Android application vulnerability detection method and system based on multi-agent collaboration

Abstract

The present invention discloses an Android application vulnerability detection method and system based on multi-agent collaboration, which relates to the field of cyberspace security. The method comprises: S1, vulnerability information sorting step; S2, APK decompression and decompilation step, S3, APK intelligent scanning step; S4, vulnerability mining step; S5, vulnerability verification step. The present invention discloses an Android application vulnerability detection method and system based on multi-agent collaboration, which can effectively identify and verify security vulnerabilities in Android applications, and can more accurately verify vulnerabilities by using the semantic analysis ability of the agent, reduce the false alarm rate and missed alarm rate of vulnerability scanning, and improve the reliability of vulnerability detection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an Android application vulnerability detection method and system based on multi-agent collaboration. Background Art

[0002] With the widespread use of the Android platform around the world, its application market share continues to expand and its popularity is increasing, bringing great convenience to users. However, along with this high popularity, the security risks faced by the Android system and its applications are becoming increasingly prominent and have become an important issue that needs to be addressed. Therefore, vulnerability analysis technology for Android applications is gradually gaining widespread attention and in-depth research in the industry.

[0003] At present, the main vulnerability mining methods are divided into static analysis and dynamic debugging. Static analysis refers to the discovery of potential errors by checking source code and binary code without running the program. Static analysis is usually performed by automated tools and can quickly scan large amounts of code. In the paper "ATVHunter: Reliable Version Detection of Third-Party Libraries for Vulnerability Identification in Android Applications", Xian Zhan et al. proposed an APK third-party library detection framework ATVHunter and found vulnerable third-party libraries in nine thousand APKs. However, since the framework lacks a mechanism for regularly updating vulnerability libraries, it is unable to identify new vulnerabilities. Vulnerability mining based on text matching is also a current research hotspot, but due to the large granularity of the matching template, the false positive rate of the matching results is high.

[0004] Compared with static analysis, dynamic debugging has problems such as high overhead and difficulty in automation. Zhang Xiaosong et al. proposed a dynamic and static APK vulnerability analysis method (see System and method for automatic mining of application vulnerabilities under Android platform [P] . Chinese patent: CN107832619B . 2020.12.15), which uses static analysis technology to generate a large number of Fuzz test cases to solve the problem of high performance of dynamic testing. Summary of the invention

[0005] The present invention aims to solve the problems of high false positive rate of vulnerability scanning results in existing vulnerability scanning technologies, and overcome the limitations of artificial intelligence in real-time updating and optimizing decision-making. To this end, a hybrid multi-agent automated penetration testing system integrating large models and deep reinforcement learning is proposed. Relying on the adaptive and learning capabilities of the agents, it can effectively reduce the risk of errors caused by human operations, and provide an innovative solution for the security protection of Android applications.

[0006] The technical solution of the present invention is as follows.

[0007] On the one hand, a multi-agent collaboration-based Android application vulnerability detection method includes:

[0008] S1, vulnerability information collation step: adding vulnerability details regularly collated on the vulnerability website into the vulnerability details database; adding the vulnerabilities existing in the third-party library regularly collected on the vulnerability website into the third-party library-vulnerability number database;

[0009] S2, APK decompression and decompilation step: decompress the Android application package APK to obtain a decompressed APK folder, and use decompilation technology to decompile the binary code in the decompressed APK folder into a high-level programming language code;

[0010] S3, APK intelligent scanning step: Scan the decompressed APK folder to obtain scanning data; use the sensitive information collection agent group to deduplicate, verify and classify the scanning data; summarize the scanning data and the information processed by the sensitive information collection agent group to compile a scanning report;

[0011] S4, vulnerability mining step: Based on the scan report generated by the scan and the high-level programming language code obtained by decompilation, combined with the third-party library-vulnerability number database, text matching and database matching technology are used to perform vulnerability mining, and the CVE vulnerability number obtained by database matching and the vulnerability scanning information obtained by text matching are returned;

[0012] S5, vulnerability verification step: The vulnerability verification agent receives the vulnerability number and vulnerability scanning information returned in the vulnerability mining phase, executes the attack script and uses the attack tool based on the vulnerability details and high-level programming language code to verify whether the corresponding vulnerability actually exists in the APK to be tested; and compiles the final verification results into a test report.

[0013] Preferably, the vulnerability information collating step specifically includes:

[0014] S11, using vulnerability analysis agents to regularly organize and analyze detailed information of vulnerabilities on vulnerability websites, and add vulnerability numbers, vulnerability overviews, vulnerability exploitation scripts, vulnerability risk levels, and vulnerability repair suggestions into the vulnerability details database;

[0015] S12, using vulnerability analysis agents, regularly collects vulnerabilities existing in third-party libraries on vulnerability websites, and adds the vulnerabilities existing in third-party libraries into the third-party library-vulnerability number database.

[0016] Preferably, the APK decompression and decompilation steps specifically include:

[0017] S21, decompress the Android application package APK to obtain a decompressed APK folder;

[0018] S22, try to decompress the shell to obtain the high-level programming language code; determine whether the decompressed APK folder is shelled, if not, jump to step S23; if it is shelled, use the shelling tool to remove the protection layer of the APK folder, if the shelling fails, jump to S23; if the shelling is successful, obtain the binary executable file of the source code, and then use the decompilation tool to convert the binary file into a high-level programming language, and end the step;

[0019] S23, decompile the decompressed binary file and convert it into a high-level programming language.

[0020] Preferably, the APK intelligent scanning step specifically includes:

[0021] S31, the tool calling agent calls a third-party library scanning tool and multiple sensitive information scanning tools to scan the decompressed APK folder, and returns the third-party library information used by the APK and the APK sensitive information;

[0022] S32, calling different agents in the sensitive information collection agent group to perform deduplication, verification and classification on the sensitive information scanning results, and returning the sorted results;

[0023] S33, sort out the third-party library information and sensitive information collection agent group return results, and generate a scan report.

[0024] Preferably, the vulnerability mining step specifically includes:

[0025] S41, scanning information preprocessing: arranging the generated scanning report and the decompiled high-level programming language code as input for vulnerability mining;

[0026] S42, database-based third-party library vulnerability matching: according to the name and version information of the third-party library used in the decompiled high-level programming language code, query the third-party library-vulnerability number database for vulnerabilities existing in these third-party libraries, and return the vulnerability number;

[0027] S43, vulnerability mining based on text matching: pre-set regular matching rules in the text matching tool, match the resource files after decompression of APK with the decompiled code files, and return the matching vulnerability scanning information.

[0028] Preferably, the vulnerability verification step specifically includes:

[0029] S51, vulnerability verification preparation: the vulnerability verification agent receives the vulnerability number and vulnerability scanning information returned in the vulnerability mining phase, searches and reads the vulnerability details in the vulnerability details database, and finds the specific location of the vulnerability and the corresponding code context in the decompiled high-level programming language code;

[0030] S52, vulnerability exploitation script generation: after analyzing the vulnerability details, the vulnerability verification agent generates an attack script and determines the attack tool to be used;

[0031] S53, vulnerability exploitation: the vulnerability verification agent executes the attack script and uses the attack tool to attack the target APK;

[0032] S54, return the vulnerability verification result: After the vulnerability verification is completed, the vulnerability verification agent analyzes whether the attack result meets the expectations; if it does not meet the expectations, it proves that the vulnerability does not exist and the vulnerability is eliminated; if it meets the expectations, it proves that the vulnerability exists and returns a detailed test report, including the verified vulnerability number, the tools used, and the vulnerability test script.

[0033] On the other hand, an Android application vulnerability detection system based on multi-agent collaboration includes:

[0034] Vulnerability information sorting module: used to sort out vulnerability details on the vulnerability website regularly based on the vulnerability analysis agent, add them to the vulnerability details database, regularly collect vulnerabilities existing in third-party libraries on the vulnerability website, and add them to the third-party library-vulnerability number database;

[0035] APK decompression and decompilation module: used to decompress the Android application package APK to obtain the decompressed APK folder, and use the decompilation technology to decompile the binary code in the decompressed APK folder into readable high-level programming language code;

[0036] APK intelligent scanning module: used to scan the unzipped APK folder to obtain scanning data; use the sensitive information collection agent group to deduplicate, verify and classify the scanning data; summarize the scanning data and the information processed by the sensitive information collection agent group to compile a scanning report;

[0037] Vulnerability mining module: Based on the scan report generated in the scanning phase and the high-level programming language code obtained by decompilation, combined with the third-party library-vulnerability number database, it uses text matching and database matching technology to conduct in-depth vulnerability mining, and returns the CVE vulnerability number obtained by database matching and the vulnerability scanning information obtained by text matching;

[0038] Vulnerability verification module: used to verify whether the APK to be tested contains the vulnerabilities obtained during the vulnerability mining phase; the vulnerability verification agent receives the vulnerability number and verifies it by simulating attack scenarios; the final results of the verification will be compiled into a test report.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] The present invention is based on a multi-agent collaboration framework, can automatically mine vulnerabilities contained in Android applications, improve the efficiency of vulnerability discovery, and verify whether the vulnerabilities exist; at the same time, the introduction of a joint collaboration mechanism of multi-agent Agents can improve the efficiency and accuracy of the process. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 A flowchart of a multi-agent collaborative Android application vulnerability detection method provided by an embodiment of the present invention;

[0043] Figure 2 A flowchart of APK decompression and decompilation steps of an Android application vulnerability detection method based on multi-agent collaboration provided by an embodiment of the present invention;

[0044] Figure 3 A flowchart of APK intelligent scanning steps of an Android application vulnerability detection method based on multi-agent collaboration provided by an embodiment of the present invention;

[0045] Figure 4A flowchart of vulnerability mining steps of an Android application vulnerability detection method based on multi-agent collaboration provided by an embodiment of the present invention;

[0046] Figure 5 A flowchart of vulnerability verification steps of an Android application vulnerability detection method based on multi-agent collaboration provided by an embodiment of the present invention;

[0047] Figure 6 A structural block diagram of an Android application vulnerability detection system based on multi-agent collaboration provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] See also Figure 1 As shown, the present invention provides an Android application vulnerability detection method based on multi-agent collaboration, which includes the following steps.

[0050] S1, vulnerability information collation step: regularly organize vulnerability details on the vulnerability website and add them to the vulnerability details database; regularly collect vulnerabilities existing in third-party libraries on the vulnerability website and add them to the third-party library-vulnerability number database.

[0051] S11, using vulnerability analysis agents, regularly analyze and organize the detailed information of vulnerabilities on the vulnerability website, and add the vulnerability number, vulnerability overview, vulnerability risk level, vulnerability exploitation script, and vulnerability repair suggestions to the vulnerability details database; for example, the vulnerability website has a CVE-2016-6637 vulnerability entry, which has a score of 9.6 in CVSSV3.0 (Common Vulnerability Assessment Method), which is a high-risk vulnerability; this vulnerability indicates that Pivotal Cloud Foundry (PCF) and its components have multiple cross-site request forgery (CSRF) vulnerabilities, which attackers can use to hijack sessions. After analysis and organization, the vulnerability analysis agent adds the detailed information of the vulnerability to the vulnerability details database.

[0052] S12, using vulnerability analysis agents, regularly collect vulnerabilities in third-party libraries on vulnerability websites and add them to the third-party library-vulnerability number database. For example, a third-party library with package name org.json, name json, and version 20230618 has two vulnerabilities, namely CVE-2023-5072 and CVE-2023-51074. After the vulnerability analysis agent collects this information, it adds the third-party library details and the vulnerability numbers it has to the third-party library-vulnerability number database.

[0053] S2, APK decompression and decompilation steps: First, decompress the Android application package (APK) to obtain the decompressed APK folder. Then, use decompilation technology to decompile the binary code in the decompressed APK folder into readable high-level programming language code for further code analysis; the decompilation technology process also includes removing possible reinforcement protection measures of the APK to ensure the integrity and accuracy of the decompilation process.

[0054] See also Figure 2 As shown, the specific implementation of the APK decompression and decompilation steps is as follows.

[0055] S21, receiving the APK file to be detected, and using a dedicated APK decompression tool, such as the unzip function in Python, to decompress the APK file to a specified directory, and obtain a decompressed folder containing application resources, an AndroidManifest.xml file, and binary source code.

[0056] S22, after inspection, the decompressed APK folder is hardened, and a deshelling tool is used to deshell the folder in order to obtain the binary code after deshelling.

[0057] S23, unpacking is successful, and the binary code is converted into readable high-level program code using a decompilation tool.

[0058] S3, APK intelligent scanning step: Scan the unzipped APK folder to obtain scanning data, then use the sensitive information collection agent group to deduplicate, verify and classify the scanning data to ensure the accuracy and consistency of the information; finally, summarize the scanning results and the information organized by the agent to compile an accurate scanning report to provide a basis for vulnerability mining.

[0059] See also Figure 3 As shown, the specific implementation of the APK intelligent scanning step is as follows.

[0060] S31, third-party library information acquisition: Use the third-party library scanning tool to obtain detailed information about the third-party library used in the APK, including the name of the third-party library, the package name of the third-party library, and the version of the third-party library used.

[0061] S32, APK sensitive information acquisition and organization: Use multiple scanning tools to scan the APK, and the scanning results will be repeated and redundant. Use the sensitive information collection agent group to schedule the configuration file analysis agent and the hard-coded information analysis agent to organize and deduplicate the redundant scanning information. The configuration file analysis agent can analyze the AndroidManifest.xml file and perform a detailed analysis of the permission list involved in the APK to determine whether there is a problem of collecting user privacy. In addition, the configuration file analysis agent can also analyze the export status of the four major components and analyze whether there are security issues such as unauthorized access. The hard-coded information analysis agent analyzes whether there is unsafe hard-coded information by scanning the code, such as the username and password for connecting to the server, API key information, and unsafe encryption information, etc.

[0062] S33, return the scan report: organize the scan results of the agent group and the scanned third-party library information, and generate a scan report.

[0063] S4, vulnerability mining step: Based on the scanning report generated in the scanning phase and the high-level programming language code obtained by decompilation, combined with the third-party library-vulnerability number database, text matching and database matching technology are used to conduct in-depth vulnerability mining, and the CVE vulnerability number obtained by database matching and the vulnerability scanning information obtained by text matching are returned;

[0064] See also Figure 4 As shown, the specific implementation of the vulnerability mining step is as follows.

[0065] S41, scanning information preprocessing: sorting out the scanning report generated by the previous module and the source code generated by decompilation as the input of vulnerability mining. The vulnerability mining process is divided into two parts: the first part is to match the third-party library vulnerabilities based on the database, and the second part is to mine vulnerabilities based on text matching.

[0066] S42, database-based third-party library vulnerability matching: According to the name and version information of the third-party library used by the decompiled high-level programming language code, the vulnerabilities existing in these third-party libraries are queried in the third-party library-vulnerability number database, and the vulnerability number is returned; for example, a third-party library is used in the APK code file, and its package name is com.alibaba, the third-party library name is fastjson, and the version name is 1.2.11. After searching in the third-party library-vulnerability number database, the vulnerability CVE-2017-18349 existing in the third-party library is returned.

[0067] S43, vulnerability mining based on text matching: match the resource files and code files in the decompressed APK folder using regular text matching tools, and return the corresponding vulnerability scanning information. In order to reduce the false negative rate of vulnerability scanning, a special YAML scanning template is formulated for each matching rule. For example, when calling the PendingIntent.getBroadcast method, the PendingIntent.FLAG_MUTABLE and PendingIntent.FLAG_IMMUTABLE flags are not set, which allows attackers to hijack the Intent. Create a YAML scanning template for scanning this vulnerability, add a detailed description of this vulnerability and the hazard level, and the regular expression used for detection is as follows " PendingIntent\.getBroadcast\(\s*this\s*,\s*\d+\s*,\s*intent\s*(?!\,\s*PendingIntent\.(FLAG_IMMUTABLE|FLAG_MUTABLE))\s*\)". If the vulnerability is matched during the text matching process, the detailed information and hazard level of the vulnerability are returned.

[0068] S5, vulnerability verification step: The vulnerability verification agent receives the vulnerability number and vulnerability scanning information returned in the vulnerability mining phase, executes the attack script and uses the attack tool based on the vulnerability details and high-level programming language code to verify whether the corresponding vulnerability actually exists in the APK to be tested; and compiles the final verification results into a test report for users to read.

[0069] See also Figure 5 As shown, the specific implementation of the vulnerability verification step is as follows.

[0070] S51, vulnerability verification preparation: The vulnerability verification agent receives the vulnerability number and vulnerability scanning information returned by the vulnerability mining phase, searches and reads the vulnerability details in the vulnerability details database, and then finds the specific location of the vulnerability and the corresponding code context in the decompiled high-level programming language code. Then the agent selects the appropriate attack tool and generates an attack script to complete the preparation for vulnerability verification.

[0071] S52, vulnerability exploitation script generation: After analyzing the vulnerability details, the vulnerability verification agent generates an attack script and determines the attack tool to be used.

[0072] S53, vulnerability exploitation: The vulnerability verification agent executes the attack script and uses the attack tool to attack the target APK.

[0073] S54, return the vulnerability verification result: After the vulnerability verification is completed, the vulnerability verification agent analyzes whether the attack result meets expectations. If it does not meet expectations, it proves that the vulnerability does not exist and the vulnerability is excluded. If it meets expectations, it proves that the vulnerability exists and returns a detailed test report, including the verified vulnerability number, the tools used, and the vulnerability test script. For example, vulnerability A is identified in the vulnerability mining stage, and vulnerability A has the hazard of local privilege escalation. If the vulnerability verification agent fails to escalate privileges after the attack, the vulnerability verification fails.

[0074] See also Figure 6 As shown, the present invention also discloses an Android application vulnerability detection system based on multi-agent collaboration, comprising:

[0075] The present invention is divided into two stages, a preparation stage and a detection stage. The preparation stage includes the following modules:

[0076] Vulnerability information sorting module 601: used to sort out vulnerability details on the vulnerability website regularly based on the vulnerability analysis agent, add them to the vulnerability details database, regularly collect vulnerabilities existing in third-party libraries on the vulnerability website, and add them to the third-party library-vulnerability number database.

[0077] The detection phase includes the following modules:

[0078] APK decompression and decompilation module 602: used to decompress the Android application package APK to obtain a decompressed APK folder, and use decompilation technology to decompile the binary code in the decompressed APK folder into a readable high-level programming language code;

[0079] APK intelligent scanning module 603: used to scan the decompressed APK folder to obtain scanning data; use the sensitive information collection agent group to deduplicate, verify and classify the scanning data; summarize the scanning data and the information processed by the sensitive information collection agent group to compile a scanning report;

[0080] Vulnerability mining module 604: used to perform in-depth vulnerability mining based on the scan report generated in the scanning phase and the high-level programming language code obtained by decompilation, in combination with the third-party library-vulnerability number database, using text matching and database matching technology, and returning the CVE vulnerability number obtained by database matching and the vulnerability scanning information obtained by text matching;

[0081] Vulnerability verification module 605: used to verify whether the APK to be tested contains the vulnerabilities obtained during the vulnerability mining phase; the vulnerability verification agent receives the vulnerability number and performs verification by simulating attack scenarios; the final result of the verification will be compiled into a test report.

[0082] The specific implementation of the Android application vulnerability detection method and system based on multi-agent collaboration is the same as the Android application vulnerability detection method based on multi-agent collaboration, and will not be repeated in this embodiment.

[0083] In summary, the present invention can automatically mine the vulnerabilities contained in the Android application, improve the efficiency of finding vulnerabilities, and verify whether the vulnerabilities exist. At the same time, the introduction of the joint cooperation mechanism of multi-agent agents can improve the efficiency and accuracy of the process.

[0084] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. An Android application vulnerability detection method based on multi-agent collaboration, characterized in that: include: S1, vulnerability information collation step: adding vulnerability details regularly collated on the vulnerability website into the vulnerability details database; adding the vulnerabilities existing in the third-party library regularly collected on the vulnerability website into the third-party library-vulnerability number database; S2, APK decompression and decompilation step: decompress the Android application package APK to obtain a decompressed APK folder, and use decompilation technology to decompile the binary code in the decompressed APK folder into a high-level programming language code; S3, APK intelligent scanning step: Scan the decompressed APK folder to obtain scanning data; use the sensitive information collection agent group to deduplicate, verify and classify the scanning data; summarize the scanning data and the information processed by the sensitive information collection agent group to compile a scanning report; S4, vulnerability mining step: Based on the scan report generated by the scan and the high-level programming language code obtained by decompilation, combined with the third-party library-vulnerability number database, text matching and database matching technology are used to perform vulnerability mining, and the CVE vulnerability number obtained by database matching and the vulnerability scanning information obtained by text matching are returned; S5, vulnerability verification step: The vulnerability verification agent receives the vulnerability number and vulnerability scanning information returned in the vulnerability mining phase, executes the attack script and uses the attack tool based on the vulnerability details and high-level programming language code to verify whether the corresponding vulnerability actually exists in the APK to be detected; The final verification results are compiled into a test report; the vulnerability information collation steps specifically include: S11, using vulnerability analysis agents to regularly organize and analyze detailed information of vulnerabilities on vulnerability websites, and add vulnerability numbers, vulnerability overviews, vulnerability exploitation scripts, vulnerability risk levels, and vulnerability repair suggestions into the vulnerability detailed information database; S12, using vulnerability analysis agents to regularly collect vulnerabilities in third-party libraries on vulnerability websites, and adding the vulnerabilities in third-party libraries to the third-party library-vulnerability number database; The vulnerability mining steps specifically include: S41, scanning information preprocessing: arranging the generated scanning report and the decompiled high-level programming language code as input for vulnerability mining; S42, database-based third-party library vulnerability matching: according to the name and version information of the third-party library used in the decompiled high-level programming language code, query the third-party library-vulnerability number database for vulnerabilities existing in these third-party libraries, and return the vulnerability number; S43, vulnerability mining based on text matching: pre-set regular matching rules in the text matching tool, match the resource files after decompression of the APK with the decompiled code files, and return the matching vulnerability scanning information; The vulnerability verification steps specifically include: S51, vulnerability verification preparation: the vulnerability verification agent receives the vulnerability number and vulnerability scanning information returned in the vulnerability mining phase, searches and reads the vulnerability details in the vulnerability details database, and finds the specific location of the vulnerability and the corresponding code context in the decompiled high-level programming language code; S52, vulnerability exploitation script generation: after analyzing the vulnerability details, the vulnerability verification agent generates an attack script and determines the attack tool to be used; S53, vulnerability exploitation: the vulnerability verification agent executes the attack script and uses the attack tool to attack the target APK; S54, return the vulnerability verification result: After the vulnerability verification is completed, the vulnerability verification agent analyzes whether the attack result meets the expectations; if it does not meet the expectations, it proves that the vulnerability does not exist and the vulnerability is eliminated; if it meets the expectations, it proves that the vulnerability exists and returns a detailed test report, including the verified vulnerability number, the tools used, and the vulnerability test script.

2. The Android application vulnerability detection method based on multi-agent collaboration according to claim 1 is characterized in that: The APK decompression and decompilation steps specifically include: S21, decompress the Android application package APK to obtain a decompressed APK folder; S22, try to decompress and obtain high-level programming language code; determine whether the decompressed APK folder is shelled, if not, jump to step S23; if it is shelled, use a shelling tool to remove the protective layer of the APK folder, if the shelling fails, jump to S23; if the shelling is successful, obtain the binary executable file of the source code, and then use a decompilation tool to convert the binary file into a high-level programming language, and end the step; S23, decompile the decompressed binary file and convert it into a high-level programming language.

3. The Android application vulnerability detection method based on multi-agent collaboration according to claim 1 is characterized in that: The APK intelligent scanning step specifically includes: S31, the tool calling agent calls a third-party library scanning tool and multiple sensitive information scanning tools to scan the decompressed APK folder, and returns the third-party library information used by the APK and the APK sensitive information; S32, calling different agents in the sensitive information collection agent group to perform deduplication, verification and classification on the sensitive information scanning results, and returning the sorted results; S33, sort out the third-party library information and sensitive information collection agent group return results, and generate a scan report.

4. An Android application vulnerability detection system based on multi-agent collaboration, characterized in that: include: Vulnerability information sorting module: used to sort out vulnerability details on the vulnerability website regularly based on the vulnerability analysis agent, add them to the vulnerability details database, regularly collect vulnerabilities existing in third-party libraries on the vulnerability website, and add them to the third-party library-vulnerability number database; APK decompression and decompilation module: used to decompress the Android application package APK to obtain the decompressed APK folder, and use the decompilation technology to decompile the binary code in the decompressed APK folder into readable high-level programming language code; APK intelligent scanning module: used to scan the unzipped APK folder to obtain scanning data; use the sensitive information collection agent group to deduplicate, verify and classify the scanning data; summarize the scanning data and the information processed by the sensitive information collection agent group to compile a scanning report; Vulnerability mining module: Based on the scan report generated in the scanning phase and the high-level programming language code obtained by decompilation, combined with the third-party library-vulnerability number database, it uses text matching and database matching technology to conduct in-depth vulnerability mining, and returns the CVE vulnerability number obtained by database matching and the vulnerability scanning information obtained by text matching; Vulnerability verification module: used to verify whether the APK to be tested contains the vulnerabilities obtained in the vulnerability mining phase; the vulnerability verification agent receives the vulnerability number and verifies it by simulating attack scenarios; the final verification result will be compiled into a test report; The vulnerability information sorting module is specifically used to: Use vulnerability analysis agents to regularly organize and analyze vulnerability details on vulnerability websites, and add vulnerability numbers, vulnerability overviews, vulnerability exploitation scripts, vulnerability risk levels, and vulnerability repair suggestions to the vulnerability details database; Use vulnerability analysis agents to regularly collect vulnerabilities in third-party libraries on vulnerability websites, and add the vulnerabilities in third-party libraries to the third-party library-vulnerability number database; The vulnerability mining module is specifically used for: Scan information preprocessing: organize the generated scan reports and decompiled high-level programming language codes as input for vulnerability mining; Database-based third-party library vulnerability matching: Based on the names and version information of the third-party libraries used in the decompiled high-level programming language code, the third-party library-vulnerability number database is used to query the vulnerabilities in these third-party libraries and return the vulnerability numbers. Vulnerability mining based on text matching: pre-set regular matching rules in the text matching tool, match the decompressed APK resource files with the decompiled code files, and return the matching vulnerability scanning information; The vulnerability verification module is specifically used for: Vulnerability verification preparation: The vulnerability verification agent receives the vulnerability number and vulnerability scanning information returned in the vulnerability mining phase, searches and reads the vulnerability details in the vulnerability details database, and finds the specific location of the vulnerability and the corresponding code context in the decompiled high-level programming language code; Vulnerability exploit script generation: After analyzing the vulnerability details, the vulnerability verification agent generates an attack script and determines the attack tool to be used; Vulnerability Exploitation: The vulnerability verification agent executes the attack script and uses the attack tool to attack the target APK; Return vulnerability verification results: After the vulnerability verification is completed, the vulnerability verification agent analyzes whether the attack results meet expectations; if not, it proves that the vulnerability does not exist and the vulnerability is ruled out; if it meets expectations, it proves that the vulnerability exists and returns a detailed test report, including the verified vulnerability number, the tools used, and the vulnerability test script.

Images