System and method for carrying out security scanning on mobile application

Abstract

The invention provides a system and a method for safely scanning a mobile application, and the system and the method for safely scanning the mobile application comprise a pre-scanning module which is used for carrying out preliminary attribute and format checking on an uploaded mobile application file, and querying a database to determine whether the analysis has been performed on the file; the code extraction and file analysis module is connected with the pre-scanning module; the code extraction and file analysis module is used for carrying out deep analysis on a mobile application and extracting key application information and codes; a vulnerability scanning module; the permission detection module is used for detecting the system permission requested by the mobile application; a signature detection module; a sensitive information detection module; and a report generation module. Security vulnerabilities can be quickly identified, permission abuse can be detected, the data leakage risk can be evaluated, and a clear security report can be provided.

Description

Technical Field

[0001] The present invention relates to the technical field of security scanning of mobile applications, and provides a system and method for security scanning of mobile applications. Background Art

[0002] In the era of mobile Internet, mobile applications (Apps) have become a part of people's lives, but the security issues that come with it are becoming increasingly severe. Security threats such as malware, data leakage, and permission abuse pose serious challenges to user privacy and device security. Although there are some security scanning tools on the market, they often cannot fully cover the security needs of mobile applications, especially in static code analysis, permission abuse detection, data leakage risk assessment, etc. There are obvious deficiencies.

[0003] The existing APP scanning system has the following shortcomings: (1) Insufficient security scanning: Existing tools mostly focus on virus detection and lack in-depth analysis of security vulnerabilities in the code; (2) Permission abuse: Apps often request unnecessary permissions, increasing the risk of user privacy leakage; (3) Data leakage risk: The application has improper behavior when processing user data, and the risk of data leakage is high; (4) Insufficient signature and source verification: Malicious applications can be mixed into the application market by forging signatures, making them difficult to identify. Summary of the invention

[0004] The present invention provides a system and method for security scanning of mobile applications in order to solve the following technical problems: insufficient security scanning: existing tools mostly focus on virus detection and lack in-depth analysis of security vulnerabilities in the code; permission abuse: applications often request unnecessary permissions, increasing the risk of user privacy leakage; data leakage risk: applications have improper behavior when processing user data, and the risk of data leakage is high; insufficient signature and source verification: malicious applications can be mixed into the application market by forging signatures, making them difficult to identify.

[0005] The present invention solves the above technical problems through the following technical solutions: The present invention provides a system and method for performing security scanning on a mobile application. The system and method for performing security scanning on a mobile application include: A pre-scanning module, the pre-scanning module is used to perform a preliminary attribute and format check on the uploaded mobile application file, and query the database to determine whether the file has been analyzed; A code extraction and file parsing module, which is connected to the pre-scanning module; the code extraction and file parsing module is used to perform in-depth analysis on the mobile application and extract key application information and code; A vulnerability scanning module, which is used to identify and mark known security vulnerabilities in the application; A permission detection module, the permission detection module is used to detect the system permissions requested by the mobile application; A signature detection module, which is responsible for verifying the authenticity of the signature of the mobile application; A sensitive information detection module, wherein the sensitive information detection module is used to identify sensitive information that may be contained in the mobile application; A report generation module, which is used to summarize the results of each detection module; The code extraction and file parsing module is electrically connected to the vulnerability scanning module, the permission detection module, the signature detection module and the sensitive information detection module, and the vulnerability scanning module, the permission detection module, the signature detection module and the sensitive information detection module are electrically connected to the report generation module.

[0006] Furthermore, the pre-scanning module is unidirectionally connected to the code extraction and file parsing module, the code extraction and file parsing module is unidirectionally connected to the vulnerability scanning module, the permission detection module, the signature detection module and the sensitive information detection module respectively, and the vulnerability scanning module, the permission detection module, the signature detection module and the sensitive information detection module are unidirectionally connected to the report generation module respectively.

[0007] Furthermore, a method for performing security scanning on a mobile application is provided, wherein the method for performing security scanning on a mobile application comprises the following steps: (I) The pre-scan module performs a preliminary property and format check on the uploaded mobile application file, and queries the database to determine whether the file has been analyzed before. If the database already has relevant analysis records, the system will directly retrieve and return the previously analyzed data; if it is the first scan, the system will initialize a new security scan process. The pre-scan module passes the information to the code extraction and file parsing module, which performs in-depth analysis of the mobile application and extracts key application information and code. This process is the cornerstone of security analysis and ensures that subsequent modules can accurately identify and assess potential risks in the application; (ii) The code extraction and file parsing module passes the information to the vulnerability scanning module, permission detection module, signature detection module and sensitive information detection module for processing. The vulnerability scanning module compares the application code with a comprehensive database of known vulnerability features to identify and mark known security vulnerabilities in the application and provide developers with repair directions. The permission detection module detects the system permissions requested by the mobile application, especially those sensitive permission requests that may involve user privacy. Through detailed permission analysis, this module helps identify and warn those requests that may abuse user permissions. The signature detection module verifies the authenticity of the signature of the mobile application. This module ensures the legitimacy of the application source and prevents malicious applications from entering the formal application market by forging signatures, thereby protecting users from malware. The sensitive information detection module identifies sensitive information that may be contained in mobile applications, such as personal identity data, financial information and keys, assesses the risk of data leakage, and provides corresponding protection suggestions; (III) The information processed by the vulnerability scanning module, permission detection module, signature detection module and sensitive information detection module is passed to the report generation module, which summarizes the results of each detection module and supports exporting the security assessment report into PDF, Excel, CSV, Json and other formats for internal security operations personnel to conduct security scoring and further assessment and analysis.

[0008] Furthermore, the processing method of the pre-scanning module includes the following steps: a. Determine the file type submitted for scanning and perform differentiated scanning for different application types; b. Generate MD5 value for comparison with scanned records in the database; c. Query records in the database. If there is a direct query and the data is returned, if it is the first scan, the scan will start from scratch; d. Mark whether it is the first scan or just query status.

[0009] Furthermore, the code extraction and file parsing module processing method comprises the following steps: a. Unzip the application and obtain the application source resource file; b. For Android applications, extract the Manifest.xml file and start parsing the data in the file; for iOS applications, extract the Info.plist file; c. Extract the uses-permission parameter for subsequent permission detection and analysis; d. Extract certificate files, including cer, pem, cert, pub, key, pfx, p12 and other certificate files, as well as jbs, bks and other key library files; e. Decompile the mobile application into code using tools such as apktool or budletool for subsequent vulnerability scanning; d. Write each extracted result into the database.

[0010] Furthermore, the vulnerability scanning module processing method includes the following steps: a. Obtain vulnerability features, repair suggestions, etc. from the vulnerability database; b. Match and compare the code with the features through regular expressions; c. Save the matching results in the database.

[0011] Furthermore, the permission detection module processing method includes the following steps: a. Read the extracted application permission data from the database; b. Classify and grade permissions, mainly into dangerous permissions (level 3), core permissions (level 2 and), special permissions (level 1), and other permission information (level 0); c. Analyze the permission information, identify sensitive permissions in the permission list, such as access to contacts, text messages, locations, etc., and issue risk warnings; d. The detection data is stored in the database.

[0012] Furthermore, the signature detection module processing method includes the following steps: a. Use the apksigner tool to extract the signature certificate information of the application, including v1-v4signature, Signature Algorithm, Issuer, Bit Size, Fingerprint and other information; b. Compare the signature certificate information with the internal APP certificate to confirm the legitimacy; c. If the comparison is inconsistent, the risk will be prompted; d. The detection data is stored in the database.

[0013] Furthermore, the sensitive information detection module processing method includes the following steps: a. Use tools such as apktool or budletool to decompile the application file; b. Use regular expression to match keywords, including pwd, passwd, miyao and other constant strings; c. The test data is stored in the database.

[0014] Furthermore, the report generation module processing method includes the following steps: a. Obtain the test results of each module; b. Combine the detection results of each module and output them in PDF format.

[0015] On the basis of being in accordance with the common sense in the art, the above-mentioned preferred conditions can be arbitrarily combined to obtain the preferred embodiments of the present invention.

[0016] The positive and progressive effects of the present invention are: The above-mentioned system and method for security scanning of mobile applications can quickly identify security vulnerabilities, detect abuse of permissions, assess data leakage risks, and provide clear security reports; Through static code analysis, combined with vulnerability detection, permission detection, signature certificate detection, and sensitive information identification, it can fully cover the security needs of mobile applications and discover potential security vulnerabilities and risks. By identifying security vulnerabilities in mobile applications at an early stage, the cost and time of later repairs can be reduced, and potential losses caused by the exploitation of vulnerabilities can be avoided; Achieve automated detection, reduce manual intervention, and generate highly readable reports for internal security operations personnel to analyze, thereby reducing security management costs and improving efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application.

[0018] Figure 1 The figure is a schematic diagram of the overall system of the system and method for performing security scanning on mobile applications according to the present invention.

[0019] Figure 2 This is a flow chart of a pre-scanning module processing method of a system and method for performing security scanning on mobile applications of the present invention.

[0020] Figure 3 This is a flow chart of the code extraction and file parsing module processing method of the system and method for performing security scanning on mobile applications of the present invention.

[0021] Figure 4 This is a flow chart of a vulnerability scanning module processing method of the system and method for performing security scanning on mobile applications of the present invention.

[0022] Figure 5 This is a flow chart of a permission detection module processing method of a system and method for performing security scanning on mobile applications of the present invention.

[0023] Figure 6 This is a flow chart of a signature detection module processing method of a system and method for performing security scanning on mobile applications of the present invention.

[0024] Figure 7This is a flow chart of a sensitive information detection module processing method of a system and method for performing security scanning on mobile applications of the present invention.

[0025] Figure 8 This is a flow chart of a report generation module processing method of a system and method for performing security scanning on mobile applications of the present invention.

[0026] Description of Reference Numerals 1. Pre-scanning module; 2. Code extraction and file parsing module; 3. Vulnerability scanning module; 4. Permission detection module; 5. Signature detection module; 6. Sensitive information detection module; 7. Report generation module. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application may be combined with each other.

[0029] like Figure 1-8 As shown, the system and method for performing security scanning on mobile applications include: A pre-scanning module 1, the pre-scanning module 1 is used to perform a preliminary attribute and format check on the uploaded mobile application file, and query the database to determine whether the file has been analyzed; A code extraction and file parsing module 2, which is connected to the pre-scanning module 1; the code extraction and file parsing module 2 is used to perform in-depth analysis on the mobile application and extract key application information and code; A vulnerability scanning module 3, wherein the vulnerability scanning module 3 is used to identify and mark known security vulnerabilities in the application; A permission detection module 4, wherein the permission detection module 4 is used to detect the system permissions requested by the mobile application; A signature detection module 5, which is responsible for verifying the authenticity of the signature of the mobile application; A sensitive information detection module 6, which is used to identify sensitive information that may be contained in the mobile application; A report generation module 7, wherein the report generation module 7 is used to summarize the results of each detection module; The code extraction and file parsing module 2 is electrically connected to the vulnerability scanning module 3, the permission detection module 4, the signature detection module 5 and the sensitive information detection module 6, and the vulnerability scanning module 3, the permission detection module 4, the signature detection module 5 and the sensitive information detection module 6 are electrically connected to the report generation module 7.

[0030] The pre-scanning module 1 is unidirectionally connected to the code extraction and file parsing module 2, and the code extraction and file parsing module 2 is unidirectionally connected to the vulnerability scanning module 3, the permission detection module 4, the signature detection module 5 and the sensitive information detection module 6 respectively, and the vulnerability scanning module 3, the permission detection module 4, the signature detection module 5 and the sensitive information detection module 6 are unidirectionally connected to the report generation module 7 respectively.

[0031] like Figure 1-8 As shown, a method for performing security scanning on a mobile application includes the following steps: (I) Pre-scanning module 1 performs a preliminary property and format check on the uploaded mobile application file, and queries the database to determine whether the file has been analyzed. If the database already has relevant analysis records, the system will directly retrieve and return the previously analyzed data; if it is the first scan, the system will initialize a new security scanning process. Pre-scanning module 1 passes the information to code extraction and file parsing module 2. Code extraction and file parsing module 2 performs in-depth analysis of the mobile application and extracts key application information and code. This process is the cornerstone of security analysis and ensures that subsequent modules can accurately identify and assess potential risks in the application; (ii) The code extraction and file parsing module 2 passes the information to the vulnerability scanning module 3, the permission detection module 4, the signature detection module 5 and the sensitive information detection module 6 for processing. The vulnerability scanning module 3 compares the application code with a comprehensive database of known vulnerability features to identify and mark known security vulnerabilities in the application and provide developers with repair directions. The permission detection module 4 detects the system permissions requested by the mobile application, especially those sensitive permission requests that may involve user privacy. Through detailed permission analysis, this module helps identify and warn those requests that may abuse user permissions. The signature detection module 5 verifies the authenticity of the signature of the mobile application. This module ensures the legitimacy of the application source and prevents malicious applications from mixing into the formal application market by forging signatures, thereby protecting users from malware. The sensitive information detection module 6 identifies sensitive information that may be contained in the mobile application, such as personal identity data, financial information and keys, assesses the risk of data leakage, and provides corresponding protection suggestions; (III) The information processed by the vulnerability scanning module 3, the permission detection module 4, the signature detection module 5 and the sensitive information detection module 6 is passed to the report generation module 7, which summarizes the results of each detection module and supports exporting the security assessment report into PDF, Excel, CSV, Json and other formats for internal security operations personnel to conduct security scoring and further assessment and analysis.

[0032] like Figure 2 As shown, the processing method of the pre-scanning module 1 includes the following steps: a. Determine the file type submitted for scanning and perform differentiated scanning for different application types; b. Generate MD5 value for comparison with scanned records in the database; c. Query records in the database. If there is a direct query and the data is returned, if it is the first scan, the scan will start from scratch; d. Mark whether it is the first scan or just query status.

[0033] like Figure 3 As shown, the code extraction and file parsing module 2 processing method includes the following steps: a. Unzip the application and obtain the application source resource file; b. For Android applications, extract the Manifest.xml file and start parsing the data in the file; for iOS applications, extract the Info.plist file; c. Extract the uses-permission parameter for subsequent permission detection and analysis; d. Extract certificate files, including cer, pem, cert, pub, key, pfx, p12 and other certificate files, as well as jbs, bks and other key library files; e. Decompile the mobile application into code using tools such as apktool or budletool for subsequent vulnerability scanning; d. Write each extracted result into the database.

[0034] like Figure 4 As shown, the vulnerability scanning module 3 processing method includes the following steps: a. Obtain vulnerability features, repair suggestions, etc. from the vulnerability database; b. Match and compare the code with the features through regular expressions; c. Save the matching results in the database.

[0035] like Figure 5 As shown, the processing method of the permission detection module 4 includes the following steps: a. Read the extracted application permission data from the database; b. Classify and grade permissions, mainly into dangerous permissions (level 3), core permissions (level 2 and), special permissions (level 1), and other permission information (level 0); c. Analyze the permission information, identify sensitive permissions in the permission list, such as access to contacts, text messages, locations, etc., and issue risk warnings; d. The detection data is stored in the database.

[0036] like Figure 6 As shown, the signature detection module 5 processing method includes the following steps: a. Use the apksigner tool to extract the signature certificate information of the application, including v1-v4signature, Signature Algorithm, Issuer, Bit Size, Fingerprint and other information; b. Compare the signature certificate information with the internal APP certificate to confirm the legitimacy; c. If the comparison is inconsistent, the risk will be prompted; d. The detection data is stored in the database.

[0037] like Figure 7 As shown, the processing method of the sensitive information detection module 6 includes the following steps: a. Use tools such as apktool or budletool to decompile the application file; b. Use regular expression to match keywords, including pwd, passwd, miyao and other constant strings; c. The test data is stored in the database.

[0038] like Figure 8 As shown, the report generation module 7 processing method includes the following steps: a. Obtain the test results of each module; b. Combine the detection results of each module and output them in PDF format.

[0039] This system and method for performing security scanning on mobile applications can quickly identify security vulnerabilities, detect abuse of permissions, assess data leakage risks, and provide clear security reports; through static code analysis, combined with vulnerability detection, permission detection, signature certificate detection, sensitive information identification and multiple dimensions of security detection technology, it can comprehensively cover the security needs of mobile applications and discover potential security vulnerabilities and risks; by early identification of security vulnerabilities in mobile applications, the cost and time of subsequent repairs can be reduced, and potential losses caused by the exploitation of vulnerabilities can be avoided; automatic detection is achieved, manual intervention is reduced, and by generating highly readable reports for internal security operations personnel to analyze, security management costs can be reduced and efficiency improved.

[0040] The circuits, electronic components and modules involved are all prior art and can be fully implemented by those skilled in the art, and needless to say, the content protected by this application does not involve improvements to software and methods.

[0041] The present invention is not limited to the above-mentioned embodiments. Any changes in shape or structure are within the protection scope of the present invention. The protection scope of the present invention is defined by the attached claims. Those skilled in the art can make various changes or modifications to these embodiments without departing from the principle and essence of the present invention, but these changes and modifications are within the protection scope of the present invention.

Claims

1. A system for performing security scanning on mobile applications, characterized in that: The system for performing security scanning on mobile applications comprises: A pre-scanning module (1), the pre-scanning module (1) being used to perform a preliminary attribute and format check on the uploaded mobile application file, and query a database to determine whether the file has been analyzed; A code extraction and file parsing module (2), the code extraction and file parsing module (2) being connected to the pre-scanning module (1); the code extraction and file parsing module (2) being used to perform in-depth analysis on the mobile application and extract key application information and code; A vulnerability scanning module (3), the vulnerability scanning module (3) being used to identify and mark known security vulnerabilities existing in the application; A permission detection module (4), the permission detection module (4) is used to detect the system permissions requested by the mobile application; A signature detection module (5), the signature detection module (5) being responsible for verifying the authenticity of the signature of the mobile application; A sensitive information detection module (6), the sensitive information detection module (6) being used to identify sensitive information that may be contained in the mobile application; A report generation module (7), the report generation module (7) is used to summarize the results of each detection module; The code extraction and file parsing module (2) is electrically connected to the vulnerability scanning module (3), the permission detection module (4), the signature detection module (5) and the sensitive information detection module (6); and the vulnerability scanning module (3), the permission detection module (4), the signature detection module (5) and the sensitive information detection module (6) are electrically connected to the report generation module (7).

2. A system for performing security scanning on mobile applications as claimed in claim 1, characterized in that: The pre-scanning module (1) is unidirectionally connected to the code extraction and file parsing module (2), the code extraction and file parsing module (2) is unidirectionally connected to the vulnerability scanning module (3), the permission detection module (4), the signature detection module (5) and the sensitive information detection module (6), respectively, and the vulnerability scanning module (3), the permission detection module (4), the signature detection module (5) and the sensitive information detection module (6) are unidirectionally connected to the report generation module (7).

3. A method for performing security scanning on a mobile application is derived from a system for performing security scanning on a mobile application as described in any one of claims 1 to 8, characterized in that: The method for security scanning of mobile applications comprises the following steps: (i) performing preliminary attribute and format checks on the uploaded mobile application file through a pre-scanning module (1), and querying a database to determine whether the file has been analyzed. If relevant analysis records already exist in the database, the system will directly retrieve and return the previously analyzed data; If it is the first scan, the system will initialize a new security scan process. The pre-scan module (1) passes the information to the code extraction and file parsing module (2). The code extraction and file parsing module (2) performs a deep analysis of the mobile application to extract key application information and code. This process is the cornerstone of security analysis and ensures that subsequent modules can accurately identify and evaluate potential risks in the application. (ii) The code extraction and file parsing module (2) passes the information to the vulnerability scanning module (3), the permission detection module (4), the signature detection module (5) and the sensitive information detection module (6) for processing. The vulnerability scanning module (3) compares the application code with a comprehensive database of known vulnerability features to identify and mark known security vulnerabilities in the application and provide developers with repair directions. The permission detection module (4) detects the system permissions requested by the mobile application, especially those sensitive permission requests that may involve user privacy. Through detailed permission analysis, this module helps identify and warn those requests that may abuse user permissions. The signature detection module (5) verifies the authenticity of the signature of the mobile application. This module ensures the legitimacy of the application source and prevents malicious applications from entering the formal application market by forging signatures, thereby protecting users from malware. The sensitive information detection module (6) identifies sensitive information that may be contained in the mobile application, such as personal identity data, financial information and keys, assesses the risk of data leakage, and provides corresponding protection suggestions; (iii) The information processed by the vulnerability scanning module (3), the permission detection module (4), the signature detection module (5) and the sensitive information detection module (6) is transmitted to the report generation module (7). The report generation module (7) summarizes the results of each detection module and supports exporting the security assessment report into PDF, Excel, CSV, Json and other formats for internal security operations personnel to perform security scoring and further assessment and analysis.

4. A method for security scanning of mobile applications as claimed in claim 3, characterized in that: The processing method of the pre-scanning module (1) comprises the following steps: a. Determine the file type submitted for scanning and perform differentiated scanning for different application types; b. Generate MD5 value for comparison with scanned records in the database; c. Query records in the database. If there is a direct query and the data is returned, if it is the first scan, the scan will start from scratch; d. Mark whether it is the first scan or just query status.

5. A method for security scanning of mobile applications as claimed in claim 3, characterized in that: The code extraction and file parsing module (2) processing method comprises the following steps: a. Unzip the application and obtain the application source resource file; b. For Android applications, extract the Manifest.xml file and start parsing the data in the file; for iOS applications, extract the Info.plist file; c. Extract the uses-permission parameter for subsequent permission detection and analysis; d. Extract certificate files, including cer, pem, cert, pub, key, pfx, p12 and other certificate files, as well as jbs, bks and other key library files; e. Decompile the mobile application into code using tools such as apktool or budletool for subsequent vulnerability scanning; d. Write each extracted result into the database.

6. A method for security scanning of mobile applications as claimed in claim 3, characterized in that: The vulnerability scanning module (3) processing method comprises the following steps: a. Obtain vulnerability features, repair suggestions, etc. from the vulnerability database; b. Match and compare the code with the features through regular expressions; c. Save the matching results in the database.

7. A method for security scanning of mobile applications as claimed in claim 3, characterized in that: The processing method of the permission detection module (4) comprises the following steps: a. Read the extracted application permission data from the database; b. Classify and grade permissions, mainly into dangerous permissions (level 3), core permissions (level 2 and), special permissions (level 1), and other permission information (level 0); c. Analyze the permission information, identify sensitive permissions in the permission list, such as access to contacts, text messages, locations, etc., and issue risk warnings; d. The detection data is stored in the database.

8. A method for security scanning of mobile applications as claimed in claim 3, characterized in that: The signature detection module (5) processing method comprises the following steps: a. Use the apksigner tool to extract the signature certificate information of the application, including v1-v4signature, Signature Algorithm, Issuer, Bit Size, Fingerprint and other information; b. Compare the signature certificate information with the internal APP certificate to confirm the legitimacy; c. If the comparison is inconsistent, the risk will be prompted; d. The detection data is stored in the database.

9. A method for security scanning of mobile applications as claimed in claim 3, characterized in that: The sensitive information detection module (6) processing method comprises the following steps: a. Use tools such as apktool or budletool to decompile the application file; b. Use regular expression to match keywords, including pwd, passwd, miyao and other constant strings; c. The test data is stored in the database.

10. A method for security scanning of mobile applications as claimed in claim 3, characterized in that: The report generation module (7) processing method comprises the following steps: a. Obtain the test results of each module; b. Combine the detection results of each module and output them in PDF format.

Images