Android DEX file SCA analysis method, program product, equipment and medium

Abstract

The embodiment of the invention provides an Android DEX file SCA analysis method, a program product, equipment and a medium, and relates to the technical field of software component analysis. According to the method, for each first character string in a DEX file, a pre-selected jar package set corresponding to the current first character string is determined based on the current first character string and calling information of the current first character string, and at least one pre-selected jar package set is obtained; determining a first character string statistic of each pre-selected jar packet based on a third character string which is in each pre-selected jar packet and is the same as any first character string in the DEX file, and calling information of the third character string is matched with calling information of the first character string, and screening a target jar packet of which the first character string statistic meets a statistic condition from at least one pre-selected jar packet set, and determining the target jar package as the component of the DEX file, so that accurate analysis of the DEX file can be realized, and the component analysis efficiency of Android software is improved.

Description

Technical Field

[0001] This application relates to the technical field of software composition analysis. Specifically, it relates to an SCA analysis method, program product, device, and medium for Android DEX files. Background Art

[0002] Software Composition Analysis (SCA) is a technology for identifying and managing third-party components in software, such as open-source components and commercial components, etc., and is used to detect security vulnerabilities, compliance risks, and supply chain security hazards. With the continuous increase in the analysis depth from homologous analysis to source code analysis and then to binary analysis, the difficulty of software composition analysis is also continuously increasing.

[0003] Currently, in order to identify third-party components in Android software, mainly the local dynamic library files in the Android Package (APK) file are analyzed. This analysis method is relatively complex, resulting in low efficiency of Android software composition analysis. Summary of the Invention

[0004] The purpose of the embodiments of this application is to provide an SCA analysis method, program product, device, and medium for Android DEX files, so as to achieve the technical effect of accurately analyzing DEX files and improving the efficiency of Android software composition analysis.

[0005] In a first aspect, the embodiments of this application provide an SCA analysis method for Android DEX files, including: Obtain a first string set of the DEX file, and call information of each first string in the first string set; For each first string in the first string set, determine a set of preselected jar packages corresponding to the current first string, and obtain at least one set of preselected jar packages; wherein, each preselected jar package in the set of preselected jar packages includes a second string that is the same as the current first string and whose call information matches the call information of the current first string; Screen target jar packages from the at least one set of preselected jar packages, and determine the target jar packages as the components of the DEX file; wherein, the first string statistic of the target jar package meets the statistic condition, and the first string statistic of the target jar package is determined according to a third string in the target jar package that is the same as any first string in the first string set and whose call information matches the call information of the first string.

[0006] In the above implementation process, for each first string in the DEX file, a set of preselected jar packages corresponding to the current first string is determined based on the current first string and the call information of the current first string, obtaining at least one set of preselected jar packages, and the first string statistic of each preselected jar package is determined based on the third string that is the same as any first string in the DEX file and whose call information matches the call information of the first string. The target jar packages whose first string statistics meet the statistical condition are filtered from at least one set of preselected jar packages, and the target jar packages are determined as the components of the DEX file, which can accurately analyze the jar packages contained in the DEX file based on the string and the string call information, thereby realizing the accurate analysis of the DEX file and improving the efficiency of Android software component analysis.

[0007] Further, the determining the set of preselected jar packages corresponding to the current first string includes: Querying the set of original jar packages corresponding to the current first string from the pre-constructed feature library; wherein, each original jar package in the set of original jar packages includes a fourth string that is the same as the current first string; Judging whether the call information of the fourth string in each original jar package matches the call information of the current first string; wherein, the call information of the fourth string in each original jar package is queried from the feature library; In the case where the call information of the fourth string in any original jar package in the set of original jar packages does not match the call information of the current first string, deleting the original jar package from the set of original jar packages to obtain the set of preselected jar packages.

[0008] In the above implementation process, by querying each original jar package including a fourth string that is the same as the current first string from the pre-constructed feature library, judging whether the call information of the fourth string in each original jar package matches the call information of the current first string, and in the case where the call information of the fourth string in any original jar package does not match the call information of the current first string, deleting the original jar package from the set of original jar packages to obtain the set of preselected jar packages, the acquisition efficiency of at least one set of preselected jar packages can be improved, which is beneficial to further improving the efficiency of Android software component analysis.

[0009] Further, the method further includes: For each of the multiple JAR packages, store the second string set of the current JAR package and the call information of each second string in the second string set in a database as a mapping relationship to obtain the feature library.

[0010] In the above implementation process, by storing the second string set of each JAR package among the multiple JAR packages and the call information of each second string in the second string set in a database as a mapping relationship to obtain the feature library, it is convenient to directly query the feature library later to determine the set of candidate JAR packages corresponding to each first string, which helps to further improve the efficiency of Android software component analysis.

[0011] Further, the call information includes the number of calls; The step of determining whether the call information of the fourth string in each of the original JAR packages matches the call information of the current first string includes: For each original JAR package in the set of original JAR packages, compare the number of calls of the fourth string in the current original JAR package with the number of calls of the current first string; If the number of calls of the fourth string in the current original JAR package is greater than the number of calls of the current first string, determine that the call information of the fourth string in the current original JAR package does not match the call information of the current first string; If the number of calls of the fourth string in the current original JAR package is less than or equal to the number of calls of the current first string, determine that the call information of the fourth string in the current original JAR package matches the call information of the current first string.

[0012] In the above implementation process, by selecting the number of string calls as the string call information and using the method of comparing the magnitudes of the number of string calls to perform the matching of string call information, it is possible to reduce the difficulty of string call information matching, eliminate in advance the JAR packages that the DEX file cannot contain, so as to better achieve the rapid and accurate analysis of the DEX file and further improve the efficiency of Android software component analysis.

[0013] Further, the step of screening target JAR packages from the at least one set of candidate JAR packages includes: Determine the first string statistic of each candidate JAR package in the at least one set of candidate JAR packages; Take the candidate JAR package with the largest first string statistic in the at least one set of candidate JAR packages as the current target JAR package; Delete the target string set of the current target jar package from the first string set; wherein, the target string set includes a fifth string in the current target jar package that is the same as any first string in the first string set and whose call information matches the call information of the first string. Re - execute the pre - selected jar package set determination operation and the target jar package screening operation for the updated first string set until the end condition is met.

[0014] In the above implementation process, by using the pre - selected jar package with the largest first - string statistic in at least one pre - selected jar package set as the current target jar package, deleting the fifth string in the current target jar package that is the same as any first string in the first string set and whose call information matches the call information of that first string, and re - executing the pre - selected jar package set determination operation and the target jar package screening operation for the updated first string set until the end condition is met, it is possible to adopt a screening strategy of gradually screening one target jar package, more precisely screen the target jar package from at least one pre - selected jar package set, which is beneficial to improving the analysis accuracy of the DEX file.

[0015] Further, the method further includes: In the case that there are at least two pre - selected jar packages with the largest first - string statistic in the at least one pre - selected jar package set, use the pre - selected jar package with the largest second - string statistic among the at least two pre - selected jar packages as the current target jar package; Wherein, the first - string statistic of each pre - selected jar package is determined according to the number of target strings and the total number of strings in each pre - selected jar package. The number of target strings in each pre - selected jar package is the total number of sixth strings in each pre - selected jar package that are the same as any first string in the first string set and whose call information matches the call information of the first string. The second - string statistic of each pre - selected jar package is the total number of strings in each pre - selected jar package.

[0016] In the above implementation process, by using the pre - selected jar package with the largest second - string statistic among at least two pre - selected jar packages with the largest first - string statistic in at least one pre - selected jar package set as the current target jar package, it is possible to adopt a screening strategy of gradually screening one target jar package based on multiple string statistics, ensuring that in special cases, one target jar package can still be gradually screened from at least one pre - selected jar package set, which is beneficial to improving the analysis accuracy of the DEX file.

[0017] Further, the end condition includes that at least one preselected jar package set obtained most recently is empty.

[0018] In the above implementation process, by setting the end condition to include that at least one preselected jar package set obtained most recently is empty, it can be ensured that all preselected jar package sets corresponding to each first string are processed and analyzed, comprehensively and completely analyzing the jar packages contained in the DEX file, effectively avoiding the problem of missed judgment of the DEX file, and being beneficial to further improving the analysis accuracy of the DEX file.

[0019] Further, the determining the target jar package as a component of the DEX file includes: Determining the component corresponding to the target jar package as a component of the DEX file.

[0020] In the above implementation process, by determining the component corresponding to the target jar package as a component of the DEX file after obtaining the target jar package, it can facilitate the user to intuitively determine the components in the Android software.

[0021] In a second aspect, an embodiment of the present application provides an Android DEX file SCA analysis device, including: An information acquisition module, configured to acquire a first string set of the DEX file, and call information of each first string in the first string set; A jar package preselection module, configured to, for each first string in the first string set, determine a preselected jar package set corresponding to the current first string, and obtain at least one preselected jar package set; wherein, each preselected jar package in the preselected jar package set includes a second string that is the same as the current first string and whose call information matches the call information of the current first string; A component analysis module, configured to screen a target jar package from the at least one preselected jar package set, and determine the target jar package as a component of the DEX file; wherein, the first string statistic of the target jar package satisfies a statistic condition, and the first string statistic of the target jar package is determined according to a third string that is the same as any first string in the first string set and whose call information matches the call information of the first string in the target jar package.

[0022] In a third aspect, an embodiment of the present application provides a computer program product, the computer program product includes instructions, and when the instructions are executed by a computer, the computer implements the method as described above.

[0023] Fourthly, an embodiment of the present application provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, the above-mentioned method is implemented.

[0024] Fifthly, an embodiment of the present application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program runs, it controls the device where the computer-readable storage medium is located to execute the above-mentioned method. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the accompanying drawings required to be used in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other related drawings can also be obtained based on these drawings.

[0026] Figure 1 It is a schematic flowchart of a method for SCA analysis of an Android DEX file provided in the first embodiment of the present application; Figure 2 It is a schematic flowchart of a method for SCA analysis of an Android DEX file exemplified in the first embodiment of the present application; Figure 3 It is a schematic structural diagram of a device for SCA analysis of an Android DEX file provided in the second embodiment of the present application; Figure 4 It is a schematic structural diagram of an electronic device provided in the third embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0027] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

[0028] It should be noted that: similar reference numerals and letters indicate similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present application, terms such as "first" and "second" are only used for distinguishing descriptions and cannot be understood as indicating or implying relative importance.

[0029] Software Composition Analysis (SCA) is a technology for identifying and managing third-party components in software, such as open-source components and commercial components, etc., and is used to detect security vulnerabilities, compliance risks, and supply chain security hazards. With the increasing depth of analysis from homologous analysis to source code analysis and then to binary analysis, the difficulty of software composition analysis is also constantly increasing.

[0030] In related technologies, in order to identify third-party components in Android software, mainly the local dynamic library files in the Android Package (APK) file are analyzed. This analysis method is relatively complex, resulting in low efficiency of Android software composition analysis.

[0031] Moreover, during the Android software development process, in order to improve the development efficiency of Android software, many third-party jar packages are usually introduced into the Android software. After these jar packages are compiled into the APK file, they will be combined with the self-developed code to form one or more DEX files. Although both DEX files and jar packages are composed of bytecode, the Android compiler will optimize and tamper with the bytecode of the jar packages. At this time, it is very difficult to accurately analyze the jar packages introduced into the Android software from the DEX files.

[0032] Therefore, this application proposes a method for analyzing the components of DEX files in APK files. For each first string in the DEX file, a set of preselected jar packages corresponding to the current first string is determined based on the current first string and the call information of the current first string, obtaining at least one set of preselected jar packages, and the first string statistic of each preselected jar package is determined based on the third string in each preselected jar package that is the same as any first string in the DEX file and whose call information matches the call information of the first string. The target jar packages are screened from at least one set of preselected jar packages whose first string statistics meet the statistical condition, and the target jar packages are determined as the components of the DEX file, which can accurately analyze the jar packages contained in the DEX file based on strings and string call information, thereby realizing accurate analysis of the DEX file and improving the efficiency of Android software composition analysis.

[0033] Next, the technical solutions in the embodiments of the present application will be described with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments.

[0034] Next, in combination with Figure 1Describe an Android DEX file SCA analysis method according to an embodiment of the present application. The method provided by the embodiment of the present application can be executed by a relevant terminal device. Hereinafter, the user terminal is taken as an example of the execution entity for illustration.

[0035] Please refer to Figure 1 , Figure 1 FIG. is a schematic flowchart of an Android DEX file SCA analysis method provided by the first embodiment of the present application. The first embodiment of the present application provides an Android DEX file SCA analysis method, including steps S101 to S103: S101. Obtain a first string set of the DEX file and call information of each first string in the first string set.

[0036] As an example, according to actual business requirements, an APK file is determined in advance, and the APK file is decompressed to obtain the DEX file in the APK file.

[0037] Parse the DEX file, extract strings and string call information from the DEX file to obtain a first string set of the DEX file and call information of each first string in the first string set.

[0038] For example, the first string set is {string_01, string_02, string_03}, the call information of string_01 is a1, the call information of string_02 is a2, and the call information of string_03 is a3.

[0039] It should be noted that the first string set includes at least one first string.

[0040] S102. For each first string in the first string set, determine a corresponding set of preselected jar packages for the current first string to obtain at least one set of preselected jar packages; wherein, each preselected jar package in the set of preselected jar packages includes a second string that is the same as the current first string and whose call information matches the call information of the current first string.

[0041] As an example, after obtaining the first string set and call information of each first string in the first string set, for each first string in the first string set, determine a corresponding set of preselected jar packages for the current first string, wherein each preselected jar package in the set of preselected jar packages includes a second string that is the same as the current first string and whose call information matches the call information of the current first string.

[0042] Since the first string set includes at least one first string, at least one set of preselected jar packages will be finally obtained.

[0043] For example, assume that multiple jar packages, namely jar_1, jar_2, and jar_3, are pre-collected.

[0044] The string set of jar_1 is {string_11, string_12, string_13}, where string_11 is the same as string_01, and the call information of string_11 matches the call information a1 of string_01; string_12 is the same as string_02, and the call information of string_12 matches the call information a2 of string_02; string_13 is the same as string_03, and the call information of string_13 matches the call information a3 of string_03.

[0045] The string set of jar_2 is {string_21, string_22, string_23}, and only string_22 is the same as string_02, and the call information of string_22 matches the call information a2 of string_02.

[0046] The string set of jar_3 is {string_31, string_32, string_33}, where string_31 is the same as string_01, and the call information of string_31 matches the call information a1 of string_01; string_32 is the same as string_02, and the call information of string_32 matches the call information a2 of string_02.

[0047] Then the set of preselected jar packages corresponding to string_1 is {jar_1, jar_3}, the set of preselected jar packages corresponding to string_2 is {jar_1, jar_2, jar_3}, and the set of preselected jar packages corresponding to string_3 is {jar_1}. At this time, at least one set of preselected jar packages includes: the set of preselected jar packages corresponding to string_1, that is, {jar_1, jar_3}; the set of preselected jar packages corresponding to string_2, that is, {jar_1, jar_2, jar_3}, and the set of preselected jar packages corresponding to string_3 is {jar_1}.

[0048] At this time, the corresponding relationship between each first string and the preselected jar packages is a one-to-one or one-to-many correspondence, that is: string_1 <=> {jar_1, jar_3}; string_2 <=> {jar_1, jar_2, jar_3}; string_3 <=> {jar_1}. According to the corresponding relationship between each first string and the preselected jar packages, the corresponding relationship between each preselected jar package and the first string can be established conversely, that is: jar_1 <=> {string_1, string_2, string_3}; jar_2 <=> {string_2}; jar_3 <=> {string_1, string_3}.

[0049] S103. Screen the target jar package from at least one set of preselected jar packages, and determine the target jar package as a component of the DEX file; wherein, the first string statistic of the target jar package meets the statistic condition, and the first string statistic of the target jar package is determined according to the third string in the target jar package that is the same as any first string in the first string set and whose call information matches the call information of the first string.

[0050] As an example, after obtaining at least one set of preselected jar packages, for each preselected jar package in the at least one set of preselected jar packages, according to the third string in the current preselected jar package that is the same as any first string in the first string set and whose call information matches the call information of the first string, determine the first string statistic of the current preselected jar package, and determine whether the first string statistic of the current preselected jar package meets the pre-set statistic condition, such as the first string statistic being greater than the pre-set first string statistic threshold, screen the preselected jar package whose first string statistic meets the statistic condition from the at least one set of preselected jar packages as the target jar package, and determine the target jar package as a component of the DEX file.

[0051] For example, the at least one set of preselected jar packages includes: the set of preselected jar packages corresponding to string_1, that is, {jar_1, jar_3}; the set of preselected jar packages corresponding to string_2, that is, {jar_1, jar_2, jar_3}, and the set of preselected jar packages corresponding to string_3 is {jar_1}. At this time, each of the preselected jar packages in the at least one set of preselected jar packages is jar_1, jar_2, and jar_3.

[0052] For jar_1, since string_11 is the same as string_01 and the call information of string_11 matches the call information a1 of string_01, string_12 is the same as string_02 and the call information of string_12 matches the call information a2 of string_02, and string_13 is the same as string_03 and the call information of string_13 matches the call information a3 of string_03, the first string statistic of jar_1 is determined according to string_11, string_12, and string_13.

[0053] For jar_2, since only string_22 is the same as string_02 and the call information of string_22 matches the call information a2 of string_02, the first string statistic of jar_2 is determined according to string_22.

[0054] For jar_3, since string_31 is the same as string_01 and the call information of string_31 matches the call information a1 of string_01, and string_32 is the same as string_02 and the call information of string_32 matches the call information a2 of string_02, the first string statistic of jar_3 is determined according to string_31 and string_32.

[0055] Although the Android compiler will optimize and tamper with the bytecode of the imported jar packages, it will not modify the strings in the jar packages. Therefore, by analyzing whether a DEX file contains a certain jar package based on strings and string call information, the composition of the DEX file can be accurately analyzed. Even if the same string exists in multiple jar packages, the string call information can be used to assist in analyzing whether a DEX file contains a certain jar package, ensuring the accurate analysis of the composition of the DEX file.

[0056] In the embodiments of the present application, for each first string in the DEX file, a set of preselected jar packages corresponding to the current first string is determined based on the current first string and the call information of the current first string, at least one set of preselected jar packages is obtained, and the first string statistic of each preselected jar package is determined based on a third string that is the same as any first string in the DEX file and whose call information matches the call information of the first string in each preselected jar package. The target jar packages whose first string statistics meet the statistical condition are screened from at least one set of preselected jar packages, and the target jar packages are determined as the components of the DEX file, so that the jar packages included in the DEX file can be accurately analyzed based on the string and the string call information, thereby realizing the accurate analysis of the DEX file and improving the efficiency of Android software component analysis.

[0057] In an alternative embodiment, the determining of the set of preselected jar packages corresponding to the current first string includes: querying, from a pre-constructed feature library, the set of original jar packages corresponding to the current first string; wherein, each original jar package in the set of original jar packages includes a fourth string that is the same as the current first string; determining whether the call information of the fourth string in each original jar package matches the call information of the current first string; wherein, the call information of the fourth string in each original jar package is queried from the feature library; in the case where the call information of the fourth string in any original jar package in the set of original jar packages does not match the call information of the current first string, the original jar package is deleted from the set of original jar packages to obtain the set of preselected jar packages.

[0058] Exemplarily, in order to quickly determine the set of preselected jar packages corresponding to each first string, a feature library is pre-constructed, wherein the feature library is used to store a plurality of collected jar packages, as well as the strings and string call information in each jar package.

[0059] After obtaining the first string set and the call information of each first string in the first string set, for each first string in the first string set, query the set of original jar packages corresponding to the current first string from the pre-constructed feature library, wherein each original jar package in the set of original jar packages includes a fourth string that is the same as the current first string.

[0060] Query the call information of the fourth string in each original jar package from the feature library, and determine whether the call information of the fourth string in each original jar package matches the call information of the current first string.

[0061] In the case where the call information of the fourth string in any original JAR package in the original JAR package set matches the call information of the current first string, retain the original JAR package in the original JAR package set.

[0062] In the case where the call information of the fourth string in any original JAR package in the original JAR package set does not match the call information of the current first string, delete the original JAR package from the original JAR package set to obtain a preselected JAR package set.

[0063] In the embodiment of the present application, by querying each original JAR package including the fourth string identical to the current first string from a pre-constructed feature library, determining whether the call information of the fourth string in each original JAR package matches the call information of the current first string, and in the case where the call information of the fourth string in any original JAR package does not match the call information of the current first string, deleting the original JAR package from the original JAR package set to obtain a preselected JAR package set, the acquisition efficiency of at least one preselected JAR package set can be improved, which is conducive to further improving the Android software component analysis efficiency.

[0064] In an optional embodiment, the method further includes step S104: S104. For each JAR package among multiple JAR packages, store the second string set of the current JAR package and the call information of each second string in the second string set in a database as a mapping relationship to obtain a feature library.

[0065] Exemplarily, according to actual business requirements, collect multiple JAR packages from common Android package managers, such as the repository dependent on Maven.

[0066] For each JAR package among multiple JAR packages, parse the current JAR package, extract strings and string call information from the current JAR package to obtain the second string set of the current JAR package and the call information of each second string in the second string set, and store the second string set of the current JAR package and the call information of each second string in the second string set in a database as a mapping relationship to obtain a feature library.

[0067] In practical applications, strings and string call information can be extracted from a JAR package by parsing the constant pool of the JAR package.

[0068] In the embodiments of the present application, for each of multiple jar packages, a second string set of the current jar package and call information of each second string in the second string set are stored in a database as a mapping relationship to obtain a feature library, which can facilitate directly querying the feature library subsequently to determine a set of candidate jar packages corresponding to each first string, and is beneficial to further improving the efficiency of Android software component analysis.

[0069] In an alternative embodiment, the call information includes the number of calls; the determination of whether the call information of the fourth string in each original jar package matches the call information of the current first string includes: for each original jar package in the set of original jar packages, comparing the number of calls of the fourth string in the current original jar package with the number of calls of the current first string; if the number of calls of the fourth string in the current original jar package is greater than the number of calls of the current first string, it is determined that the call information of the fourth string in the current original jar package does not match the call information of the current first string; if the number of calls of the fourth string in the current original jar package is less than or equal to the number of calls of the current first string, it is determined that the call information of the fourth string in the current original jar package matches the call information of the current first string.

[0070] Exemplarily, considering that even if there is the same string in multiple jar packages, the number of calls of the string in multiple jar packages may be different, and after the jar packages and self-developed code are combined into one or more DEX files, the number of calls of the string in the DEX file cannot be less than the number of calls of the string before the combination of the jar packages, the number of calls of the string can be selected as the call information of the string.

[0071] After obtaining the set of original jar packages corresponding to the current first string, for each original jar package in the set of original jar packages, compare the number of calls of the fourth string in the current original jar package with the number of calls of the current first string.

[0072] If the number of calls of the fourth string in the current original jar package is greater than the number of calls of the current first string, it is determined that the call information of the fourth string in the current original jar package does not match the call information of the current first string, and at this time it is considered that the DEX file cannot contain the current original jar package.

[0073] If the number of calls of the fourth string in the current original jar package is less than or equal to the number of calls of the current first string, it is determined that the call information of the fourth string in the current original jar package matches the call information of the current first string, and at this time it is considered that the DEX file may contain the current original jar package.

[0074] By matching the string call information by comparing the number of string calls, not only can the difficulty of matching the string call information be reduced, and the set of candidate jar packages corresponding to each first string be quickly determined, but also the jar packages that the DEX file cannot contain can be excluded in advance, simplifying the subsequent processing and analysis process.

[0075] In the embodiment of the present application, by selecting the number of string calls as the string call information and matching the string call information by comparing the number of string calls, the difficulty of matching the string call information can be reduced, and the jar packages that the DEX file cannot contain can be excluded in advance, so as to better achieve the rapid and accurate analysis of the DEX file and further improve the efficiency of Android software component analysis.

[0076] In an optional embodiment, the screening of the target jar package from at least one set of candidate jar packages includes: determining the first string statistic of each candidate jar package in at least one set of candidate jar packages; using the candidate jar package with the largest first string statistic in at least one set of candidate jar packages as the current target jar package; deleting the target string set of the current target jar package from the first string set; where the target string set includes the fifth string in the current target jar package that is the same as any first string in the first string set and whose call information matches the call information of the first string; re-executing the candidate jar package set determination operation and the target jar package screening operation for the updated first string set until the end condition is met.

[0077] Exemplarily, in order to improve the analysis accuracy of the DEX file, a screening strategy of screening one target jar package step by step can be adopted to screen the target jar package from at least one set of candidate jar packages.

[0078] After obtaining at least one set of candidate jar packages, determine the first string statistic of each candidate jar package in at least one set of candidate jar packages.

[0079] Use the candidate jar package with the largest first string statistic in at least one set of candidate jar packages as the current target jar package.

[0080] Delete the target string set of the current target jar package from the first string set to obtain an updated first string set, where the target string set includes the fifth string in the current target jar package that is the same as any first string in the first string set and whose call information matches the call information of the first string.

[0081] Re - execute the above - mentioned pre - selected jar package set determination operation and target jar package screening operation for the updated first string set until the end condition is met.

[0082] In practical applications, in order to shorten the DEX file component analysis time, the end condition can be set to include that the number of pre - selected jar packages in at least one newly obtained pre - selected jar package set is less than the pre - selected jar package quantity threshold.

[0083] In the embodiment of the present application, by using the pre - selected jar package with the largest first string statistic in at least one pre - selected jar package set as the current target jar package, deleting from the first string set the fifth strings in the current target jar package that are the same as any first string and whose call information matches the call information of the first string, and re - executing the pre - selected jar package set determination operation and target jar package screening operation for the updated first string set until the end condition is met, it is possible to adopt a screening strategy of gradually screening one target jar package, more precisely screen the target jar package from at least one pre - selected jar package set, which is beneficial to improving the analysis accuracy of the DEX file.

[0084] In an optional embodiment, the method further includes step S105: S105. When there are at least two pre - selected jar packages with the largest first string statistic in at least one pre - selected jar package set, use the pre - selected jar package with the largest second string statistic among the at least two pre - selected jar packages as the current target jar package; wherein, the first string statistic of each pre - selected jar package is determined according to the number of target strings and the total number of strings in each pre - selected jar package, the number of target strings in each pre - selected jar package is the total number of sixth strings in each pre - selected jar package that are the same as any first string in the first string set and whose call information matches the call information of the first string, and the second string statistic of each pre - selected jar package is the total number of strings in each pre - selected jar package.

[0085] As an example, in practical applications, there may be a situation where there are at least two pre - selected jar packages with the largest first string statistic in at least one pre - selected jar package set. Considering this, the second string statistic is added to the above - mentioned screening strategy.

[0086] When there are at least two pre - selected jar packages with the largest first string statistic in at least one pre - selected jar package set, determine the second string statistic of each pre - selected jar package among these at least two pre - selected jar packages, and use the pre - selected jar package with the largest second string statistic among these at least two pre - selected jar packages as the current target jar package.

[0087] In an alternative implementation of this embodiment, the first string statistic of each preselected jar package is determined based on the number of target strings and the total number of strings in each preselected jar package. The number of target strings in each preselected jar package is the total number of sixth strings in each preselected jar package that are the same as any first string in the first string set and whose call information matches the call information of the first string. The second string statistic of each preselected jar package is the total number of strings in each preselected jar package.

[0088] In practical applications, the first string statistic of each preselected jar package can be the ratio of the number of target strings to the total number of strings in each preselected jar package, or the percentage of the number of target strings in each preselected jar package in the total number of strings.

[0089] The second character statistic of each preselected jar package, such as the number of strings, can be obtained by querying the feature library.

[0090] In the embodiment of the present application, when there are at least two preselected jar packages with the largest first string statistic in at least one set of preselected jar packages, the preselected jar package with the largest second string statistic among the at least two preselected jar packages is used as the current target jar package. A screening strategy for gradually screening a target jar package based on multiple string statistics can be adopted, ensuring that a target jar package can still be gradually screened from at least one set of preselected jar packages in special cases, which is beneficial to improving the analysis accuracy of DEX files.

[0091] In an alternative embodiment, the end condition includes that the latest obtained at least one set of preselected jar packages is empty.

[0092] Exemplarily, in order to further improve the analysis accuracy of DEX files, the end condition can be set to include that the latest obtained at least one set of preselected jar packages is empty.

[0093] That is to say, when the latest obtained at least one set of preselected jar packages is empty, the step-by-step screening action is ended. At this time, the screening of the target jar package from at least one set of preselected jar packages is completed, and all the screened target jar packages are determined as the components of the DEX file.

[0094] By setting the end condition to include that the latest obtained at least one set of preselected jar packages is empty, it can be ensured that all sets of preselected jar packages corresponding to each first string are processed and analyzed, comprehensively and completely analyzing the jar packages included in the DEX file, and effectively avoiding the problem of missed judgment of DEX files.

[0095] In the embodiment of the present application, by setting the end condition to include that at least one preselected jar package set obtained most recently is empty, it can be ensured that the preselected jar package sets corresponding to each first string are all processed and analyzed, comprehensively and completely analyzing the jar packages included in the DEX file, effectively avoiding the problem of missed judgment of the DEX file, and being beneficial to further improving the analysis accuracy of the DEX file.

[0096] In an optional embodiment, the determining the target jar package as a component of the DEX file includes: determining the component corresponding to the target jar package as a component of the DEX file.

[0097] Exemplarily, in order to facilitate the user to intuitively determine the components in the Android software, after obtaining the target jar package, the component corresponding to the target jar package can be queried from a pre-constructed knowledge base, and the component corresponding to the target jar package is determined as a component of the DEX file.

[0098] It should be noted that the knowledge base stores multiple jar packages and the components corresponding to each jar package.

[0099] In the embodiment of the present application, by determining the component corresponding to the target jar package as a component of the DEX file after obtaining the target jar package, it can facilitate the user to intuitively determine the components in the Android software.

[0100] To more clearly illustrate a method for Android DEX file SCA analysis provided in the first embodiment of the present application, applying the method for Android DEX file SCA analysis, the schematic flowchart of the method for Android DEX file SCA analysis is as Figure 2 shown.

[0101] Please refer to Figure 3 , Figure 3Schematic diagram of a structure of an Android DEX file SCA analysis device provided in the second embodiment of the present application. The second embodiment of the present application provides an Android DEX file SCA analysis device, including: an information acquisition module 201, configured to acquire a first string set of a DEX file and call information of each first string in the first string set; a jar package preselection module 202, configured to determine a preselected jar package set corresponding to the current first string for each first string in the first string set, so as to obtain at least one preselected jar package set; wherein, each preselected jar package in the preselected jar package set includes a second string that is the same as the current first string and whose call information matches the call information of the current first string; a component analysis module 203, configured to screen a target jar package from the at least one preselected jar package set and determine the target jar package as a component of the DEX file; wherein, a first string statistic of the target jar package satisfies a statistic condition, and the first string statistic of the target jar package is determined according to a third string that is the same as any first string in the first string set and whose call information matches the call information of the first string in the target jar package.

[0102] In an optional embodiment, the determining the preselected jar package set corresponding to the current first string includes: querying a raw jar package set corresponding to the current first string from a pre-constructed feature library; wherein, each raw jar package in the raw jar package set includes a fourth string that is the same as the current first string; determining whether the call information of the fourth string in each raw jar package matches the call information of the current first string; wherein, the call information of the fourth string in each raw jar package is queried from the feature library; in a case where the call information of the fourth string in any raw jar package in the raw jar package set does not match the call information of the current first string, deleting the raw jar package from the raw jar package set to obtain the preselected jar package set.

[0103] In an optional embodiment, the device further includes: a feature library construction module, configured to store, for each of a plurality of jar packages, a second string set of the current jar package and call information of each second string in the second string set as a mapping relationship in a database to obtain a feature library.

[0104] In an alternative embodiment, the call information includes the number of calls; determining whether the call information of the fourth string in each original jar package matches the call information of the current first string includes: for each original jar package in the set of original jar packages, comparing the number of calls of the fourth string in the current original jar package with the number of calls of the current first string; if the number of calls of the fourth string in the current original jar package is greater than the number of calls of the current first string, determining that the call information of the fourth string in the current original jar package does not match the call information of the current first string; if the number of calls of the fourth string in the current original jar package is less than or equal to the number of calls of the current first string, determining that the call information of the fourth string in the current original jar package matches the call information of the current first string.

[0105] In an alternative embodiment, screening for a target jar package from at least one set of preselected jar packages includes: determining the first string statistic of each preselected jar package in the at least one set of preselected jar packages; taking the preselected jar package with the largest first string statistic in the at least one set of preselected jar packages as the current target jar package; deleting the set of target strings of the current target jar package from the set of first strings; wherein, the set of target strings includes the fifth strings in the current target jar package that are the same as any first string in the set of first strings and whose call information matches the call information of the first string; re-executing the operation of determining the set of preselected jar packages and the operation of screening for the target jar package for the updated set of first strings until an end condition is met.

[0106] In an alternative embodiment, the component analysis module 203 is further configured to, when there are at least two preselected jar packages with the largest first string statistic in the at least one set of preselected jar packages, take the preselected jar package with the largest second string statistic among the at least two preselected jar packages as the current target jar package; wherein, the first string statistic of each preselected jar package is determined according to the number of target strings and the total number of strings in each preselected jar package, the number of target strings in each preselected jar package is the total number of the sixth strings in each preselected jar package that are the same as any first string in the set of first strings and whose call information matches the call information of the first string, and the second string statistic of each preselected jar package is the total number of strings in each preselected jar package.

[0107] In an alternative embodiment, the end condition includes that the latest obtained at least one set of preselected jar packages is empty.

[0108] In an alternative embodiment, determining the target jar package as a component of the DEX file includes: determining the component corresponding to the target jar package as a component of the DEX file.

[0109] The implementation processes of the functions and roles of each module in the above device are specifically described in the implementation processes of the corresponding steps in the above method, and will not be elaborated here.

[0110] The third embodiment of the present application provides a computer program product. The computer program product includes instructions, which when executed by a computer, cause the computer to implement the method described in the first embodiment of the present application and achieve the same beneficial effects.

[0111] The method described in the first embodiment of the present application can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in each embodiment of the present application are executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM (Open Application Model), or other programmable devices.

[0112] The computer program or instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another. For example, the computer program or instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center in a wired or wireless manner. The computer-readable storage medium can be any available medium that the computer can access or a data storage device such as a server or data center integrating one or more available media. The available medium can be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it can also be an optical medium, such as a digital video disc; or it can be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile types of storage media.

[0113] Please refer to Figure 4 , Figure 4 which is a schematic structural diagram of an electronic device provided in the fourth embodiment of the present application. The fourth embodiment of the present application provides an electronic device 30, including a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; when the processor 301 executes the computer program, it implements the method described in the first embodiment of the present application and achieves the same beneficial effects.

[0114] Among them, when the processor 301 reads the computer program from the memory 302 through the bus 303 and executes the computer program, the method described in the first embodiment of the present application can be implemented.

[0115] The processor 301 can process digital signals and can include various computing architectures. For example, a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of multiple instruction sets. In some examples, the processor 301 can be a microprocessor.

[0116] The memory 302 can be used to store instructions executed by the processor 301 or data related to the instruction execution process. These instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the present application. The processor 301 of this embodiment can be used to execute the instructions in the memory 302 to implement the method described in the first embodiment of the present application. The memory 302 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0117] The fifth embodiment of the present application provides a computer-readable storage medium, which includes a stored computer program; among them, when the computer program runs, it controls the device where the computer-readable storage medium is located to execute the method described in the first embodiment of the present application, and can achieve the same beneficial effects.

[0118] In summary, the embodiments of the present application provide an Android DEX file SCA analysis method, program product, device, and medium. The Android DEX file SCA analysis method includes: obtaining a first string set of a DEX file and call information of each first string in the first string set; for each first string in the first string set, determining a set of preselected jar packages corresponding to the current first string to obtain at least one set of preselected jar packages; wherein, each preselected jar package in the set of preselected jar packages includes a second string that is the same as the current first string and whose call information matches the call information of the current first string; screening target jar packages from at least one set of preselected jar packages and determining the target jar packages as components of the DEX file; wherein, the first string statistic of the target jar package meets a statistic condition, and the first string statistic of the target jar package is determined according to a third string in the target jar package that is the same as any first string in the first string set and whose call information matches the call information of the first string. By determining, for each first string in the DEX file, a set of preselected jar packages corresponding to the current first string based on the current first string and the call information of the current first string to obtain at least one set of preselected jar packages, and determining the first string statistic of each preselected jar package based on a third string in each preselected jar package that is the same as any first string in the DEX file and whose call information matches the call information of the first string, and screening target jar packages whose first string statistic meets the statistic condition from at least one set of preselected jar packages and determining the target jar packages as components of the DEX file, the embodiments of the present application can accurately analyze the jar packages included in the DEX file based on strings and string call information, thereby achieving accurate analysis of the DEX file and improving the efficiency of Android software component analysis.

[0119] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of devices, methods, and computer program products according to multiple embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0120] In addition, in each embodiment of the present application, the various functional modules may be integrated together to form an independent part, or each module may exist alone, or two or more modules may be integrated to form an independent part.

[0121] If the above functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present application. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0122] The above are only embodiments of the present application and are not intended to limit the protection scope of the present application. For those skilled in the art, various modifications and changes can be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application. It should be noted that similar reference numerals and letters indicate similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0123] As described above, the above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, and all should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0124] It should be noted that in this text, relative terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article or device including the said element.

Claims

1. An Android DEX file SCA analysis method, characterized in that, Including: Obtaining a first string set of a DEX file and call information of each first string in the first string set; For each first string in the first string set, determining a set of preselected jar packages corresponding to the current first string to obtain at least one set of preselected jar packages; wherein, each preselected jar package in the set of preselected jar packages includes a second string that is the same as the current first string and whose call information matches the call information of the current first string; Filtering target jar packages from the at least one set of preselected jar packages and determining the target jar packages as components of the DEX file; wherein, the first string statistic of the target jar package satisfies a statistic condition, and the first string statistic of the target jar package is determined according to a third string that is the same as any first string in the first string set and whose call information matches the call information of the first string in the target jar package.

2. The method according to claim 1, wherein The determining the set of preselected jar packages corresponding to the current first string includes: Querying a set of original jar packages corresponding to the current first string from a pre-constructed feature library; wherein, each original jar package in the set of original jar packages includes a fourth string that is the same as the current first string; Judging whether the call information of the fourth string in each original jar package matches the call information of the current first string; wherein, the call information of the fourth string in each original jar package is queried from the feature library; In the case where the call information of the fourth string in any original jar package in the set of original jar packages does not match the call information of the current first string, deleting the original jar package from the set of original jar packages to obtain the set of preselected jar packages.

3. The method according to claim 2, characterized in that, The method further includes: For each jar package among multiple jar packages, storing the second string set of the current jar package and the call information of each second string in the second string set in a database as a mapping relationship to obtain the feature library.

4. The method according to claim 2, wherein The call information includes the number of calls; The judging whether the call information of the fourth string in each original jar package matches the call information of the current first string includes: For each original jar package in the set of original jar packages, comparing the number of calls of the fourth string in the current original jar package with the number of calls of the current first string; If the number of calls of the fourth string in the current original jar package is greater than the number of calls of the current first string, determining that the call information of the fourth string in the current original jar package does not match the call information of the current first string; If the number of calls of the fourth string in the current original jar package is less than or equal to the number of calls of the current first string, determining that the call information of the fourth string in the current original jar package matches the call information of the current first string.

5. The method according to claim 1, characterized in that, Screening a target JAR package from the at least one preselected JAR package set includes: Determining a first string statistic of each preselected JAR package in the at least one preselected JAR package set; Taking the preselected JAR package with the largest first string statistic in the at least one preselected JAR package set as the current target JAR package; Deleting the target string set of the current target JAR package from the first string set; wherein, the target string set includes a fifth string in the current target JAR package that is the same as any first string in the first string set and whose call information matches the call information of the first string; Re-executing the preselected JAR package set determination operation and the target JAR package screening operation for the updated first string set until an end condition is met.

6. The method according to claim 5, characterized in that, The method further includes: When there are at least two preselected JAR packages with the largest first string statistic in the at least one preselected JAR package set, taking the preselected JAR package with the largest second string statistic among the at least two preselected JAR packages as the current target JAR package; Wherein, the first string statistic of each preselected JAR package is determined according to the number of target strings and the total number of strings in each preselected JAR package, the number of target strings in each preselected JAR package is the total number of sixth strings in each preselected JAR package that are the same as any first string in the first string set and whose call information matches the call information of the first string, and the second string statistic of each preselected JAR package is the total number of strings in each preselected JAR package.

7. The method according to claim 5, characterized in that, The end condition includes that the latest obtained at least one preselected JAR package set is empty.

8. The method according to any one of claims 1 to 7, characterized in that, Determining the target JAR package as a component of the DEX file includes: Determining the component corresponding to the target JAR package as a component of the DEX file.

9. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computer, cause the computer to implement the method according to any one of claims 1 to 8.

10. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, it implements the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program runs, it controls the device where the computer-readable storage medium is located to execute the method according to any one of claims 1 to 8.

Images