A mobile application component vulnerability analysis method and analysis device

Abstract

The application provides a mobile application component vulnerability analysis method and analysis device, and relates to the technical field of vulnerability analysis.The method comprises the following steps: performing static reverse assembly on a mobile application file instruction, and constructing a control flow graph; performing feature extraction according to a preset feature group; constructing a mobile application binary feature vector; performing multi-dimensional feature extraction on an open source component set; constructing a vulnerability matching analysis space, performing multi-dimensional neighbor matching according to the mobile application binary feature vector; obtaining a target open source component set, and performing component vulnerability analysis to obtain a component vulnerability analysis result.The application solves the technical problem that, in the prior art, complex factors in open source components and mobile applications are ignored during vulnerability analysis, security risks in mobile application components cannot be fully revealed, and vulnerability detection efficiency is low.The matching of the open source component feature vector and the application binary feature vector improves the accuracy and efficiency of vulnerability detection.

Description

Technical Field

[0001] This application relates to the field of vulnerability analysis technology, and in particular to a method and apparatus for analyzing vulnerabilities in mobile application components. Background Technology

[0002] With the rapid development of the mobile internet, mobile applications are increasingly widely used in various fields. Vulnerability analysis of mobile application components, by analyzing component dependencies and known vulnerability databases, can uncover potential security risks and improve the security of mobile applications. Currently, there are two main methods for mobile application vulnerability detection: dynamic analysis and static analysis. Dynamic analysis methods monitor the runtime behavior of the application, which can capture some vulnerabilities but cannot cover all execution paths and has high testing costs and time consumption, thus having limitations. Static analysis methods, on the other hand, analyze the static information of the application to extract valuable features for vulnerability detection. Although they do not involve the actual operation of the application, they can comprehensively detect potential vulnerabilities in the program. Current static analysis methods often rely on single features for vulnerability detection, often ignoring the characteristics of open-source components and the complexities of mobile applications, failing to fully reveal the security risks in the application, resulting in low efficiency and difficulty in covering all potential vulnerabilities.

[0003] In summary, existing technologies suffer from low vulnerability detection efficiency because they neglect the characteristics of open-source components and the complexities of mobile applications during vulnerability analysis, failing to fully reveal security risks in mobile application components. Summary of the Invention

[0004] The purpose of this application is to provide a method and apparatus for analyzing vulnerabilities in mobile application components, in order to solve the technical problem that the vulnerability analysis of existing technologies ignores the characteristics of open source components and the complex factors in mobile applications, which fails to fully reveal the security risks in mobile application components and leads to low vulnerability detection efficiency.

[0005] In view of the above problems, this application provides a method and apparatus for analyzing vulnerabilities in mobile application components.

[0006] Firstly, this application provides a method for analyzing vulnerabilities in mobile application components. This method is implemented using a mobile application component vulnerability analysis device. The method includes: statically disassembling instructions from a mobile application file to obtain an assembly instruction sequence; constructing a control flow graph based on the assembly instruction sequence; extracting features from the control flow graph according to preset feature groups to obtain instruction sequence features; extracting data segment features and string features from the mobile application file, and constructing a mobile application binary feature vector by combining the instruction sequence features; performing multi-dimensional feature extraction on a set of open-source components to generate a set of open-source component feature vectors; constructing a vulnerability matching analysis space based on the set of open-source component feature vectors; performing multi-dimensional nearest neighbor matching in the vulnerability matching analysis space based on the mobile application binary feature vectors to obtain a target matching open-source component feature vector set; mapping the open-source component set based on the target matching open-source component feature vector set to obtain a target open-source component set; and performing component vulnerability analysis on the mobile application based on the target open-source component set to obtain component vulnerability analysis results.

[0007] Optionally, the assembly instruction sequence is traversed to perform modular structure semantic recognition to obtain assembly instruction semantic feature vectors; hierarchical relationship analysis is performed on the assembly instruction sequence from sequential flow, conditional jump, unconditional jump, function call and return, and loop structure to obtain hierarchical relationship analysis results; and the assembly instruction semantic feature vectors and hierarchical relationship analysis results are integrated and analyzed using a weighted fusion strategy to construct the control flow graph.

[0008] Optionally, a first assembly instruction located at the first position is extracted from the assembly instruction sequence; the first assembly instruction is subjected to semantic word extraction according to a preset instruction semantic word set, and the extraction result is added to an initially empty vector to generate a first semantic feature vector; a second assembly instruction located at the second position is extracted from the assembly instruction sequence; the second assembly instruction is subjected to semantic word extraction based on the preset instruction semantic word set and the first semantic feature vector, and the first semantic feature vector is updated according to the extraction result to obtain a second semantic feature vector; and so on, the assembly instruction sequence is traversed to identify semantic words and obtain assembly instruction semantic feature vectors.

[0009] Optionally, the preset instruction semantic association word set includes opcode, operand, register, assignment, and status flag.

[0010] Optionally, the preset feature group includes syntax features, graph structure features, function features, constant strings, and immediate values.

[0011] Optionally, each open-source component feature vector in the open-source component feature vector set is mapped to a D-dimensional space to construct the vulnerability matching analysis space, where D is a positive integer greater than or equal to 2, and the vulnerability matching analysis space includes multiple mapping points; the mobile application binary feature vector is mapped to the vulnerability matching analysis space to obtain a target matching point; multi-dimensional nearest neighbor matching is performed on the target matching point and the multiple mapping points in the vulnerability matching analysis space to obtain a target nearest neighbor matching mapping point set; the open-source component feature vector corresponding to the target nearest neighbor matching mapping point set is used as the target matching open-source component feature vector set.

[0012] Optionally, the Euclidean distances from the plurality of mapping points to the target matching point are calculated respectively, and the mapping points whose calculation results are in the first m positions are added to the initial nearest neighbor matching mapping point set, where m is a positive integer greater than or equal to 3; the initial nearest neighbor matching mapping point set is subjected to density filtering to determine the target nearest neighbor matching mapping point set.

[0013] Optionally, the initial nearest neighbor matching mapping point corresponding to the minimum Euclidean distance in the initial nearest neighbor matching mapping point set is used as the starting point of dense filtering; the starting point neighborhood of the starting point of dense filtering is constructed according to a preset filtering scale, and an initial nearest neighbor matching mapping point is randomly extracted from the edge of the starting point neighborhood as a dense filtering iteration point; the iteration point neighborhood of the dense filtering iteration point is constructed, and it is determined whether the neighborhood density of the iteration point neighborhood is greater than or equal to the neighborhood density of the starting point neighborhood. If so, an initial nearest neighbor matching mapping point is randomly extracted from the edge of the iteration point neighborhood to update the dense filtering iteration point until the preset number of iterations is met, the target iteration point neighborhood is obtained, and the initial nearest neighbor matching mapping points in the target iteration point neighborhood are summarized into the target nearest neighbor matching mapping point set.

[0014] Optionally, the target open-source component set is traversed to identify known vulnerabilities, and a set of known vulnerability identification results is obtained; the union of the known vulnerability identification results is then performed to obtain the component vulnerability analysis results.

[0015] Secondly, this application also provides a mobile application component vulnerability analysis device for executing a mobile application component vulnerability analysis method as described in the first aspect. The mobile application component vulnerability analysis device includes: a control flow graph construction module for statically disassembling instructions from a mobile application file to obtain an assembly instruction sequence, and constructing a control flow graph based on the assembly instruction sequence; a feature extraction module for extracting features from the control flow graph according to a preset feature group to obtain instruction sequence features; a feature vector construction module for extracting data segment features and string features from the mobile application file, and constructing a mobile application binary feature vector by combining the instruction sequence features; a multi-dimensional extraction module for performing multi-dimensional feature extraction on a set of open-source components to generate a set of open-source component feature vectors; a nearest neighbor matching module for constructing a vulnerability matching analysis space based on the set of open-source component feature vectors, performing multi-dimensional nearest neighbor matching in the vulnerability matching analysis space based on the mobile application binary feature vectors to obtain a target matching open-source component feature vector set; and a vulnerability analysis module for mapping the open-source component set based on the target matching open-source component feature vector set to obtain a target open-source component set, and performing component vulnerability analysis on the mobile application based on the target open-source component set to obtain component vulnerability analysis results.

[0016] One or more technical solutions provided in this application have at least the following beneficial effects:

[0017] By statically disassembling the instructions in a mobile application file, an assembly instruction sequence is obtained, and a control flow graph is constructed based on this sequence. Features are then extracted from the control flow graph according to preset feature groups to obtain instruction sequence features. Data segment and string features are extracted from the mobile application file, and combined with the instruction sequence features to construct a binary feature vector for the mobile application. Multi-dimensional feature extraction is performed on a set of open-source components to generate a set of open-source component feature vectors. A vulnerability matching analysis space is constructed based on this set of open-source component feature vectors. Multi-dimensional nearest neighbor matching is performed in this vulnerability matching analysis space based on the mobile application's binary feature vectors to obtain a target set of matching open-source component feature vectors. This target set of open-source component feature vectors is then mapped to the target set of matching open-source component feature vectors to obtain a set of target open-source component features. Finally, component vulnerability analysis is performed on the mobile application based on this target set of open-source component features to obtain component vulnerability analysis results. In other words, by extracting features from the mobile application file, constructing a binary feature vector for the mobile application, and conducting in-depth analysis of open-source components to build a vulnerability matching analysis space, the feature vectors of the application and open-source components are mapped to perform component vulnerability analysis. This improves the ability to identify security risks in mobile application components, thereby enhancing the accuracy and efficiency of vulnerability detection.

[0018] The above description is merely an overview of the technical solution of this application. To better understand the technical means of this application and to facilitate its implementation according to the description, and to make the above and other objects, features, and advantages of this application more apparent, specific embodiments of this application are described below. It should be understood that the content described in this section is not intended to identify key or important features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent through the following description. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating a mobile application component vulnerability analysis method according to this application.

[0021] Figure 2 This is a schematic diagram of the structure of a mobile application component vulnerability analysis device according to this application.

[0022] Figure labeling: Control flow graph construction module 11, feature extraction module 12, feature vector construction module 13, multidimensional extraction module 14, nearest neighbor matching module 15, vulnerability analysis module 16. Detailed Implementation

[0023] This application provides a method and apparatus for analyzing vulnerabilities in mobile application components, addressing the technical problem of low vulnerability detection efficiency in existing technologies due to the neglect of open-source component characteristics and complex factors within mobile applications during vulnerability analysis, which fails to fully reveal security risks in mobile application components. By extracting features from mobile application files to construct binary feature vectors for the mobile application, and conducting in-depth analysis of open-source components to build a vulnerability matching analysis space, the feature vectors of the application and open-source components are mapped for component vulnerability analysis. This improves the ability to identify security risks in mobile application components, thereby enhancing the accuracy and efficiency of vulnerability detection.

[0024] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. It should be understood that this application is not limited to the exemplary embodiments described herein. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application. It should also be noted that, for ease of description, only the parts related to this application are shown in the accompanying drawings, not all of them.

[0025] Example 1, please refer to the appendix. Figure 1 This application provides a method for analyzing vulnerabilities in mobile application components. The method is executed by a mobile application component vulnerability analysis device and specifically includes the following steps:

[0026] S100: Static disassemble the instructions in the mobile application file to obtain the assembly instruction sequence, and construct a control flow graph based on the assembly instruction sequence.

[0027] Furthermore, this application S100 includes:

[0028] The assembly instruction sequence is traversed to perform modular structure semantic recognition and obtain assembly instruction semantic feature vectors; the assembly instruction sequence is analyzed hierarchically from sequential flow, conditional jump, unconditional jump, function call and return, and loop structure to obtain hierarchical relationship analysis results; the assembly instruction semantic feature vectors and hierarchical relationship analysis results are integrated and analyzed using a weighted fusion strategy to construct the control flow graph.

[0029] Specifically, static disassembly is performed on the instructions in the mobile application files. Static disassembly extracts the instructions from the mobile application files in a non-executable state, converting binary code into assembly code. In other words, it automatically identifies machine instructions in the application and transforms them into easily understandable assembly language. Assembly instruction sequences are generated using disassembly tools, and a control flow graph (CFG) is constructed by analyzing jump instructions, conditional branches, etc. That is, the source code is compiled into a binary program, and then disassembled to obtain the control flow graph (directed graph).

[0030] Semantic recognition is performed on the disassembled assembly instruction sequence. By analyzing the behavior of each instruction in the assembly instruction sequence, different functional modules are identified. Modular structure semantic recognition refers to identifying different modules or functional units of the application program by analyzing the function, calling relationship and logical structure of the instructions in the disassembled assembly instructions, and understanding their semantics and behavior, such as semantic information such as opcodes, operands, registers, assignments and status flags.

[0031] Analysis of the control flow structure of assembly instruction sequences identifies sequential flow, jump structures, function calls, and returns. Different execution paths can be determined by identifying conditional jump instructions (such as JE and JNE) and unconditional jump instructions (such as JMP). Function calls (such as CALL instructions) and returns (such as RET instructions) can also be identified. Furthermore, the start and end of loop structures are analyzed, and loop bodies (such as LOOP instructions or loops based on conditional jumps) are identified. Hierarchical relationship analysis involves the analysis of control flow between instructions, including the identification of sequential flow, conditional jumps, unconditional jumps, function calls, returns, and loop structures. This reveals the control logic during instruction execution, aids in understanding the program structure, and yields hierarchical relationship analysis results. Sequential flow refers to the execution of instructions sequentially; conditional jumps jump to different code paths based on a condition; unconditional jumps forcibly jump to a specified location without any conditions; function calls and returns involve the program calling a function and returning after execution; and loop structures refer to the loop bodies in the program, indicating the repeated execution of a certain section of code until a termination condition is met.

[0032] The semantic feature vectors of the identified assembly instructions and the results of hierarchical relationship analysis are weighted and fused together. The semantic feature vectors of the assembly instructions describe the modular structure with specific semantics in each instruction, while the hierarchical relationship analysis results describe the program's control flow structure, such as sequential flow, conditional jumps, function calls, and loops. The goal of weighted fusion is to combine the semantic feature vectors and hierarchical relationship analysis results into a single vector that reflects the semantics of the assembly instructions and the program's control flow. First, different features are assigned corresponding weights, typically based on their importance to vulnerability analysis; the more important the vulnerability analysis, the greater the weight assigned.

[0033] A control flow graph is constructed by merging the semantic feature vectors and hierarchical relationship analysis results using a weighted average. Each instruction corresponds to a node in the graph, and the edges represent control flow transitions (such as jumps and calls). The weighted fusion result provides rich semantic and control flow information for each node, helping to construct a more accurate control flow graph. Basic blocks (instructions executed sequentially) form a node in the graph, and jump instructions (conditional jumps or unconditional jumps) form edges. For example, MOV EAX,5, ADD EAX,2, CMP EAX,10 are sequentially executed instructions, JE equals is a conditional jump, and MOVEBX,0 and MOV EBX,1 represent different execution paths. Through the merged features, jumps and execution paths in the program are effectively analyzed, revealing potential vulnerabilities or unreasonable control flows. Simultaneously, abnormal paths are handled, and complex loops and recursive calls are appropriately simplified, ensuring that key information is preserved while avoiding excessive graph expansion.

[0034] A control flow graph is a directed graph where each node represents a basic block (such as a function or a continuous block of code), and edges represent the control flow from one basic block to another. Through modular structure semantic recognition and hierarchical relationship analysis, the meaning of each instruction and its position in the program can be accurately understood. Control flow graphs provide a comprehensive understanding of the program execution path, helping to discover potential control flow vulnerabilities, infinite loops, logical errors, and other problems.

[0035] Furthermore, this application also includes the following steps:

[0036] The assembly instruction sequence is processed as follows: First assembly instruction is extracted from the first position; semantic related words are extracted from the first assembly instruction according to a preset set of semantic related words, and the extracted results are added to an initially empty vector to generate a first semantic feature vector; Second assembly instruction is extracted from the second position; semantic related words are extracted from the second assembly instruction based on the preset set of semantic related words and the first semantic feature vector, and the first semantic feature vector is updated according to the extraction results to obtain a second semantic feature vector; This process is repeated, traversing the assembly instruction sequence to identify semantic related words and obtain assembly instruction semantic feature vectors.

[0037] The preset instruction semantic association word set includes opcode, operand, register, assignment, and status flag.

[0038] Specifically, the first instruction is extracted from the assembly instruction sequence. This is usually the starting instruction of the program execution, which may be some initialization instructions or program entry instructions. According to the preset instruction semantic association word set, relevant association words are extracted from the first instruction, including opcode, operand, register, assignment, and status flag. Among them, the opcode is the core part of the assembly instruction, which specifies the type of operation to be performed by the instruction, such as MOV (move data), ADD (addition), JMP (jump), etc.; the operand is the object of the instruction operation, such as register (EAX), memory address ([ESP]), constant (10), etc.; the register is a temporary location inside the CPU used to store data, used to store operands; assignment involves copying data from one location to another; the status flag is the status information related to the execution of the instruction, such as ZF (zero flag, set to 1 when the result is 0), CF (carry flag, set to 1 when unsigned operation overflows), OF (overflow flag, set to 1 when signed operation overflows), SF (sign flag, set to 1 when the result is negative), etc.

[0039] The semantic information extracted from the first assembly instruction is transformed into a feature vector and added to an initially empty vector. This maps the specific semantic information of the instruction to a vector space, generating the first semantic feature vector. Initially, the semantic feature vector is empty, and it is gradually filled in as each instruction is analyzed. For example, the opcode MOV can be mapped to the number 1, and the register EAX can be mapped to the number 2, etc. The second instruction, the second instruction in the assembly instruction sequence, is extracted. Based on a preset set of semantic related words and the first semantic feature vector, related words are extracted from the second assembly instruction. By combining the first semantic feature vector (i.e., the semantic features of the previous instruction), the understanding of the second instruction is enhanced. The semantic features of the first instruction represent the current state of the program, while the semantic features of the second instruction are closely related to the execution result of the first instruction. The first semantic feature vector represents the characteristics of previous instructions, containing not only the semantics of the instruction itself but also indirectly some state information during program execution. Applying this feature vector to the next instruction (the second instruction) is essentially passing historical information to the current step, so that the feature vector can reflect the dependencies between instructions when representing the second instruction.

[0040] The first semantic feature vector is updated based on the extraction results to obtain the second semantic feature vector. The updated second semantic feature vector is then combined with the semantic information of the two instructions and adjusted using a weighted method. During the update, the weights can be adjusted according to the correlation between instructions to more accurately represent the overall behavior of the program. This process is repeated, traversing the entire assembly instruction sequence, extracting semantic related words for each instruction, and progressively updating the semantic feature vector to finally obtain the semantic feature representation of the entire assembly instruction sequence, i.e., the assembly instruction semantic feature vector.

[0041] By extracting semantic related words and representing vectors for each instruction, the semantic content in the assembly instructions is accurately captured. The generated assembly instruction semantic feature vector can capture key semantic information in the assembly instruction sequence, realizing accurate modeling of the behavior of mobile application file programs, thereby improving the effectiveness of program analysis and vulnerability detection.

[0042] S200: Based on the control flow graph, feature extraction is performed according to a preset feature group to obtain instruction sequence features.

[0043] The preset feature group includes syntax features, graph structure features, function features, constant strings, and immediate values.

[0044] Specifically, instruction sequence features, or code segment features, are extracted from the control flow graph to describe the program's logical structure, operation types, and flow control. These typically include syntax features, graph structure features, function call features, constant strings, and immediate values. Syntax features refer to the basic operational content of each instruction, helping to discover vulnerability patterns or design flaws in the source code structure. For example, in Java, class and method definitions have fixed syntax structures, typically including class name, method name, parameter types, and return type. By identifying these syntax structures, we can understand the application's modular design and thus infer potential vulnerability points. Control structures in different programming languages ​​(such as conditional statements, loop structures, and exception handling) have specific manifestations in assembly code, such as jump instructions (JMP) or conditional jump instructions (such as JE, JNE, etc.). Extracting information from these specific control structures can help identify potential program logic vulnerabilities.

[0045] Graph structure features describe the control flow structure of a program, including the number of nodes and edges. The control flow graph (CFG) can capture the execution path of a program and identify important structures such as conditional statements and jump statements. Specifically, it involves traversing all nodes in the control flow graph, analyzing their connections, extracting the in-degree and out-degree of nodes, checking for loops, conditional jumps, and unconditional jumps, calculating the complexity of the control flow graph (such as the number of branches and path length), and capturing branching and loop structures in the program.

[0046] Function characteristics describe the calling relationships, calling frequency, and parameter passing methods of various functions in a program. By identifying the entry and exit points of each function in the control flow graph, analyzing the function's call path, recording the number of times each function is called and the number of nested calls, extracting information such as the function's parameter types and return values, we can understand the function's usage and obtain its characteristics.

[0047] Constant strings refer to fixed strings used in a program, such as error messages, prompts, and log information. Immediate values ​​are constant values ​​directly used in instructions, such as fixed numerical values ​​and bitmasks. Both constant strings and immediate values ​​typically contain hard-coded information in the program, such as keys, IP addresses, and URLs. Attackers can exploit this information to launch attacks, such as cracking known keys or using pre-defined sensitive strings for SQL injection attacks.

[0048] After feature extraction, instruction sequence features are obtained, which are used to describe the program's logical structure, operation types, and flow control. Through detailed feature extraction, a comprehensive understanding of the program's behavior is achieved, including the operation type of each instruction, the program's control flow path, and the call relationships between functions. This identifies behavioral patterns in the program, including similarities to known vulnerabilities or malicious attacks, providing support for security analysis and defense.

[0049] S300: Extract data segment features and string features from the mobile application file, and construct a binary feature vector of the mobile application by combining the instruction sequence features.

[0050] Specifically, data segment features and string features are extracted from mobile application files. Data segment features store information such as static data, constants, and variables, identifying and analyzing the data structures the program relies on at runtime, understanding how this data is used and modified, and helping to detect potential vulnerabilities or malicious behavior. The program's binary file has a clearly defined data segment section, typically including constant strings, global variables, etc., which are extracted from the binary file. For each data item, its type (e.g., integer, floating-point number, string), size (e.g., 32-bit integer, 64-bit floating-point number), initial value, and whether it is frequently modified in the program are extracted. Data segment features typically include the data item's type, size, initial value, and modification frequency.

[0051] String features refer to fixed strings used in a program, such as error messages, debugging information, and configuration file paths. These help identify common patterns, potentially sensitive information, or strings related to known attacks. The process involves traversing all data segments in the program to identify all occurring constant strings, including but not limited to error messages, log strings, and prompts. For each extracted string, its value, length, position in the program, and frequency of use are recorded. Strings related to known vulnerabilities, malicious behavior, or sensitive data require special marking. String features can be represented by the string's value, frequency of occurrence, and contextual information.

[0052] The extracted data segment features, string features, and instruction sequence features are integrated according to a certain order and rules to construct the binary feature vector of the mobile application. For features from different sources, standardization may be required to ensure that each dimension in the feature vector is within the same scale range. Each feature (data segment feature, string feature, instruction sequence feature, etc.) is represented as a numerical feature using vectorization techniques. For example, constants in data segment features can be directly mapped to integer values ​​or hash values, and strings can be converted into vectors using methods such as hash values, frequency analysis, or TF-IDF.

[0053] A mobile application's binary feature vector is a set of numerical vectors obtained by extracting features from the program's binary file. It aims to represent the program's structure, behavior, and potential risks, including instruction sequence features, data segment features, and string features. By extracting data segment, string, and instruction sequence features and integrating them into a complete binary feature vector, it helps detect and identify potential vulnerabilities, malicious behavior, and improper data access.

[0054] S400: Performs multi-dimensional feature extraction on a collection of open-source components to generate a set of feature vectors for the open-source components.

[0055] Specifically, this involves extracting multi-dimensional features from the open-source component collection. This means performing multi-dimensional feature extraction on the open-source component collection to generate a set of feature vectors, including code structure (module organization), function call relationships (call hierarchy between functions), and dependency library information (other libraries and their versions). Multi-dimensional feature extraction refers to analyzing the modular structure and hierarchical relationships of the open-source component collection separately, and then extracting features according to preset feature groups and data segment features.

[0056] Static analysis tools (such as source code parsing tools and dependency analysis tools) are used to extract the modular structure of open-source components. Based on the modular structure, the hierarchical relationships between modules are analyzed, including parent-child module relationships, dependency relationships, and call hierarchy between modules. This helps to reveal the internal complexity of the components and the interaction methods between modules.

[0057] Function call relationships reflect the calling patterns between functions within an open-source component, revealing the component's logical structure and identifying potential code complexity, dependencies, and security risks. Static analysis tools are used to extract information about all functions in the open-source component, including function names, input parameters, and return values. Based on the function call information, a function call graph is constructed. Each function can be considered a node, and each call relationship can be represented as an edge in the graph. By analyzing the function call chains, dependencies, call levels, and potential recursion or circular calls between functions are identified.

[0058] Dependency information reveals the external libraries or frameworks that open-source components depend on. Analyzing these dependencies helps in understanding the component's external dependencies and potential security risks (such as the use of outdated library versions). By extracting the dependency information of an open-source component, we can determine the component's runtime environment and the external resources it depends on. It's important to pay attention not only to the names of the dependency libraries but also to extract their version information, as different versions of libraries may contain different vulnerabilities.

[0059] For some more complex open-source components, other auxiliary features can be extracted, such as code complexity (e.g., cyclomatic complexity), the proportion of code comments, and documentation completeness. Code complexity is assessed by analyzing the complexity of the source code and the size of functions; comments in open-source projects help in understanding the functionality of the code, and extracting comments and documentation can further enrich the features of open-source components.

[0060] The code structure (module organization), function call relationships (call hierarchy between functions), and dependency library information (other libraries and their versions) are integrated to form a complete feature vector. To ensure that different feature dimensions can be compared under the same standard, each feature dimension is standardized. After standardization, all dimensions of all feature vectors will have the same scale. The open-source component feature vector set refers to the set of multiple features of an open-source component (such as code structure, function calls, dependency library information, etc.) represented by vectorization. Through multi-dimensional feature extraction, a comprehensive understanding of the code structure, function behavior, and dependencies of open-source components is obtained. The resulting open-source component feature vector set can comprehensively represent the code structure, function call relationships, dependency library information, etc. of open-source components, and is used for subsequent matching and analysis with the binary feature vectors of mobile applications, thereby identifying the open-source components used in mobile applications, as well as potential security risks and vulnerabilities.

[0061] S500: Construct a vulnerability matching analysis space based on the feature vector set of the open source components, and perform multi-dimensional nearest neighbor matching in the vulnerability matching analysis space according to the binary feature vector of the mobile application to obtain the feature vector set of the target matching open source components.

[0062] Furthermore, this application S500 includes:

[0063] Each open-source component feature vector in the open-source component feature vector set is mapped to a D-dimensional space to construct the vulnerability matching analysis space, where D is a positive integer greater than or equal to 2, and the vulnerability matching analysis space includes multiple mapping points; the mobile application binary feature vector is mapped to the vulnerability matching analysis space to obtain target matching points; multi-dimensional nearest neighbor matching is performed on the target matching points and the multiple mapping points in the vulnerability matching analysis space to obtain a target nearest neighbor matching mapping point set; the open-source component feature vector corresponding to the target nearest neighbor matching mapping point set is used as the target matching open-source component feature vector set.

[0064] Specifically, dimensionality reduction techniques such as Principal Component Analysis (PCA) are used to map the feature vectors of each open-source component in the set of open-source component feature vectors from a high-dimensional space to a D-dimensional space (where D is greater than or equal to 2). Each open-source component's feature vector then becomes a D-dimensional vector, representing a point in that D-dimensional space. PCA is a common dimensionality reduction method that maps data from high to low dimensions by finding the direction of maximum variance in the data. PCA can remove redundant information and retain the most important features in the data. For example, suppose the feature vector of an open-source component is [module=Core, dependency=Utils, hierarchy=Root, call relationship=funcA->funcB]. After standardization and dimensionality reduction, we obtain the mapped D-dimensional vector: [x1,x2,...,xD]. This vector corresponds to a point in the D-dimensional space. The D-dimensional space is a multi-dimensional mathematical space where each point represents a feature representation of an open-source component.

[0065] When the feature vectors of all open-source components are mapped to a D-dimensional space, a vulnerability matching analysis space is constructed. This space consists of multiple mapping points, each representing an open-source component and reflecting its multi-dimensional characteristics. Using the same mapping technique as the open-source components (such as PCA), the binary feature vector of the mobile application is also mapped to the same D-dimensional vulnerability matching analysis space to obtain the target matching point. The target matching point is the target position obtained by mapping the binary feature vector of the mobile application to the vulnerability matching analysis space, representing the corresponding position of the mobile application's feature in the set of feature vectors of the open-source components.

[0066] By calculating the distance between the target point and multiple mapping points in the vulnerability matching analysis space, the set of mapping points closest to the target matching point is found. The feature vectors of the open-source components corresponding to the target's nearest neighbor matching mapping point set are used as the target's matching open-source component feature vector set. By mapping and matching the feature vectors of open-source components with those of mobile applications, the open-source components most similar to the target application are identified, thereby discovering potential vulnerabilities.

[0067] Furthermore, this application also includes the following steps:

[0068] Calculate the Euclidean distance from each of the multiple mapping points to the target matching point, and add the mapping points with the calculation results in the first m positions to the initial nearest neighbor matching mapping point set, where m is a positive integer greater than or equal to 3; perform density filtering on the initial nearest neighbor matching mapping point set to determine the target nearest neighbor matching mapping point set.

[0069] The initial nearest neighbor matching mapping point corresponding to the minimum Euclidean distance in the initial nearest neighbor matching mapping point set is used as the starting point of dense filtering. The starting point neighborhood of the starting point of dense filtering is constructed according to a preset filtering scale, and an initial nearest neighbor matching mapping point is randomly extracted from the edge of the starting point neighborhood as a dense filtering iteration point. The iteration point neighborhood of the dense filtering iteration point is constructed, and it is determined whether the neighborhood density of the iteration point neighborhood is greater than or equal to the neighborhood density of the starting point neighborhood. If so, an initial nearest neighbor matching mapping point is randomly extracted from the edge of the iteration point neighborhood to update the dense filtering iteration point until the preset number of iterations is met, the target iteration point neighborhood is obtained, and the initial nearest neighbor matching mapping points in the target iteration point neighborhood are summarized into the target nearest neighbor matching mapping point set.

[0070] Specifically, for each mapping point, its distance to the target matching point is calculated using Euclidean distance, the most common distance metric between two points, representing the straight-line distance between two points in space. By calculating the Euclidean distances from all mapping points to the target matching point, the m closest mapping points are selected to form an initial set of nearest-neighbor matching mapping points. For example, assuming the calculated Euclidean distances of the 5 mapping points are: [D1,D2,D3,D4,D5]=[0.2,0.3,0.5,0.6,0.8], the 3 points with the smallest Euclidean distances (i.e., the 3 mapping points with the smallest distances, D1, D2, D3) are selected as the initial set of nearest-neighbor matching mapping points.

[0071] Dense filtering further refines the initial nearest neighbor matching point set through iterative methods, filtering out points with high density to determine the target nearest neighbor matching point set. It excludes outliers that, although close to the target matching point, may be due to noise or other factors, ensuring that the final set of matching points has a high degree of similarity in features to the target matching point. The initial nearest neighbor matching point closest to the target matching point in the initial nearest neighbor matching point set is selected as the starting point for dense filtering; typically, the point with the smallest Euclidean distance is chosen, i.e., the point closest to the target matching point.

[0072] Based on a preset filtering scale (such as a fixed radius or a specified neighborhood size), a neighborhood of the starting point for dense filtering is constructed, and points within this neighborhood are selected as candidate points. The preset filtering scale is a standard scale for evaluating neighborhood density during the dense filtering process, usually represented as a fixed radius range used to control the extent of the neighborhood. An initial nearest neighbor matching mapping point is randomly extracted from the edge of the starting point's neighborhood as an iteration point, entering the dense filtering iteration phase.

[0073] Similarly, a neighborhood of the iteration point is constructed based on a preset screening scale. The neighborhood density of the iteration point's neighborhood and the neighborhood density of the starting point's neighborhood are calculated. The neighborhood density is usually obtained by calculating the number of points within the neighborhood. If the neighborhood density of the iteration point's neighborhood is greater than or equal to the neighborhood density of the starting point's neighborhood, an initial nearest neighbor matching mapping point is randomly extracted from the edge of the iteration point's neighborhood as a new iteration point, updating the screening process. For example, assuming the starting point's neighborhood contains 4 points and the iteration point's neighborhood contains 5 points, the iteration point's neighborhood density is high, meeting the condition for continuing screening. This iterative process is repeated until the preset maximum number of iterations is reached, or the neighborhood density no longer meets the condition. The iteration point's neighborhood at this point is taken as the target iteration point's neighborhood, and the initial nearest neighbor matching mapping points within the target iteration point's neighborhood are summarized into a target nearest neighbor matching mapping point set.

[0074] By combining preliminary screening using Euclidean distance and dense screening, distant and irrelevant mapping points are removed, making the target matching point set more accurate and avoiding interference from irrelevant points. Dense screening not only relies on distance but also comprehensively considers the spatial distribution density of points, effectively handling uneven spatial distribution and thus improving the robustness of the matching process. Rapid preliminary screening using Euclidean distance, followed by further refinement through dense screening, enables efficient matching on large-scale datasets.

[0075] S600: Based on the target matching open source component feature vector set, the open source component set is mapped to obtain the target open source component set, and the mobile application is subjected to component vulnerability analysis based on the target open source component set to obtain the component vulnerability analysis results.

[0076] Furthermore, this application S600 includes:

[0077] Traverse the target open-source component set to identify known vulnerabilities and obtain a set of known vulnerability identification results; perform a union operation on the set of known vulnerability identification results to obtain the component vulnerability analysis results.

[0078] Specifically, using a set of feature vectors from open-source components for target matching, each open-source component in the set is mapped based on similarity metrics (such as Euclidean distance, cosine similarity, etc.). The most matching open-source components are then selected to form the target open-source component set. Each feature vector in the target matching open-source component feature vector set is compared with the feature vectors of each open-source component in the open-source component set. Similarity is calculated using methods such as cosine similarity, i.e., the ratio of the dot product and the modulo product of the feature vectors of the target and open-source components. For each open-source component, its similarity to each feature vector in the target matching open-source component feature vector set is calculated. The open-source component with the highest similarity is selected as the candidate set for matching, forming the target open-source component set.

[0079] The process involves traversing the target set of open-source components to perform component vulnerability analysis on the mobile application. Vulnerability scanning is conducted using vulnerability identification tools, vulnerability databases, or static / dynamic analysis methods to check for known vulnerability characteristics in the components, such as common vulnerabilities (buffer overflows, SQL injection, cross-site scripting attacks, etc.). Each open-source component may contain multiple known vulnerabilities. These vulnerabilities are identified through vulnerability identification tools or vulnerability database queries and marked with CVE numbers, descriptions, and impact scope.

[0080] The vulnerability identification results for each component are saved, including vulnerability ID (e.g., CVE number), vulnerability description, vulnerability type, and affected component versions. Each component may have multiple known vulnerabilities, and information for each vulnerability needs to be recorded completely. Once the known vulnerabilities of all target open-source components have been identified, the vulnerability identification results for each component are merged, that is, the vulnerability information for each component is aggregated into a large vulnerability set. Through a union operation, all vulnerabilities, including those corresponding to each component, are organized. The vulnerabilities in the union are summarized, ensuring that each vulnerability has detailed information, such as vulnerability type, affected versions, and vulnerability description. Different identifiers are used to distinguish different vulnerability types, such as CVE number, vulnerability classification, and vulnerability remediation status.

[0081] This process aggregates known vulnerabilities across all target open-source components to obtain the final component vulnerability analysis results. This includes detailed information for each identified vulnerability, such as vulnerability type, description, CVE number, and affected versions. By analyzing open-source components, all potential vulnerabilities, especially known ones, are identified. A union operation ensures that vulnerability information for all target open-source components is included in the analysis, improving the accuracy and efficiency of vulnerability analysis and providing a basis for subsequent vulnerability remediation.

[0082] In summary, the mobile application component vulnerability analysis method provided in this application has the following beneficial effects:

[0083] By statically disassembling the instructions in a mobile application file, an assembly instruction sequence is obtained, and a control flow graph is constructed based on this sequence. Features are then extracted from the control flow graph according to preset feature groups to obtain instruction sequence features. Data segment and string features are extracted from the mobile application file, and combined with the instruction sequence features to construct a binary feature vector for the mobile application. Multi-dimensional feature extraction is performed on a set of open-source components to generate a set of open-source component feature vectors. A vulnerability matching analysis space is constructed based on this set of open-source component feature vectors. Multi-dimensional nearest neighbor matching is performed in this vulnerability matching analysis space based on the mobile application's binary feature vectors to obtain a target set of matching open-source component feature vectors. This target set of open-source component feature vectors is then mapped to the target set of matching open-source component feature vectors to obtain a set of target open-source component features. Finally, component vulnerability analysis is performed on the mobile application based on this target set of open-source component features to obtain component vulnerability analysis results. In other words, by extracting features from the mobile application file, constructing a binary feature vector for the mobile application, and conducting in-depth analysis of open-source components to build a vulnerability matching analysis space, the feature vectors of the application and open-source components are mapped to perform component vulnerability analysis. This improves the ability to identify security risks in mobile application components, thereby enhancing the accuracy and efficiency of vulnerability detection.

[0084] Example 2: Based on the same inventive concept as the mobile application component vulnerability analysis method in Example 1, this application also provides a mobile application component vulnerability analysis device. Please refer to the appendix. Figure 2 The mobile application component vulnerability analysis device includes:

[0085] The control flow graph construction module 11 is used to statically disassemble the instructions of the mobile application file to obtain the assembly instruction sequence, and construct a control flow graph based on the assembly instruction sequence; the feature extraction module 12 is used to extract features based on the control flow graph according to a preset feature group to obtain instruction sequence features; the feature vector construction module 13 is used to extract data segment features and string features from the mobile application file, and construct a mobile application binary feature vector by combining the instruction sequence features; the multidimensional extraction module 14 is used to perform multidimensional feature extraction on the open source component set to generate an open source component feature vector set; the nearest neighbor matching module 15 is used to construct a vulnerability matching analysis space based on the open source component feature vector set, and perform multidimensional nearest neighbor matching in the vulnerability matching analysis space according to the mobile application binary feature vector to obtain a target matching open source component feature vector set; the vulnerability analysis module 16 is used to map the open source component set based on the target matching open source component feature vector set to obtain a target open source component set, and perform component vulnerability analysis on the mobile application based on the target open source component set to obtain component vulnerability analysis results.

[0086] Furthermore, the control flow graph construction module 11 in the mobile application component vulnerability analysis device is also used to: traverse the assembly instruction sequence to perform modular structure semantic recognition and obtain assembly instruction semantic feature vectors; perform hierarchical relationship analysis on the assembly instruction sequence from sequential flow, conditional jump, unconditional jump, function call and return, and loop structure to obtain hierarchical relationship analysis results; and integrate and analyze the assembly instruction semantic feature vectors and hierarchical relationship analysis results using a weighted fusion strategy to construct the control flow graph.

[0087] Furthermore, the control flow graph construction module 11 in the mobile application component vulnerability analysis device is also used to: extract the first assembly instruction located at the first position from the assembly instruction sequence; extract related words from the first assembly instruction according to a preset instruction semantic related word set, add the extraction results to an initially empty vector, and generate a first semantic feature vector; extract the second assembly instruction located at the second position from the assembly instruction sequence; extract related words from the second assembly instruction based on the preset instruction semantic related word set and the first semantic feature vector, and update the first semantic feature vector according to the extraction results to obtain a second semantic feature vector; and so on, traversing the assembly instruction sequence to identify semantic related words and obtain assembly instruction semantic feature vectors.

[0088] Furthermore, the control flow graph construction module 11 in the mobile application component vulnerability analysis device is also used for: the preset instruction semantic association word set includes opcode, operand, register, assignment and status flag bit.

[0089] Furthermore, the feature extraction module 12 in the mobile application component vulnerability analysis device is also used for: the preset feature group includes syntax features, graph structure features, function features, constant strings and immediate values.

[0090] Furthermore, the nearest neighbor matching module 15 in the mobile application component vulnerability analysis device is also used to: map each open-source component feature vector in the open-source component feature vector set to a D-dimensional space to construct the vulnerability matching analysis space, where D is a positive integer greater than or equal to 2, and the vulnerability matching analysis space includes multiple mapping points; map the mobile application binary feature vector to the vulnerability matching analysis space to obtain a target matching point; perform multi-dimensional nearest neighbor matching on the target matching point and the multiple mapping points in the vulnerability matching analysis space to obtain a target nearest neighbor matching mapping point set; and use the open-source component feature vector corresponding to the target nearest neighbor matching mapping point set as the target matching open-source component feature vector set.

[0091] Furthermore, the nearest neighbor matching module 15 in the mobile application component vulnerability analysis device is also used to: calculate the Euclidean distance from the plurality of mapping points to the target matching point, and add the mapping points whose calculation results are in the first m positions to the initial nearest neighbor matching mapping point set, where m is a positive integer greater than or equal to 3; perform density filtering on the initial nearest neighbor matching mapping point set to determine the target nearest neighbor matching mapping point set.

[0092] Furthermore, the nearest neighbor matching module 15 in the mobile application component vulnerability analysis device is also used to: take the initial nearest neighbor matching mapping point corresponding to the minimum Euclidean distance in the initial nearest neighbor matching mapping point set as the starting point of dense screening; construct the starting point neighborhood of the dense screening starting point according to a preset screening scale, and randomly extract an initial nearest neighbor matching mapping point from the edge of the starting point neighborhood as a dense screening iteration point; construct the iteration point neighborhood of the dense screening iteration point, determine whether the neighborhood density of the iteration point neighborhood is greater than or equal to the neighborhood density of the starting point neighborhood, if so, continue to randomly extract an initial nearest neighbor matching mapping point from the edge of the iteration point neighborhood to update the dense screening iteration point until the preset number of iterations is met, obtain the target iteration point neighborhood, and summarize the initial nearest neighbor matching mapping points in the target iteration point neighborhood into the target nearest neighbor matching mapping point set.

[0093] Furthermore, the vulnerability analysis module 16 in the mobile application component vulnerability analysis device is also used to: traverse the target open-source component set to identify known vulnerabilities and obtain a set of known vulnerability identification results; and perform a union operation on the set of known vulnerability identification results to obtain the component vulnerability analysis results.

[0094] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Figure 1 The mobile application component vulnerability analysis method and specific example in Embodiment 1 are also applicable to the mobile application component vulnerability analysis device in this embodiment. Through the foregoing detailed description of the mobile application component vulnerability analysis method, those skilled in the art can clearly understand the mobile application component vulnerability analysis device in this embodiment. Therefore, for the sake of brevity, it will not be described in detail here.

[0095] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0096] Obviously, those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A mobile application component vulnerability analysis method, characterized by, The method comprises the following steps: statically disassembling a mobile application file instruction to obtain an assembly instruction sequence, and constructing a control flow graph based on the assembly instruction sequence; extracting features according to a preset feature group based on the control flow graph to obtain instruction sequence features; extracting data segment features and string features of the mobile application file, and combining the instruction sequence features to construct a mobile application binary feature vector; extracting multi-dimensional features of an open source component set to generate an open source component feature vector set; constructing a vulnerability matching analysis space based on the open source component feature vector set, and performing multi-dimensional neighbor matching in the vulnerability matching analysis space according to the mobile application binary feature vector to obtain a target matching open source component feature vector set, comprising: mapping each open source component feature vector in the open source component feature vector set to a D-dimensional space to construct the vulnerability matching analysis space, wherein D is a positive integer greater than or equal to 2, and the vulnerability matching analysis space includes a plurality of mapping points; mapping the mobile application binary feature vector to the vulnerability matching analysis space to obtain a target matching point; performing multi-dimensional neighbor matching on the target matching point and the plurality of mapping points in the vulnerability matching analysis space to obtain a target neighbor matching mapping point set; taking the open source component feature vectors corresponding to the target neighbor matching mapping point set as the target matching open source component feature vector set; mapping the target matching open source component feature vector set to the open source component set to obtain a target open source component set, and performing component vulnerability analysis on the mobile application based on the target open source component set to obtain a component vulnerability analysis result.

2. The method of claim 1, wherein, The preset feature group includes syntax features, graph structure features, function features, constant strings, and immediate numbers.

3. The method of claim 1, wherein, statically disassembling a mobile application file instruction to obtain an assembly instruction sequence, and constructing a control flow graph based on the assembly instruction sequence, comprising: traversing the assembly instruction sequence to perform modular structure semantic recognition to obtain an assembly instruction semantic feature vector; analyzing the hierarchical relationship of the assembly instruction sequence from sequential flow, conditional jump, unconditional jump, function call and return, and loop structure to obtain a hierarchical relationship analysis result; integrating and analyzing the assembly instruction semantic feature vector and the hierarchical relationship analysis result using a weighted fusion strategy to construct the control flow graph.

4. The method of claim 3, wherein, obtaining an assembly instruction semantic feature vector, comprising: extracting a first assembly instruction located at the first position from the assembly instruction sequence; extracting associated words of the first assembly instruction according to a preset instruction semantic associated word set, adding the extraction result to an initially empty vector to generate a first semantic feature vector; extracting a second assembly instruction located at the second position from the assembly instruction sequence; extracting associated words of the second assembly instruction based on the preset instruction semantic associated word set and the first semantic feature vector, and updating the first semantic feature vector according to the extraction result to obtain a second semantic feature vector; iterating the semantic associated word recognition of the assembly instruction sequence to obtain an assembly instruction semantic feature vector.

5. The method of claim 4, wherein, The preset instruction semantic association word set includes operation code, operation number, register, assignment and status flag bit.

6. The method of claim 1, wherein, The target matching point and the plurality of mapping points are subjected to multi-dimensional near neighbor matching in the vulnerability matching analysis space to obtain a target near neighbor matching mapping point set, including: Euclidean distances of the plurality of mapping points to the target matching point are respectively calculated, and mapping points with calculation results in the first m bits are added to an initial near neighbor matching mapping point set, where m is a positive integer greater than or equal to 3; The initial near neighbor matching mapping point set is subjected to density screening to determine a target near neighbor matching mapping point set.

7. The method of claim 6, wherein, The initial near neighbor matching mapping point set is subjected to density screening to determine a target near neighbor matching mapping point set, including: An initial near neighbor matching mapping point corresponding to a minimum Euclidean distance in the initial near neighbor matching mapping point set is taken as a density screening starting point; A starting point neighborhood of the density screening starting point is constructed according to a preset screening scale, and an initial near neighbor matching mapping point is randomly extracted from an edge of the starting point neighborhood as a density screening iteration point; An iteration point neighborhood of the density screening iteration point is constructed, and whether a neighborhood density of the iteration point neighborhood is greater than or equal to a neighborhood density of the starting point neighborhood is judged, if yes, an initial near neighbor matching mapping point is continuously randomly extracted from an edge of the iteration point neighborhood to update the density screening iteration point until a preset iteration number is satisfied, a target iteration point neighborhood is obtained, and initial near neighbor matching mapping points in the target iteration point neighborhood are summarized as the target near neighbor matching mapping point set.

8. The method of claim 1, wherein, Based on the target matching open source component feature vector set, the open source component set is mapped to obtain a target open source component set, and based on the target open source component set, component vulnerability analysis is performed on the mobile application to obtain a component vulnerability analysis result, including: Known vulnerabilities are identified by traversing the target open source component set to obtain a known vulnerability identification result set; The known vulnerability identification result set is subjected to set union to obtain the component vulnerability analysis result.

9. A mobile application component vulnerability analysis apparatus, characterized by comprising: The mobile application component vulnerability analysis device is used for implementing steps of the mobile application component vulnerability analysis method in any one of claims 1 to 8, and includes: A control flow graph construction module is configured to perform static reverse assembly on a mobile application file instruction to obtain an assembly instruction sequence, and construct a control flow graph based on the assembly instruction sequence; A feature extraction module is configured to perform feature extraction according to a preset feature group based on the control flow graph to obtain instruction sequence features; A feature vector construction module is configured to extract data segment features and string features of a mobile application file, and construct a mobile application binary feature vector in combination with the instruction sequence features; A multi-dimensional extraction module is configured to perform multi-dimensional feature extraction on an open source component set to generate an open source component feature vector set; A near neighbor matching module is configured to construct a vulnerability matching analysis space based on the open source component feature vector set, and perform multi-dimensional near neighbor matching in the vulnerability matching analysis space according to a mobile application binary feature vector to obtain a target matching open source component feature vector set; The vulnerability analysis module is configured to map the target to the set of open source components based on the set of target matching open source component feature vectors, obtain a set of target open source components, and perform component vulnerability analysis on the mobile application based on the set of target open source components to obtain a component vulnerability analysis result.

Images