library Compilation version information cleaning regular expression rule set ; Loaded compilation version information cleaning regular expression rule set Sources include, but are not limited to, Maven repositories and national SDK management service platforms, and the SDK name and vendor need to be converted to Pinyin, English, and English abbreviation respectively before being added to the feature library; (2) Configuration extraction stage: using keyword set Information was extracted from configuration files, decompiled source code, and dynamic libraries to obtain the extracted information. ; Step (2) specifically includes the following steps: (2.1) Using keyword sets Filter the configuration file and extract all SDK names and keys contained in the key-value pairs of the configuration file to form a set. : ,in, This represents any SDK name. This represents the key name corresponding to the SDK name, and extracts all SDK versions contained in the key-value pairs from the configuration file as a set. : ,in, This represents any SDK version; during this process, all string and integer references are retrieved and dereferenced through resource files; Search for collections in the res / values / folder Each SDK name The corresponding XML structure tags are found by reading the tag attributes. The corresponding value serves as the name after dereferencing. , obtain the set : ; And by searching the collection in the res / values / folder. Each SDK version The corresponding XML structure tags are found by reading the tag attributes. The corresponding value serves as the dereferenced version. , obtain the set : ; (2.2) Traverse all public static String definition statements in the decompiled source code and extract the initialization value of the code encoding of each public static String definition statement as a set. ; (2.3) Extract the library name, exported functions, and string information of the dynamic library as a set. ; (2.4) Extract the obtained set ,gather ,gather ,gather ,gather and set As extracted information ; (3) Data cleaning stage: using feature library Extracted information Perform fuzzy matching and filter based on the degree of matching.

2. The method for analyzing the components of an Android application based on configuration fuzzy matching according to claim 1, characterized in that, In step (1), the feature library is loaded. Then, it is necessary to construct a suffix automaton for fuzzy matching template sets to keep the matching time within an acceptable range.

3. The method for analyzing the components of an Android application based on configuration fuzzy matching according to claim 1, characterized in that, Step (3) specifically includes the following sub-steps: (3.1) Clear the set Meaningless results with the same SDK name and key name are removed, resulting in a cleaned-up set. ; (3.2) For sets ,gather and set With feature library Perform fuzzy matching based on the longest common substring, where the matching length is greater than... Total length of characters or target string A % indicates a successful match; (3.3) Cleaning rule set based on version information For sets The field values ​​of each dereferenced version are replaced using regular expressions to generate normalized version information.

Images