Hidden sensitive behavior detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of hidden sensitive behavior detection, and provides a hidden sensitive behavior detection method and device, electronic equipment and a storage medium. The detection method comprises the following steps: determining an interprocess control flow diagram corresponding to an Android application according to an installation package file of the Android application; a conditional branch unit is positioned from the interprocess control flow diagram, branch statements and conditional statements included in the conditional branch unit are expanded, and corresponding expanded branch statements and expanded conditional statements are obtained; and performing sensitivity analysis and hiding analysis on the extension branch statements and the extension conditional statements, and determining hidden sensitive behaviors in the Android application according to analysis results. According to the embodiment of the invention, security analysts can be helped to quickly and accurately position hidden sensitive behaviors in the application, and the analysis efficiency of the analysts is improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of hidden sensitive behavior detection, and in particular to a hidden sensitive behavior detection method and device, electronic equipment, and storage medium. Background Art

[0002] Hidden Sensitive Operations (HSO) of Android applications refer to sensitive codes in Android applications that are triggered and executed only under specific conditions. Although hidden sensitive behavior does not mean malicious behavior, in recent years, more and more malware hides its malicious behavior under specific triggering conditions of Android applications to evade the analysis of security detectors and carry out persistent attacks on Android systems and users. For example, malware can obtain the name of the device operator through the getNetworkOperatorName() function in the Application Programming Interface (API) included in the Android system, and then determine whether the current device is a virtual device by judging whether the name of the operator is "android" (the name of the operator in the Android simulator is fixed as "android"), thereby selectively triggering its malicious behavior. In the above context, the detection of hidden sensitive behaviors of Android applications plays an important role in comprehensively and accurately analyzing application behaviors and detecting their security. Summary of the invention

[0003] The present disclosure aims to solve at least one of the problems existing in the prior art and provide a hidden sensitive behavior detection method and device, an electronic device, and a storage medium.

[0004] In one aspect of the present disclosure, a method for detecting hidden sensitive behaviors is provided, the detection method comprising:

[0005] Determine, according to the installation package file of the Android application, an inter-process control flow graph corresponding to the Android application;

[0006] Locating a conditional branch unit from the inter-procedural control flow graph, and respectively expanding a branch statement and a conditional statement included in the conditional branch unit to obtain a corresponding expanded branch statement and an expanded conditional statement;

[0007] A sensitivity analysis and a hiddenness analysis are performed on the extended branch statement and the extended conditional statement, and based on the analysis results, hidden sensitive behaviors in the Android application are determined.

[0008] Optionally, determining the inter-process control flow graph corresponding to the Android application according to the installation package file of the Android application includes:

[0009] The installation package file is input into a Soot framework, and the inter-process control flow graph is obtained using the Soot framework.

[0010] Optionally, locating a conditional branch unit from the inter-procedural control flow graph includes:

[0011] Traversing each node in the inter-procedural control flow graph, and determining whether each node satisfies any one of the preset conditions: if so, skipping the node; if not, constructing a corresponding unit call graph;

[0012] The preset conditions include that the method corresponding to the node is a method provided by the Android system; or, the method corresponding to the node is a method created by the Soot framework; or, the method corresponding to the node is an abstract method or interface;

[0013] The conditional branch unit is screened out from the unit call graph.

[0014] Optionally, the respectively expanding the branch statements and conditional statements included in the conditional branch unit to obtain corresponding expanded branch statements and expanded conditional statements includes:

[0015] Respectively obtaining the branch statement and the conditional statement in the conditional branch unit, wherein the branch statement includes an IF statement and an ELSE statement;

[0016] Expand the IF statement and the ELSE statement into branch reachable statements respectively, to obtain corresponding IF reachable statements and ELSE reachable statements;

[0017] The conditional statement is expanded into an assignment statement to obtain a corresponding conditional assignment statement.

[0018] Optionally, the respectively expanding the IF statement and the ELSE statement into branch reachable statements to obtain corresponding IF reachable statements and ELSE reachable statements includes:

[0019] Step 2.1.1, adding the target statement to its corresponding target reachable statement, traversing all statements contained in the target reachable statement, and executing step 2.1.2; wherein, the target statement is the IF statement or the ELSE statement, when the target statement is the IF statement, the target reachable statement is the IF reachable statement, and when the target statement is the ELSE statement, the target reachable statement is the ELSE reachable statement;

[0020] Step 2.1.2: If the traversed statement contains a method call that is not in the Android system, execute step 2.1.3;

[0021] Step 2.1.3, adding all statements corresponding to method calls contained in the traversed statements to the target reachable statements;

[0022] Step 2.1.4, recursively execute step 2.1.2 for all statements added to the target reachable statement in step 2.1.3 until no new statements are added to the target reachable statement.

[0023] Optionally, the step of expanding the conditional statement into an assignment statement to obtain a corresponding conditional assignment statement includes:

[0024] Step 2.2.1, search for all variables in the conditional statement, add the assignment statement of the variable to the conditional assignment statement corresponding to the conditional statement; traverse all assignment statements in the conditional assignment statement, and execute step 2.2.2;

[0025] Step 2.2.2, if the right-hand side element of the assignment statement is not a constant, execute step 2.2.3;

[0026] Step 2.2.3, if the right-hand element of the assignment statement is a variable other than the corresponding variable, then add the assignment statement of the other variable to the conditional assignment statement, and then recursively execute step 2.2.2;

[0027] Step 2.2.4, if the right-hand element of the assignment statement contains a method call, then search for the assignment statement of the return value corresponding to the method call, add the assignment statement of the return value to the conditional assignment statement, and then recursively execute step 2.2.2.

[0028] Optionally, the performing sensitivity analysis and hiddenness analysis on the extended branch statement and the extended conditional statement, and determining hidden sensitive behaviors in the Android application according to the analysis results, includes:

[0029] Respectively find out all the APIs belonging to the Android system used by the IF reachable statement and the ELSE reachable statement, and obtain the corresponding APIList-IF and APIList-ELSE;

[0030] Traverse the APIList-IF and the APIList-ELSE respectively, and remove the APIs that are not protected by the Android system permissions;

[0031] Determine whether there is a difference between the APIList-IF and the APIList-ELSE after removing the API that is not protected by the Android system permissions. If so, extract all the APIs belonging to the Android system from the conditional assignment statement, and determine whether the extracted API belongs to the environmental perception API. If the extracted API belongs to the environmental perception API, the conditional branch unit corresponding to the conditional assignment statement has hidden sensitive behavior.

[0032] Another aspect of the present disclosure provides a hidden sensitive behavior detection device, the detection device comprising:

[0033] A determination module, used to determine an inter-process control flow graph corresponding to the Android application according to an installation package file of the Android application;

[0034] An expansion module, used to locate a conditional branch unit from the inter-procedural control flow graph, and to expand the branch statements and conditional statements included in the conditional branch unit to obtain corresponding expanded branch statements and expanded conditional statements;

[0035] The analysis module is used to perform sensitivity analysis and hiddenness analysis on the extended branch statement and the extended conditional statement, and determine the hidden sensitive behavior in the Android application according to the analysis results.

[0036] Optionally, the determining module is used to determine the inter-process control flow graph corresponding to the Android application according to the installation package file of the Android application, including:

[0037] The determining module is used to:

[0038] The installation package file is input into a Soot framework, and the inter-process control flow graph is obtained using the Soot framework.

[0039] Optionally, the expansion module is used to locate the conditional branch unit from the inter-procedural control flow graph, including:

[0040] The expansion module is used to:

[0041] Traversing each node in the inter-procedural control flow graph, and determining whether each node satisfies any one of the preset conditions: if so, skipping the node; if not, constructing a corresponding unit call graph;

[0042] The preset conditions include that the method corresponding to the node is a method provided by the Android system; or, the method corresponding to the node is a method created by the Soot framework; or, the method corresponding to the node is an abstract method or interface;

[0043] The conditional branch unit is screened out from the unit call graph.

[0044] Optionally, the expansion module is used to expand the branch statement and the conditional statement included in the conditional branch unit respectively to obtain the corresponding expanded branch statement and expanded conditional statement, including:

[0045] The expansion module is used to:

[0046] Respectively obtaining the branch statement and the conditional statement in the conditional branch unit, wherein the branch statement includes an IF statement and an ELSE statement;

[0047] Expand the IF statement and the ELSE statement into branch reachable statements respectively, to obtain corresponding IF reachable statements and ELSE reachable statements;

[0048] The conditional statement is expanded into an assignment statement to obtain a corresponding conditional assignment statement.

[0049] Optionally, the expansion module is used to expand the IF statement and the ELSE statement into branch reachable statements respectively to obtain corresponding IF reachable statements and ELSE reachable statements, including:

[0050] The expansion module is used to perform the following steps:

[0051] Step 2.1.1, adding the target statement to its corresponding target reachable statement, traversing all statements contained in the target reachable statement, and executing step 2.1.2; wherein, the target statement is the IF statement or the ELSE statement, when the target statement is the IF statement, the target reachable statement is the IF reachable statement, and when the target statement is the ELSE statement, the target reachable statement is the ELSE reachable statement;

[0052] Step 2.1.2: If the traversed statement contains a method call that is not in the Android system, execute step 2.1.3;

[0053] Step 2.1.3, adding all statements corresponding to method calls contained in the traversed statements to the target reachable statements;

[0054] Step 2.1.4, recursively execute step 2.1.2 for all statements added to the target reachable statement in step 2.1.3 until no new statements are added to the target reachable statement.

[0055] Optionally, the expansion module is used to expand the conditional statement into an assignment statement to obtain a corresponding conditional assignment statement, including:

[0056] The expansion module is used to perform the following steps:

[0057] Step 2.2.1, search for all variables in the conditional statement, add the assignment statement of the variable to the conditional assignment statement corresponding to the conditional statement; traverse all assignment statements in the conditional assignment statement, and execute step 2.2.2;

[0058] Step 2.2.2, if the right-hand side element of the assignment statement is not a constant, execute step 2.2.3;

[0059] Step 2.2.3, if the right-hand element of the assignment statement is a variable other than the corresponding variable, then add the assignment statement of the other variable to the conditional assignment statement, and then recursively execute step 2.2.2;

[0060] Step 2.2.4, if the right-hand element of the assignment statement contains a method call, then search for the assignment statement of the return value corresponding to the method call, add the assignment statement of the return value to the conditional assignment statement, and then recursively execute step 2.2.2.

[0061] Optionally, the analysis module is used to perform sensitivity analysis and hiddenness analysis on the extended branch statement and the extended conditional statement, and determine hidden sensitive behaviors in the Android application according to the analysis results, including:

[0062] The analysis module is used to:

[0063] Respectively find out all the APIs belonging to the Android system used by the IF reachable statement and the ELSE reachable statement, and obtain the corresponding APIList-IF and APIList-ELSE;

[0064] Traverse the APIList-IF and the APIList-ELSE respectively, and remove the APIs that are not protected by the Android system permissions;

[0065] Determine whether there is a difference between the APIList-IF and the APIList-ELSE after removing the API that is not protected by the Android system permissions. If so, extract all the APIs belonging to the Android system from the conditional assignment statement, and determine whether the extracted API belongs to the environmental perception API. If the extracted API belongs to the environmental perception API, the conditional branch unit corresponding to the conditional assignment statement has hidden sensitive behavior.

[0066] Another aspect of the present disclosure provides an electronic device, including:

[0067] at least one processor; and,

[0068] a memory communicatively connected to at least one processor; wherein,

[0069] The memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor so that the at least one processor can execute the hidden sensitive behavior detection method described above.

[0070] Another aspect of the present disclosure provides a computer-readable storage medium storing a computer program, which implements the hidden sensitive behavior detection method described above when executed by a processor.

[0071] Compared with the prior art, the present invention has the following beneficial effects:

[0072] 1. It can help security analysts quickly and accurately locate hidden sensitive behaviors in Android applications, effectively improving the analysis efficiency of security analysts.

[0073] 2. We have fully considered the principles of malware behavioral escape in recent years, starting from the main motivation of malware hiding behavior, and detecting hidden sensitive behaviors based on the environment perception API, which greatly improves the accuracy of hidden sensitive behavior detection.

[0074] 3. It adopts purely static analysis methods. The whole process of analysis and detection does not require dynamic running of applications, and has high detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplifications do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0076] Figure 1 A flowchart of a hidden sensitive behavior detection method provided in one embodiment of the present disclosure;

[0077] Figure 2 A flowchart of a hidden sensitive behavior detection method provided by another embodiment of the present disclosure;

[0078] Figure 3 A schematic diagram of the structure of a hidden sensitive behavior detection device provided by another embodiment of the present disclosure;

[0079] Figure 4 A schematic structural diagram of an electronic device provided in another embodiment of the present disclosure. DETAILED DESCRIPTION

[0080] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the embodiments of the present disclosure will be described in detail below in conjunction with the accompanying drawings. However, it can be understood by those skilled in the art that in each embodiment of the present disclosure, many technical details are proposed in order to enable readers to better understand the present disclosure. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed for protection in the present disclosure can also be implemented. The division of the following embodiments is for the convenience of description and should not constitute any limitation on the specific implementation of the present disclosure. The various embodiments can be combined and referenced with each other without contradiction.

[0081] One embodiment of the present disclosure relates to a method for detecting hidden sensitive behaviors, the process of which is as follows: Figure 1 As shown, including:

[0082] Step S1, determining an inter-process control flow graph corresponding to the Android application according to the installation package file of the Android application.

[0083] Specifically, the installation package file of an Android application is usually an APK file, which usually contains compiled code files (.dex files), file resources (resources), native resource files (assets), certificates (certificates) and manifest files. Among them, APK is the abbreviation of Android Application Package.

[0084] The full name of the interprocedural control flow graph in English is Interprocedural Control-flow Graph, abbreviated as ICFG, which can represent the program structure of the entire APK file.

[0085] Exemplarily, step S1 includes: inputting the installation package file into the Soot framework, and obtaining an inter-process control flow graph using the Soot framework.

[0086] Specifically, the Soot framework is a Java (an object-oriented programming language) static analysis framework that can be used for optimization, static analysis, etc. This embodiment uses the Soot framework to perform static analysis on the input APK file to obtain the inter-process control flow graph corresponding to the APK file, which can effectively achieve the use of purely static analysis methods to obtain the inter-process control flow graph of the installation package file, so that the acquisition process of the inter-process control flow graph does not require any dynamic operation of any application, which effectively improves the detection efficiency.

[0087] Step S2, locate the conditional branch unit from the inter-procedural control flow graph, and expand the branch statement and conditional statement included in the conditional branch unit to obtain corresponding expanded branch statements and expanded conditional statements.

[0088] Specifically, the purpose of step S2 is to collect as much information as possible, so as to detect hidden sensitive behaviors based on the collected information and improve the comprehensiveness and accuracy of the detection. In principle, the detection of hidden sensitive behaviors can be divided into two aspects: one is to detect the hiddenness of the behavior, and the other is to detect the sensitivity of the behavior.

[0089] In the code of the installation package file of the Android application, i.e., the APK file, the hiddenness of the behavior must be achieved through the branch structure. This is because if the code of the behavior is located in the sequential structure of the method, then the code will definitely be executed. At this time, the behavior represented by the code cannot be hidden, that is, the behavior is not hidden. Therefore, step S2 first needs to locate all branch structures, i.e., all conditional branch units, included in the code of the APK file.

[0090] Exemplarily, in step S2, locating the conditional branch unit from the inter-procedural control flow graph includes: traversing each node in the inter-procedural control flow graph, and determining whether each node satisfies any one of the preset conditions: if so, skipping the node; if not, constructing the corresponding unit call graph. The preset conditions include that the method corresponding to the node is a method provided by the Android system; or, the method corresponding to the node is a method created by the Soot framework; or, the method corresponding to the node is an abstract method or interface. Filter out the conditional branch unit from the unit call graph.

[0091] Specifically, each node in the ICFG represents a method included in the APK file, and the edges between nodes represent the calling relationship between methods, and the branch structure, i.e., the conditional branch unit, included in the code of the APK file exists in the statement unit of each method. Therefore, this embodiment traverses each node in the ICFG, constructs a unit call graph of the node, uses the unit call graph to locate the branch structure, and selects the conditional branch unit.

[0092] When traversing each node in ICFG, considering that system methods, i.e. methods provided by the Android system and methods created by the Soot framework, are irrelevant to the code of the Android application itself, and abstract methods or interfaces do not contain any code implementation, it is necessary to filter out the nodes corresponding to these types of methods. In other words, when the method corresponding to a node in ICFG is a method provided by the Android system, or a method created by the Soot framework, or an abstract method or interface, the node is filtered out and skipped. Among them, whether the method corresponding to a node in ICFG is a method provided by the Android system or a method created by the Soot framework can be judged by the package name of the class to which the method corresponding to the node belongs. Whether the method corresponding to a node in ICFG is an abstract method or interface can be judged by the corresponding method modifier.

[0093] Exemplarily, in step S2, the branch statements and conditional statements included in the conditional branch unit are expanded respectively to obtain corresponding expanded branch statements and expanded conditional statements, including: respectively obtaining the branch statements and conditional statements in the conditional branch unit, the branch statements including IF statements and ELSE statements; respectively expanding the IF statements and ELSE statements into branch reachable statements to obtain corresponding IF reachable statements and ELSE reachable statements; expanding the conditional statements into assignment statements to obtain corresponding conditional assignment statements.

[0094] Specifically, the Java language used in APK files usually uses IF statements and ELSE statements when expressing branch structures. Therefore, this embodiment sets the branch statements to include IF statements and ELSE statements. Among them, the IF statement can be recorded as Stmts-IF, and the ELSE statement can be recorded as Stmts-ELSE. The branch reachable statement refers to the statement that the branch statement can execute when the corresponding code is executed. Among them, the IF reachable statement can be recorded as ReachableStmts-IF, which refers to the reachable statement corresponding to the IF statement, and is also the extended branch statement corresponding to the branch statement IF statement. The ELSE reachable statement can be recorded as ReachableStmts-ELSE, which refers to the reachable statement corresponding to the ELSE statement, and is also the extended branch statement corresponding to the branch statement ELSE statement.

[0095] The conditional statement here can be denoted as C, which refers to the conditional expression involved in the branch statement, including the conditional expression involved in the IF statement and the conditional expression involved in the ELSE statement. The conditional assignment statement can be denoted as AssignStmts, which refers to the statement obtained by expanding the conditional statement C into an assignment statement, and is also the extended conditional statement corresponding to the conditional statement C. The assignment statement is usually used to assign the value of an expression to a variable to initialize or update the value of the variable.

[0096] After locating the branch structure, that is, filtering out the conditional branch units, the next step is to collect all reachable statements in each branch, because these reachable statements represent the behaviors in the branch, which is crucial for accurately judging the sensitivity of the behavior. At the same time, it is also necessary to collect all assignment statements included in the branch conditions. These assignment statements can reflect the influencing factors of the branch expression, which are the key to analyzing the hidden nature of branch behaviors.

[0097] Exemplarily, the IF statement and the ELSE statement are respectively expanded into branch reachable statements to obtain corresponding IF reachable statements and ELSE reachable statements, including:

[0098] Step 2.1.1, add the target statement to its corresponding target reachable statement, traverse all statements contained in the target reachable statement, and execute step 2.1.2. Wherein, the target statement is an IF statement or an ELSE statement. When the target statement is an IF statement, the target reachable statement is an IF reachable statement, and when the target statement is an ELSE statement, the target reachable statement is an ELSE reachable statement.

[0099] Step 2.1.2: If the traversed statement contains a method call that is not in the Android system, execute step 2.1.3.

[0100] Step 2.1.3, add all statements corresponding to the method calls contained in the traversed statements to the target reachable statements.

[0101] Step 2.1.4, recursively execute step 2.1.2 for all statements added to the target reachable statement in step 2.1.3 until no new statements are added to the target reachable statement.

[0102] Specifically, the process of expanding the IF statement Stmts-IF into the IF reachable statement ReachableStmts-IF is similar to the process of expanding the ELSE statement Stmts-ELSE into the ELSE reachable statement ReachableStmts-ELSE. Therefore, by setting the target statement to the IF statement Stmts-IF and the target reachable statement to the IF reachable statement ReachableStmts-IF, the above steps 2.1.1 to 2.1.4 can be used to obtain the branch reachable statement corresponding to the IF statement Stmts-IF, namely, the IF reachable statement ReachableStmts-IF. Similarly, by setting the target statement to the ELSE statement Stmts-ELSE and the target reachable statement to the ELSE reachable statement ReachableStmts-ELSE, the above steps 2.1.1 to 2.1.4 can be used to obtain the branch reachable statement corresponding to the ELSE statement Stmts-ELSE, namely, the ELSE reachable statement ReachableStmts-ELSE.

[0103] Exemplarily, the conditional statement is expanded into an assignment statement to obtain a corresponding conditional assignment statement, including:

[0104] Step 2.2.1, search for all variables in conditional statement C, and add the variable assignment statements to the conditional assignment statement AssignStmts corresponding to conditional statement C; traverse all assignment statements in the conditional assignment statement AssignStmts, and execute step 2.2.2.

[0105] Step 2.2.2: If the right-hand side element of the assignment statement is not a constant, execute step 2.2.3.

[0106] Step 2.2.3, if the right-hand element of the assignment statement is a variable other than the corresponding variable, add the assignment statement of the other variable to the conditional assignment statement AssignStmts, and then recursively execute step 2.2.2.

[0107] Step 2.2.4, if the right-hand side element of the assignment statement contains a method call, then find the assignment statement of the return value corresponding to the method call, add the assignment statement of the return value to the conditional assignment statement AssignStmts, and then recursively execute step 2.2.2.

[0108] By using the above steps 2.1.1 to 2.1.4 to obtain the IF reachable statement corresponding to the IF statement and the ELSE reachable statement corresponding to the ELSE statement, and using the above steps 2.2.1 to 2.2.4 to obtain the conditional assignment statement corresponding to the conditional statement, it is possible to further collect as much information as possible, thereby achieving comprehensiveness and accuracy in subsequent hidden sensitive behavior detection.

[0109] Step S3, performing sensitivity analysis and hiddenness analysis on the extended branch statements and the extended conditional statements, and determining hidden sensitive behaviors in the Android application based on the analysis results.

[0110] Specifically, the purpose of step S3 is to perform hidden sensitive behavior detection based on the information collected in step S2.

[0111] Exemplarily, step S3 includes: respectively finding out all the APIs belonging to the Android system used by the IF reachable statement ReachableStmts-IF and the ELSE reachable statement ReachableStmts-ELSE, and obtaining the corresponding APIList-IF and APIList-ELSE. Traverse APIList-IF and APIList-ELSE respectively, and remove the APIs that are not protected by the Android system permissions. Determine whether there is a difference between APIList-IF and APIList-ELSE after removing the APIs that are not protected by the Android system permissions. If so, extract all the APIs belonging to the Android system from the conditional assignment statement AssignStmts, and determine whether the extracted APIs belong to the environmental perception API. If the extracted APIs belong to the environmental perception API, the conditional branch unit corresponding to the conditional assignment statement AssignStmts has hidden sensitive behavior.

[0112] Specifically, in order to determine whether the branch behavior in the branch structure is sensitive, it is first necessary to quantify the branch behavior to a certain extent. Therefore, step S3 first extracts all API calls belonging to the Android system from the IF reachable statement ReachableStmts-IF and the ELSE reachable statement ReachableStmts-ELSE included in the branch reachable statement. Next, in order to determine whether the branch behavior is sensitive, it is only necessary to determine whether the API calls belonging to the Android system are sensitive in the IF reachable statement ReachableStmts-IF and the ELSE reachable statement ReachableStmts-ELSE included in the branch reachable statement. In the Android system, sensitive API calls are protected by Android system permissions. Therefore, by determining whether the API call is protected by Android system permissions, the sensitivity of the API call can be determined, and finally the sensitivity of the branch behavior can be determined.

[0113] After the sensitivity of the branch behavior is determined, it is also necessary to determine the hiddenness of the branch behavior. The hiddenness essentially depends on the execution conditions of the branch behavior. First, if the sensitive behaviors of different branches are consistent, then no matter which branch is triggered, the sensitive behavior will be executed. At this time, the sensitive behavior is not hidden. Considering that the main basis for malware to hide its malicious behavior is the operating environment, therefore, by analyzing whether the factors affecting the conditional expression, i.e., the conditional assignment statement AssignStmts, contain environmental factors, it is possible to more accurately determine whether the conditional branch unit where the conditional assignment statement AssignStmts is located has hidden sensitive behaviors, thereby detecting the hidden sensitive behaviors of malware.

[0114] This implementation fully considers the principles of behavioral escape achieved by malware in recent years. Starting from the main motivation of malware to hide behavior, it detects hidden sensitive behaviors based on the environmental perception API, greatly improving the accuracy of hidden sensitive behavior detection.

[0115] In order to enable those skilled in the art to better understand the above implementation, a specific example is provided below for illustration.

[0116] Combined Figure 2 , a hidden sensitive behavior detection method for Android applications, comprising the following steps:

[0117] 1. According to the application sample file of the Android application, that is, the APK file, build the inter-procedural control flow graph ICFG of the Android application. This step specifically includes three parts:

[0118] 1) Environment preparation: Download Java SDK and Android SDK. Create a Java project and import the Soot framework jar package into the project. The project refers to the application sample file, i.e., the APK file.

[0119] 2) Soot framework parameter configuration: Use the Options class of the Soot framework in the Java code to set configuration parameters, including the application package name of the Android application to be analyzed, the Android SDK path, etc.

[0120] 3) Parsing application code: Use the Scene class to load the application's classes. The Scene class is the core component that manages and represents the entire scene of the analyzed Android code. The Scene class provides access and management functions for various elements in the application (such as classes, methods, fields, etc.), and is one of the key components of the Soot analysis process.

[0121] 4) Get the ICFG of the Android application through the Scene.v().getCallGraph() method.

[0122] 2. Locate the branch unit structure and expand the conditional branch unit, including branch statement expansion and conditional statement expansion, specifically including:

[0123] 1) Traverse each SootMethod node of ICFG, obtain the class to which the method belongs through getDeclaringClass(), and obtain the modifier of the method corresponding to the node through getModifiers(). According to the obtained method class and method modifier, skip the node corresponding to any one of the system method, Soot method, and abstract method.

[0124] 2) For the Android application's own methods, its unit call graph UnitGraph is constructed in the following way:

[0125] public UnitGraph buildUnitGraph(SootMethod method){

[0126] / / Get the activity body of the method (Body)

[0127] Body body=method.retrieveActiveBody();

[0128] / / Use BriefUnitGraph to build UnitGraph

[0129] UnitGraph graph=new BriefUnitGraph(body);

[0130] return graph;

[0131] }

[0132] 3) Traverse the unit call graph UnitGraph and locate the branch unit. In the Soot framework, IfStmt is a specific type of Unit subclass that represents an if statement. Therefore, the Java keyword instanceof can be used to determine whether the current unit is a branch unit through unitinstanceof IfStmt.

[0133] 4) For a branch unit, obtain its successor node through unitGraph.getSuccOf(ifStmt). For an if-else branch unit, there are two successor nodes, which represent the starting statements of the IF branch and the ELSE branch respectively. Traverse all successor nodes through the successor nodes. During the traversal process, if the successor node is a self-implemented method, enter the method and repeat the process. All nodes reachable through the successor nodes are all reachable statements of each branch, ReachableStmts-IF and ReachableStmts-ELSE.

[0134] 5) Get the conditional expression of the branch unit through ifStmt.getCondition(), and then search for the assignment statements of all variables in the conditional expression. Specifically, use unitGraph.getPredsOf(ifStmt) to continuously search for the predecessor node of the branch unit. During the search process, use unit instanceof AssignStmt determines whether the predecessor node is an assignment statement, and then determines whether the left side of the assignment statement is the target variable, and then finds the assignment statement of the target variable. After finding the assignment statement of the target variable, analyze the right side of the assignment statement. If the right side of the assignment statement is a variable or method other than the target variable, perform the same processing on the variable on the right side of the assignment statement or search for all assignment statements in the method. Finally, all the assignment statements AssignStmts of the conditional expression are obtained.

[0135] 3. Detect hidden sensitive behaviors and determine whether the expanded branch statements and conditional statements contain hidden sensitive behaviors, including hiddenness analysis and sensitivity analysis, specifically including:

[0136] 1) Extract the API belonging to the Android system from the reachable statements of the IF branch and the ELSE branch. Specifically, first use unit instanceofInvokeStmt to determine whether the reachable statements corresponding to the IF branch and the ELSE branch are method call types. If so, obtain the method called by the reachable statement through invokeStmt.getInvokeExpr().getMethod(), and then determine whether the called method belongs to the Android system API through the class to which the method belongs.

[0137] 2) Remove the APIs that are not protected by the Android system permissions from the extracted APIs belonging to the Android system, and obtain the APIList-IF corresponding to the IF branch and the APIList-ELSE corresponding to the ELSE branch. The list of APIs protected by the Android system permissions can be obtained from Google official.

[0138] 3) Perform intersection operation on APIList-IF and APIList-ELSE, and then remove the result of the intersection operation from APIList-IF and APIList-ELSE respectively. If APIList-IF or APIList-ELSE is not an empty set, continue to analyze AssignStmts.

[0139] 4) Extract the APIs belonging to the Android system from AssignStmts, and then determine whether there is an environment perception API among the extracted APIs. If so, the current conditional branch where AssignStmts is located has hidden sensitive behaviors, thereby obtaining the hidden sensitive behaviors of the Android application. Among them, the list of environment perception APIs can be constructed in advance with reference to relevant literature.

[0140] Compared with the prior art, the hidden sensitive behavior detection method provided by the disclosed embodiment can help security analysts quickly and accurately locate hidden sensitive behaviors in Android applications, effectively improving the analysis efficiency of security analysts.

[0141] Another embodiment of the present disclosure relates to a hidden sensitive behavior detection device, such as Figure 3 As shown, it includes a determination module 310 , an expansion module 320 , and an analysis module 330 .

[0142] The determination module 310 is used to determine the inter-process control flow graph corresponding to the Android application according to the installation package file of the Android application.

[0143] The expansion module 320 is used to locate the conditional branch unit from the inter-procedural control flow graph, and respectively expand the branch statement and conditional statement included in the conditional branch unit to obtain the corresponding expanded branch statement and expanded conditional statement.

[0144] The analysis module 330 is used to perform sensitivity analysis and hiddenness analysis on the extended branch statements and the extended conditional statements, and determine the hidden sensitive behaviors in the Android application according to the analysis results.

[0145] Exemplarily, the determination module 310 is used to determine the inter-process control flow graph corresponding to the Android application according to the installation package file of the Android application, including:

[0146] The determination module 310 is used to: input the installation package file into the Soot framework, and use the Soot framework to obtain an inter-process control flow graph.

[0147] Exemplarily, the expansion module 320 is used to locate the conditional branch unit from the inter-procedural control flow graph, including:

[0148] The extension module 320 is used to: traverse each node in the inter-process control flow graph, and determine whether each node satisfies any one of the preset conditions: if so, skip the node; if not, build a corresponding unit call graph; wherein the preset conditions include that the method corresponding to the node is a method provided by the Android system; or, the method corresponding to the node is a method created by the Soot framework; or, the method corresponding to the node is an abstract method or interface; and filter out conditional branch units from the unit call graph.

[0149] Exemplarily, the expansion module 320 is used to expand the branch statement and the conditional statement included in the conditional branch unit respectively to obtain the corresponding expanded branch statement and expanded conditional statement, including:

[0150] The expansion module 320 is used to: respectively obtain the branch statements and conditional statements in the conditional branch unit, the branch statements include IF statements and ELSE statements; respectively expand the IF statements and ELSE statements into branch reachable statements to obtain corresponding IF reachable statements and ELSE reachable statements; expand the conditional statements into assignment statements to obtain corresponding conditional assignment statements.

[0151] Exemplarily, the expansion module 320 is used to expand the IF statement and the ELSE statement into branch reachable statements respectively, and obtain corresponding IF reachable statements and ELSE reachable statements, including:

[0152] The expansion module 320 is used to perform the following steps:

[0153] Step 2.1.1, add the target statement to its corresponding target reachable statement, traverse all statements contained in the target reachable statement, and execute step 2.1.2; wherein, the target statement is an IF statement or an ELSE statement, when the target statement is an IF statement, the target reachable statement is an IF reachable statement, and when the target statement is an ELSE statement, the target reachable statement is an ELSE reachable statement;

[0154] Step 2.1.2: If the traversed statement contains a method call that is not in the Android system, execute step 2.1.3;

[0155] Step 2.1.3, add all statements corresponding to the method calls contained in the traversed statements to the target reachable statements;

[0156] Step 2.1.4, recursively execute step 2.1.2 for all statements added to the target reachable statement in step 2.1.3 until no new statements are added to the target reachable statement.

[0157] Exemplarily, the expansion module 320 is used to expand the conditional statement into an assignment statement to obtain a corresponding conditional assignment statement, including:

[0158] The expansion module 320 is used to perform the following steps:

[0159] Step 2.2.1, search for all variables in the conditional statement, add the variable assignment statement to the conditional assignment statement corresponding to the conditional statement; traverse all assignment statements in the conditional assignment statement, and execute step 2.2.2;

[0160] Step 2.2.2, if the right-hand side element of the assignment statement is not a constant, execute step 2.2.3;

[0161] Step 2.2.3, if the right-hand element of the assignment statement is a variable other than the corresponding variable, add the assignment statement of the other variable to the conditional assignment statement, and then recursively execute step 2.2.2;

[0162] Step 2.2.4, if the right-hand side element of the assignment statement contains a method call, then find the assignment statement of the return value corresponding to the method call, add the assignment statement of the return value to the conditional assignment statement, and then recursively execute step 2.2.2.

[0163] Exemplarily, the analysis module 330 is used to perform sensitivity analysis and hiddenness analysis on the extended branch statement and the extended conditional statement, and determine the hidden sensitive behavior in the Android application according to the analysis result, including:

[0164] The analysis module 330 is used to: respectively find out all the APIs belonging to the Android system used by the IF reachable statement and the ELSE reachable statement, and obtain the corresponding APIList-IF and APIList-ELSE; respectively traverse the APIList-IF and APIList-ELSE to remove the APIs that are not protected by the Android system permissions; determine whether there is a difference between the APIList-IF and APIList-ELSE after removing the APIs that are not protected by the Android system permissions. If so, extract all the APIs belonging to the Android system from the conditional assignment statement, and determine whether the extracted APIs belong to the environmental perception API. If the extracted APIs belong to the environmental perception API, the conditional branch unit corresponding to the conditional assignment statement has hidden sensitive behavior.

[0165] The specific implementation method of the hidden sensitive behavior detection device provided in the embodiment of the present disclosure can be found in the hidden sensitive behavior detection method provided in the embodiment of the present disclosure, and will not be repeated here.

[0166] Compared with the prior art, the hidden sensitive behavior detection device provided by the disclosed embodiment can help security analysts quickly and accurately locate hidden sensitive behaviors in Android applications, effectively improving the analysis efficiency of security analysts.

[0167] Another embodiment of the present disclosure relates to an electronic device, such as Figure 4 As shown, including:

[0168] at least one processor 401; and,

[0169] A memory 402 is communicatively connected to at least one processor 401; wherein,

[0170] The memory 402 stores instructions that can be executed by at least one processor 401, and the instructions are executed by at least one processor 401 so that the at least one processor 401 can execute the hidden sensitive behavior detection method described in the above embodiment.

[0171] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0172] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0173] Another embodiment of the present disclosure relates to a computer-readable storage medium storing a computer program, which implements the hidden sensitive behavior detection method described in the above embodiment when executed by a processor.

[0174] That is, those skilled in the art can understand that all or part of the steps in the method described in the above embodiments can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions for making a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0175] Those skilled in the art will appreciate that the above-mentioned embodiments are specific embodiments for implementing the present disclosure, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present disclosure.

Claims

1. A method for detecting hidden sensitive behaviors, characterized in that: The detection method comprises: Determine, according to the installation package file of the Android application, an inter-process control flow graph corresponding to the Android application; Locating a conditional branch unit from the inter-procedural control flow graph, and respectively expanding a branch statement and a conditional statement included in the conditional branch unit to obtain a corresponding expanded branch statement and an expanded conditional statement; A sensitivity analysis and a hiddenness analysis are performed on the extended branch statement and the extended conditional statement, and based on the analysis results, hidden sensitive behaviors in the Android application are determined.

2. The detection method according to claim 1, characterized in that: The step of determining, according to the installation package file of the Android application, an inter-process control flow graph corresponding to the Android application comprises: The installation package file is input into a Soot framework, and the inter-process control flow graph is obtained using the Soot framework.

3. The detection method according to claim 2, characterized in that: The step of locating a conditional branch unit from the inter-procedural control flow graph includes: Traversing each node in the inter-procedural control flow graph, and determining whether each node satisfies any one of the preset conditions: if so, skipping the node; if not, constructing a corresponding unit call graph; The preset conditions include that the method corresponding to the node is a method provided by the Android system; or, the method corresponding to the node is a method created by the Soot framework; or, the method corresponding to the node is an abstract method or interface; The conditional branch unit is screened out from the unit call graph.

4. The detection method according to any one of claims 1 to 3, characterized in that: The step of respectively expanding the branch statements and conditional statements included in the conditional branch unit to obtain corresponding expanded branch statements and expanded conditional statements includes: Respectively obtaining the branch statement and the conditional statement in the conditional branch unit, wherein the branch statement includes an IF statement and an ELSE statement; Expand the IF statement and the ELSE statement into branch reachable statements respectively, to obtain corresponding IF reachable statements and ELSE reachable statements; The conditional statement is expanded into an assignment statement to obtain a corresponding conditional assignment statement.

5. The detection method according to claim 4, characterized in that: The step of respectively expanding the IF statement and the ELSE statement into branch reachable statements to obtain corresponding IF reachable statements and ELSE reachable statements includes: Step 2.1.1, adding the target statement to its corresponding target reachable statement, traversing all statements contained in the target reachable statement, and executing step 2.1.2; wherein, the target statement is the IF statement or the ELSE statement, when the target statement is the IF statement, the target reachable statement is the IF reachable statement, and when the target statement is the ELSE statement, the target reachable statement is the ELSE reachable statement; Step 2.1.2: If the traversed statement contains a method call that is not in the Android system, execute step 2.1.3; Step 2.1.3, adding all statements corresponding to method calls contained in the traversed statements to the target reachable statements; Step 2.1.4, recursively execute step 2.1.2 for all statements added to the target reachable statement in step 2.1.3 until no new statements are added to the target reachable statement.

6. The detection method according to claim 4, characterized in that: The step of expanding the conditional statement into an assignment statement to obtain a corresponding conditional assignment statement includes: Step 2.2.1, search for all variables in the conditional statement, add the assignment statement of the variable to the conditional assignment statement corresponding to the conditional statement; traverse all assignment statements in the conditional assignment statement, and execute step 2.2.2; Step 2.2.2, if the right-hand side element of the assignment statement is not a constant, execute step 2.2.3; Step 2.2.3, if the right-hand element of the assignment statement is a variable other than the corresponding variable, then add the assignment statement of the other variable to the conditional assignment statement, and then recursively execute step 2.2.2; Step 2.2.4, if the right-hand element of the assignment statement contains a method call, then search for the assignment statement of the return value corresponding to the method call, add the assignment statement of the return value to the conditional assignment statement, and then recursively execute step 2.2.

2.

7. The detection method according to claim 6, characterized in that: The performing sensitivity analysis and hiddenness analysis on the extended branch statement and the extended conditional statement, and determining hidden sensitive behaviors in the Android application according to the analysis results, includes: Respectively find out all the APIs belonging to the Android system used by the IF reachable statement and the ELSE reachable statement, and obtain the corresponding APIList-IF and APIList-ELSE; Traverse the APIList-IF and the APIList-ELSE respectively, and remove the APIs that are not protected by the Android system permissions; Determine whether there is a difference between the APIList-IF and the APIList-ELSE after removing the API that is not protected by the Android system permissions. If so, extract all the APIs belonging to the Android system from the conditional assignment statement, and determine whether the extracted API belongs to the environmental perception API. If the extracted API belongs to the environmental perception API, the conditional branch unit corresponding to the conditional assignment statement has hidden sensitive behavior.

8. A hidden sensitive behavior detection device, characterized in that: The detection device comprises: A determination module, used to determine an inter-process control flow graph corresponding to the Android application according to an installation package file of the Android application; An expansion module, used to locate a conditional branch unit from the inter-procedural control flow graph, and to expand the branch statements and conditional statements included in the conditional branch unit to obtain corresponding expanded branch statements and expanded conditional statements; The analysis module is used to perform sensitivity analysis and hiddenness analysis on the extended branch statement and the extended conditional statement, and determine the hidden sensitive behavior in the Android application according to the analysis results.

9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the hidden sensitive behavior detection method described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the hidden sensitive behavior detection method described in any one of claims 1 to 7 is implemented.

Images