Android DEX file SCA analysis method, program product, equipment and media

Abstract

The present application provides an Android DEX file SCA analysis method, program product, device, and medium, relating to the technical field of software component analysis. The method determines, for each first string in a DEX file, a set of preselected jar packages corresponding to the current first string based on the current first string and the call information of the current first string, obtaining at least one preselected jar package set, and determining the first string statistics of each preselected jar package based on a third string in each preselected jar package that is identical to any first string in the DEX file and whose call information matches the call information of the first string. Target jar packages whose first string statistics meet the statistical conditions are screened from the at least one preselected jar package set, and the target jar packages are determined as components of the DEX file. This method enables accurate analysis of the DEX file and improves the efficiency of Android software component analysis.

Description

Technical Field

[0001] The present application relates to the technical field of software component analysis, and more specifically, to an Android DEX file SCA analysis method, program product, device, and medium. Background Art

[0002] Software Composition Analysis (SCA) is a technology that identifies and manages third-party components in software, such as open source and commercial components, to detect security vulnerabilities, compliance risks, and supply chain security vulnerabilities. As the depth of analysis increases from homology analysis to source code analysis and then to binary analysis, the difficulty of software composition analysis is also increasing.

[0003] Currently, in order to identify third-party components in Android software, the main method is to analyze the local dynamic library files in the Android software installation package (APK) file. This analysis method is relatively complex, resulting in low efficiency in Android software component analysis. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide an Android DEX file SCA analysis method, program product, device and medium, so as to achieve the technical effect of accurately analyzing DEX files and improving the efficiency of Android software component analysis.

[0005] In a first aspect, an embodiment of the present application provides an Android DEX file SCA analysis method, comprising:

[0006] Obtaining a first string set of a DEX file and call information of each first string in the first string set;

[0007] For each first string in the first string set, determining a preselected jar package set corresponding to the current first string, to obtain at least one preselected jar package set; wherein each preselected jar package in the preselected jar package set includes a second string that is the same as the current first string and whose call information matches the call information of the current first string;

[0008] A target jar package is screened from the at least one preselected jar package set, and the target jar package is determined as a component of the DEX file; wherein, a first string statistic of the target jar package satisfies a statistical condition, and the first string statistic of the target jar package is determined based on a third string in the target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string.

[0009] In the above implementation process, by determining the pre-selected jar package set corresponding to the current first string based on the current first string and the calling information of the current first string for each first string in the DEX file, at least one pre-selected jar package set is obtained, and the first string statistics of each pre-selected jar package are determined based on the third string in each pre-selected jar package that is identical to any first string in the DEX file and whose calling information matches the calling information of the first string, and the target jar package whose first string statistics meet the statistical conditions is screened from at least one pre-selected jar package set, and the target jar package is determined as a component of the DEX file. The jar package contained in the DEX file can be accurately analyzed based on the string and the string calling information, thereby achieving accurate analysis of the DEX file and improving the efficiency of Android software component analysis.

[0010] Furthermore, determining the preselected jar package set corresponding to the current first character string includes:

[0011] Querying a set of original jar packages corresponding to the current first string from a pre-built feature library; wherein each original jar package in the set of original jar packages includes a fourth string identical to the current first string;

[0012] Determining whether the calling information of the fourth string in each of the original jar packages matches the calling information of the current first string; wherein the calling information of the fourth string in each of the original jar packages is queried from the feature library;

[0013] When the calling information of the fourth string in any original jar package in the original jar package set does not match the calling information of the current first string, the original jar package is deleted from the original jar package set to obtain the pre-selected jar package set.

[0014] In the above implementation process, by querying each original jar package that includes the fourth string that is the same as the current first string from a pre-built feature library, it is determined whether the calling information of the fourth string in each original jar package matches the calling information of the current first string. If the calling information of the fourth string in any original jar package does not match the calling information of the current first string, the original jar package is deleted from the original jar package set to obtain a pre-selected jar package set. This can improve the acquisition efficiency of at least one pre-selected jar package set, which is conducive to further improving the efficiency of Android software component analysis.

[0015] Furthermore, the method further comprises:

[0016] For each jar package in the multiple jar packages, the second string set of the current jar package and the calling information of each second string in the second string set are stored in the database as a mapping relationship to obtain the feature library.

[0017] In the above implementation process, by storing the second string set of the current jar package and the calling information of each second string in the second string set as a mapping relationship in the database for each jar package in the multiple jar packages, a feature library is obtained, which can facilitate subsequent direct query of the feature library to determine the pre-selected jar package set corresponding to each first string, which is conducive to further improving the efficiency of Android software component analysis.

[0018] Furthermore, the call information includes the number of calls;

[0019] The determining whether the calling information of the fourth character string in each of the original jar packages matches the calling information of the current first character string includes:

[0020] For each original jar package in the original jar package set, comparing the number of calls of the fourth string in the current original jar package with the number of calls of the current first string;

[0021] If the number of calls of the fourth character string in the current original jar package is greater than the number of calls of the current first character string, it is determined that the call information of the fourth character string in the current original jar package does not match the call information of the current first character string;

[0022] If the number of calls of the fourth string in the current original jar package is less than or equal to the number of calls of the current first string, it is determined that the call information of the fourth string in the current original jar package matches the call information of the current first string.

[0023] In the above implementation process, by selecting the number of string calls as the string call information and matching the string call information by comparing the number of string calls, the difficulty of matching the string call information can be reduced, and the jar packages that the DEX file cannot contain can be excluded in advance, thereby better realizing the rapid and accurate analysis of the DEX file and further improving the efficiency of Android software component analysis.

[0024] Furthermore, the screening of the target jar package from the at least one pre-selected jar package set includes:

[0025] Determine a first string statistic of each pre-selected jar package in the at least one pre-selected jar package set;

[0026] The pre-selected jar package with the largest first string statistic in the at least one pre-selected jar package set is used as the current target jar package;

[0027] Deleting a target string set of the current target jar package from the first string set; wherein the target string set includes a fifth string in the current target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string;

[0028] The preselected jar package set determination operation and the target jar package screening operation are re-executed for the updated first string set until the end condition is met.

[0029] In the above implementation process, by using the pre-selected jar package with the largest first string statistic in at least one pre-selected jar package set as the current target jar package, deleting the fifth string in the current target jar package that is identical to any first string and whose call information matches the call information of the first string from the first string set, and re-executing the pre-selected jar package set determination operation and the target jar package screening operation for the updated first string set until the end condition is met, a screening strategy of screening a target jar package step by step can be adopted to more finely screen the target jar package from at least one pre-selected jar package set, which is beneficial to improving the analysis accuracy of the DEX file.

[0030] Furthermore, the method further comprises:

[0031] In the case that there are at least two pre-selected jar packages with the largest first string statistics in the at least one pre-selected jar package set, the pre-selected jar package with the largest second string statistics among the at least two pre-selected jar packages is used as the current target jar package;

[0032] Among them, the first string statistics of each preselected jar package are determined based on the number of target strings and the total number of strings in each preselected jar package, the number of target strings in each preselected jar package is the total number of sixth strings in each preselected jar package that are identical to any first string in the first string set and whose call information matches the call information of the first string, and the second string statistics of each preselected jar package is the total number of strings in each preselected jar package.

[0033] In the above implementation process, when there are at least two pre-selected jar packages with the largest first string statistics in at least one pre-selected jar package set, the pre-selected jar package with the largest second string statistics among the at least two pre-selected jar packages is used as the current target jar package. A screening strategy of screening a target jar package step by step based on multiple string statistics can be adopted, ensuring that a target jar package can still be screened step by step from at least one pre-selected jar package set under special circumstances, which is conducive to improving the analysis accuracy of DEX files.

[0034] Furthermore, the end condition includes that at least one newly obtained pre-selected jar package set is empty.

[0035] In the above implementation process, by setting the end condition including that at least one of the latest pre-selected jar package sets is empty, it can be ensured that the pre-selected jar package sets corresponding to each first character string are processed and analyzed, and the jar packages contained in the DEX file are comprehensively and completely analyzed, effectively avoiding the problem of missed DEX file judgment, which is conducive to further improving the analysis accuracy of the DEX file.

[0036] Furthermore, determining the target jar package as a component of the DEX file includes:

[0037] The components corresponding to the target jar package are determined as the components of the DEX file.

[0038] In the above implementation process, after obtaining the target jar package, the components corresponding to the target jar package are determined as the components of the DEX file, which can facilitate users to intuitively determine the components in the Android software.

[0039] In a second aspect, an embodiment of the present application provides an Android DEX file SCA analysis device, comprising:

[0040] An information acquisition module, configured to acquire a first string set of a DEX file and call information of each first string in the first string set;

[0041] a jar package preselection module, configured to determine, for each first string in the first string set, a preselected jar package set corresponding to the current first string, to obtain at least one preselected jar package set; wherein each preselected jar package in the preselected jar package set includes a second string that is identical to the current first string and whose call information matches the call information of the current first string;

[0042] A component analysis module is used to filter a target jar package from the at least one pre-selected jar package set and determine the target jar package as a component of the DEX file; wherein, the first string statistic of the target jar package meets the statistical condition, and the first string statistic of the target jar package is determined based on a third string in the target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string.

[0043] In a third aspect, an embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed by a computer, the computer implements the method described above.

[0044] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, the method described above is implemented.

[0045] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 A flowchart of an Android DEX file SCA analysis method provided in the first embodiment of this application;

[0048] Figure 2 This is a flowchart of an Android DEX file SCA analysis method exemplified in the first embodiment of the present application;

[0049] Figure 3 A schematic diagram of the structure of an Android DEX file SCA analysis device provided in the second embodiment of the present application;

[0050] Figure 4 A schematic structural diagram of an electronic device provided in the third embodiment of the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0052] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0053] Software Composition Analysis (SCA) is a technology that identifies and manages third-party components in software, such as open source and commercial components, to detect security vulnerabilities, compliance risks, and supply chain security vulnerabilities. As the depth of analysis increases from homology analysis to source code analysis and then to binary analysis, the difficulty of software composition analysis is also increasing.

[0054] In related technologies, in order to identify third-party components in Android software, the local dynamic library files in the Android software installation package (Android Package, APK) file are mainly analyzed. This analysis method is relatively complicated, resulting in low efficiency in Android software component analysis.

[0055] During Android software development, to improve efficiency, many third-party JAR packages are often included. After being compiled into the APK file, these JAR packages are combined with the in-house developed code to form one or more DEX files. Although DEX files, like JAR packages, are composed of bytecode, the Android compiler optimizes and modifies the JAR package bytecode, making it difficult to accurately identify the JAR packages included in the Android software from the DEX file.

[0056] To this end, the present application proposes a component analysis method for DEX files in APK files. For each first string in the DEX file, the pre-selected jar package set corresponding to the current first string is determined based on the current first string and the calling information of the current first string to obtain at least one pre-selected jar package set. The first string statistics of each pre-selected jar package are determined based on the third string in each pre-selected jar package that is the same as any first string in the DEX file and whose calling information matches the calling information of the first string. The target jar package whose first string statistics meet the statistical conditions is screened from at least one pre-selected jar package set, and the target jar package is determined as a component of the DEX file. The jar package contained in the DEX file can be accurately analyzed based on the string and string calling information, thereby realizing accurate analysis of the DEX file and improving the efficiency of Android software component analysis.

[0057] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments.

[0058] The following combination Figure 1 The present invention describes an Android DEX file SCA analysis method. The method provided in the present invention can be executed by a relevant terminal device, and the following description uses a user terminal as an example of the execution subject.

[0059] Please see Figure 1 , Figure 1 This is a flowchart of an Android DEX file SCA analysis method provided in the first embodiment of this application. The first embodiment of this application provides an Android DEX file SCA analysis method, including steps S101 to S103:

[0060] S101: Obtain a first string set of a DEX file and call information of each first string in the first string set.

[0061] As an example, according to actual business needs, an APK file is predetermined, the APK file is decompressed, and a DEX file in the APK file is obtained.

[0062] The DEX file is parsed, and strings and string call information are extracted from the DEX file to obtain a first string set of the DEX file and call information of each first string in the first string set.

[0063] For example, the first string set is {string_01, string_02, string_03}, the calling information of string_01 is a1, the calling information of string_02 is a2, and the calling information of string_03 is a3.

[0064] It should be noted that the first character string set includes at least one first character string.

[0065] S102. For each first string in the first string set, determine a preselected jar package set corresponding to the current first string to obtain at least one preselected jar package set; wherein each preselected jar package in the preselected jar package set includes a second string that is the same as the current first string and whose call information matches the call information of the current first string.

[0066] As an example, after obtaining the first string set and the calling information of each first string in the first string set, for each first string in the first string set, a pre-selected jar package set corresponding to the current first string is determined, wherein each pre-selected jar package in the pre-selected jar package set includes a second string that is the same as the current first string and whose calling information matches the calling information of the current first string.

[0067] Since the first string set includes at least the first string, at least one pre-selected jar package set will be obtained eventually.

[0068] For example, assume that multiple jar packages are pre-collected, namely jar_1, jar_2, and jar_3.

[0069] The string set of jar_1 is {string_11, string_12, string_13}, string_11 is the same as string_01, and the call information of string_11 matches the call information a1 of string_01; string_12 is the same as string_02, and the call information of string_12 matches the call information a2 of string_02; string_13 is the same as string_03, and the call information of string_13 matches the call information a3 of string_03.

[0070] The string set of jar_2 is {string_21, string_22, string_23}, only string_22 is the same as string_02, and the call information of string_22 matches the call information a2 of string_02.

[0071] The string set of jar_3 is {string_31, string_32, string_33}, string_31 is the same as string_01, and the call information of string_31 matches the call information a1 of string_01; string_32 is the same as string_02, and the call information of string_32 matches the call information a2 of string_02.

[0072] The preselected jar package set corresponding to string_1 is {jar_1,jar_3}, the preselected jar package set corresponding to string_2 is {jar_1,jar_2,jar_3}, and the preselected jar package set corresponding to string_3 is {jar_1}. In this case, at least one preselected jar package set includes: the preselected jar package set corresponding to string_1, namely {jar_1,jar_3}; the preselected jar package set corresponding to string_2, namely {jar_1,jar_2,jar_3}; and the preselected jar package set corresponding to string_3 is {jar_1}.

[0073] The correspondence between each first string and the preselected jar package is a one-to-one or one-to-many relationship, that is, string_1 <=> {jar_1, jar_3}; string_2 <=> {jar_1, jar_2, jar_3}; string_3 <=> {jar_1}. Based on the correspondence between each first string and the preselected jar package, the correspondence between each preselected jar package and the first string can be established, that is, jar_1 <=> {string_1, string_2, string_3}; jar_2 <=> {string_2}; jar_3 <=> {string_1, string_3}.

[0074] S103. Filter a target jar package from at least one pre-selected jar package set, and determine the target jar package as a component of the DEX file; wherein, a first string statistic of the target jar package meets a statistic condition, and the first string statistic of the target jar package is determined based on a third string in the target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string.

[0075] As an example, after obtaining at least one preselected jar package set, for each preselected jar package in the at least one preselected jar package set, the first string statistic of the current preselected jar package is determined based on the third string in the current preselected jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string, and whether the first string statistic of the current preselected jar package meets a preset statistical condition is judged, for example, the first string statistic is greater than a preset first string statistic threshold, and the preselected jar packages whose first string statistics meet the statistical condition are screened from the at least one preselected jar package set as target jar packages, and the target jar packages are determined as components of the DEX file.

[0076] For example, the at least one preselected jar package set includes: the preselected jar package set corresponding to string_1, namely {jar_1, jar_3}; the preselected jar package set corresponding to string_2, namely {jar_1, jar_2, jar_3}; and the preselected jar package set corresponding to string_3 is {jar_1}. In this case, the preselected jar packages in the at least one preselected jar package set are jar_1, jar_2, and jar_3 respectively.

[0077] For jar_1, since string_11 is the same as string_01 and the call information of string_11 matches the call information a1 of string_01, string_12 is the same as string_02 and the call information of string_12 matches the call information a2 of string_02, and string_13 is the same as string_03 and the call information of string_13 matches the call information a3 of string_03, the first string statistic of jar_1 is determined based on string_11, string_12, and string_13.

[0078] For jar_2, since only string_22 is identical to string_02 and the call information of string_22 matches the call information a2 of string_02, the first string statistic of jar_2 is determined based on string_22.

[0079] For jar_3, since string_31 is identical to string_01 and its call information matches a1 of string_01, and string_32 is identical to string_02 and its call information matches a2 of string_02, the first string statistic of jar_3 is determined based on string_31 and string_32.

[0080] Although the Android compiler optimizes and modifies the bytecode of imported JAR files, it does not modify the JAR file's strings. Therefore, by analyzing the presence of a JAR file in a DEX file based on strings and string call information, we can accurately analyze the DEX file's composition. Even if the same string exists in multiple JAR files, string call information can be used to assist in analyzing the presence of a JAR file, ensuring accurate analysis of the DEX file's composition.

[0081] The embodiment of the present application determines, for each first string in the DEX file, a set of preselected jar packages corresponding to the current first string based on the current first string and the calling information of the current first string, to obtain at least one preselected jar package set, and determines the first string statistics of each preselected jar package based on a third string in each preselected jar package that is identical to any first string in the DEX file and whose calling information matches the calling information of the first string, filters out a target jar package whose first string statistics meet the statistical condition from the at least one preselected jar package set, determines the target jar package as a component of the DEX file, and can accurately analyze the jar package contained in the DEX file based on the string and the string calling information, thereby achieving accurate analysis of the DEX file and improving the efficiency of Android software component analysis.

[0082] In an optional embodiment, determining the preselected jar package set corresponding to the current first string includes: querying the original jar package set corresponding to the current first string from a pre-built feature library; wherein each original jar package in the original jar package set includes a fourth string that is the same as the current first string; judging whether the call information of the fourth string in each original jar package matches the call information of the current first string; wherein the call information of the fourth string in each original jar package is queried from the feature library; if the call information of the fourth string in any original jar package in the original jar package set does not match the call information of the current first string, deleting the original jar package from the original jar package set to obtain the preselected jar package set.

[0083] As an example, in order to quickly determine the pre-selected jar package set corresponding to each first character string, a feature library is pre-built, wherein the feature library is used to store the collected multiple jar packages, as well as the character strings and string call information in each jar package.

[0084] After obtaining the first string set and the call information of each first string in the first string set, for each first string in the first string set, a set of original jar packages corresponding to the current first string is queried from a pre-built feature library, wherein each original jar package in the set of original jar packages includes a fourth string that is the same as the current first string.

[0085] The calling information of the fourth character string in each original jar package is searched from the feature library to determine whether the calling information of the fourth character string in each original jar package matches the calling information of the current first character string.

[0086] When the calling information of the fourth character string in any original jar package in the original jar package set matches the calling information of the current first character string, the original jar package in the original jar package set is retained.

[0087] When the calling information of the fourth string in any original jar package in the original jar package set does not match the calling information of the current first string, the original jar package is deleted from the original jar package set to obtain the pre-selected jar package set.

[0088] The embodiment of the present application queries each original jar package that includes a fourth string that is the same as the current first string from a pre-built feature library, determines whether the call information of the fourth string in each original jar package matches the call information of the current first string, and if the call information of the fourth string in any original jar package does not match the call information of the current first string, deletes the original jar package from the original jar package set to obtain a pre-selected jar package set, which can improve the acquisition efficiency of at least one pre-selected jar package set and is conducive to further improving the efficiency of Android software component analysis.

[0089] In an optional embodiment, the method further includes step S104:

[0090] S104 . For each jar package in the multiple jar packages, store the second string set of the current jar package and the call information of each second string in the second string set as a mapping relationship in a database to obtain a feature library.

[0091] As an example, according to actual business needs, multiple jar packages are collected from a commonly used package manager for Android, such as a repository that Maven depends on.

[0092] For each jar package in the multiple jar packages, the current jar package is parsed, and strings and string calling information are extracted from the current jar package to obtain a second string set of the current jar package and calling information of each second string in the second string set. The second string set of the current jar package and the calling information of each second string in the second string set are stored as a mapping relationship in a database to obtain a feature library.

[0093] In actual applications, you can extract strings and string call information from the jar package by parsing the constant pool of the jar package.

[0094] In the embodiment of the present application, for each jar package in a plurality of jar packages, the second string set of the current jar package and the call information of each second string in the second string set are stored in a database as a mapping relationship to obtain a feature library. This facilitates subsequent direct query of the feature library to determine the pre-selected jar package set corresponding to each first string, which is beneficial to further improve the efficiency of Android software component analysis.

[0095] In an optional embodiment, the call information includes the number of calls; the determination of whether the call information of the fourth string in each original jar package matches the call information of the current first string includes: for each original jar package in the original jar package set, comparing the number of calls of the fourth string in the current original jar package and the number of calls of the current first string; if the number of calls of the fourth string in the current original jar package is greater than the number of calls of the current first string, determining that the call information of the fourth string in the current original jar package does not match the call information of the current first string; if the number of calls of the fourth string in the current original jar package is less than or equal to the number of calls of the current first string, determining that the call information of the fourth string in the current original jar package matches the call information of the current first string.

[0096] As an example, considering that even if the same string exists in multiple jar packages, the number of calls to the string in multiple jar packages may be different, and after the jar packages are combined with the self-developed code to form one or more DEX files, the number of calls to the string in the DEX file cannot be less than the number of calls to the string before the jar packages are combined, the number of string calls can be selected as the string call information.

[0097] After obtaining the original jar package set corresponding to the current first string, for each original jar package in the original jar package set, the number of calls of the fourth string in the current original jar package is compared with the number of calls of the current first string.

[0098] If the number of calls of the fourth string in the current original jar package is greater than the number of calls of the current first string, it is determined that the call information of the fourth string in the current original jar package does not match the call information of the current first string. At this time, it is considered that the DEX file cannot contain the current original jar package.

[0099] If the number of calls of the fourth string in the current original jar package is less than or equal to the number of calls of the current first string, it is determined that the call information of the fourth string in the current original jar package matches the call information of the current first string. At this time, it is considered that the DEX file may contain the current original jar package.

[0100] By comparing the number of string calls to match string call information, we can not only reduce the difficulty of matching string call information and quickly determine the set of pre-selected jar packages corresponding to each first string, but also exclude jar packages that are unlikely to be included in the DEX file in advance, simplifying the subsequent processing and analysis process.

[0101] The embodiment of the present application selects the number of string calls as the string call information and matches the string call information by comparing the number of string calls. This can reduce the difficulty of matching the string call information and exclude jar packages that the DEX file cannot contain in advance, thereby better realizing the rapid and accurate analysis of the DEX file and further improving the efficiency of Android software component analysis.

[0102] In an optional embodiment, the screening of target jar packages from at least one preselected jar package set includes: determining a first string statistic for each preselected jar package in at least one preselected jar package set; taking a preselected jar package with the largest first string statistic in at least one preselected jar package set as a current target jar package; deleting a target string set of the current target jar package from the first string set; wherein the target string set includes a fifth string in the current target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string; and re-executing the preselected jar package set determination operation and the target jar package screening operation for the updated first string set until an end condition is met.

[0103] As an example, in order to improve the analysis accuracy of the DEX file, a screening strategy of screening a target jar package step by step can be adopted to screen the target jar package from at least one pre-selected jar package set.

[0104] After obtaining at least one pre-selected jar package set, a first string statistic of each pre-selected jar package in the at least one pre-selected jar package set is determined.

[0105] A pre-selected jar package with the largest first string statistic in at least one pre-selected jar package set is used as the current target jar package.

[0106] The target string set of the current target jar package is deleted from the first string set to obtain an updated first string set, wherein the target string set includes a fifth string in the current target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string.

[0107] The above-mentioned pre-selected jar package set determination operation and target jar package screening operation are re-executed for the updated first string set until the end condition is met.

[0108] In practical applications, in order to shorten the time for DEX file component analysis, the end condition can be set to include that the number of pre-selected jar packages in at least one newly obtained pre-selected jar package set is less than the pre-selected jar package number threshold.

[0109] In an embodiment of the present application, a preselected jar package with the largest first string statistic in at least one preselected jar package set is used as the current target jar package, and a fifth string in the current target jar package that is identical to any first string and whose call information matches the call information of the first string is deleted from the first string set. The preselected jar package set determination operation and the target jar package screening operation are re-executed for the updated first string set until the end condition is met. This allows for a screening strategy of screening a target jar package step by step, and allows for more refined screening of target jar packages from at least one preselected jar package set, which is beneficial to improving the analysis accuracy of DEX files.

[0110] In an optional embodiment, the method further includes step S105:

[0111] S105. When there are at least two pre-selected jar packages with the largest first string statistics in at least one pre-selected jar package set, the pre-selected jar package with the largest second string statistics among the at least two pre-selected jar packages is used as the current target jar package; wherein, the first string statistics of each pre-selected jar package is determined based on the number of target strings and the total number of strings in each pre-selected jar package, the number of target strings in each pre-selected jar package is the total number of sixth strings in each pre-selected jar package that are identical to any first string in the first string set and whose call information matches the call information of the first string, and the second string statistics of each pre-selected jar package is the total number of strings in each pre-selected jar package.

[0112] As an example, in actual applications, there may be at least two pre-selected jar packages with the largest first string statistics in at least one pre-selected jar package set. In view of this, the second string statistics are added to the above screening strategy.

[0113] When there are at least two pre-selected jar packages with the largest first character string statistics in at least one pre-selected jar package set, determine the second character statistics of each pre-selected jar package in the at least two pre-selected jar packages, and use the pre-selected jar package with the largest second character string statistics among the at least two pre-selected jar packages as the current target jar package.

[0114] In an optional implementation of this embodiment, the first string statistic of each preselected jar package is determined based on the number of target strings and the total number of strings in each preselected jar package, the number of target strings in each preselected jar package is the total number of sixth strings in each preselected jar package that are identical to any first string in the first string set and whose call information matches the call information of the first string, and the second string statistic of each preselected jar package is the total number of strings in each preselected jar package.

[0115] In practical applications, the first string statistic of each pre-selected jar package may be the ratio of the number of target strings to the total number of strings in each pre-selected jar package, or the percentage of the number of target strings to the total number of strings in each pre-selected jar package.

[0116] The second character statistics of each pre-selected jar package, such as the number of character strings, can be obtained from the feature library.

[0117] In the embodiment of the present application, when there are at least two pre-selected jar packages with the largest first string statistic in at least one pre-selected jar package set, the pre-selected jar package with the largest second string statistic among the at least two pre-selected jar packages is used as the current target jar package. This can adopt a screening strategy of screening a target jar package step by step based on multiple string statistics, ensuring that a target jar package can still be screened step by step from at least one pre-selected jar package set under special circumstances, which is beneficial to improving the analysis accuracy of DEX files.

[0118] In an optional embodiment, the termination condition includes that at least one newly obtained pre-selected jar package set is empty.

[0119] As an example, in order to further improve the analysis accuracy of the DEX file, the end condition may be set to include at least one newly obtained pre-selected jar package set being empty.

[0120] That is to say, when at least one pre-selected jar package set is empty, the step-by-step screening action is ended. At this time, the target jar package is screened from at least one pre-selected jar package set, and all the screened target jar packages are determined as components of the DEX file.

[0121] By setting the end condition to include at least one newly obtained pre-selected jar package set being empty, it can be ensured that the pre-selected jar package sets corresponding to each first string are processed and analyzed, and the jar packages contained in the DEX file are comprehensively and completely analyzed, effectively avoiding the problem of missed DEX file detection.

[0122] The embodiment of the present application sets the end condition including that at least one newly obtained pre-selected jar package set is empty, thereby ensuring that the pre-selected jar package sets corresponding to each first character string are processed and analyzed, comprehensively and completely analyzing the jar packages contained in the DEX file, effectively avoiding the problem of missed DEX file detection, and helping to further improve the analysis accuracy of the DEX file.

[0123] In an optional embodiment, determining the target jar package as a component of the DEX file includes: determining a component corresponding to the target jar package as a component of the DEX file.

[0124] As an example, in order to facilitate users to intuitively determine the components in Android software, after obtaining the target jar package, the components corresponding to the target jar package can be queried from the pre-built knowledge base, and the components corresponding to the target jar package can be determined as the components of the DEX file.

[0125] It should be noted that the knowledge base stores multiple jar packages and components corresponding to each jar package.

[0126] The embodiment of the present application determines the components corresponding to the target jar package as the components of the DEX file after obtaining the target jar package, which makes it convenient for users to intuitively determine the components in the Android software.

[0127] In order to more clearly illustrate an Android DEX file SCA analysis method provided by the first embodiment of the present application, the Android DEX file SCA analysis method is applied. The flow chart of the Android DEX file SCA analysis method is as follows: Figure 2 shown.

[0128] Please see Figure 3 , Figure 3 A structural diagram of an Android DEX file SCA analysis device provided for the second embodiment of the present application. The second embodiment of the present application provides an Android DEX file SCA analysis device, comprising: an information acquisition module 201 for acquiring a first string set of a DEX file and call information of each first string in the first string set; a jar package pre-selection module 202 for determining, for each first string in the first string set, a pre-selected jar package set corresponding to the current first string, and obtaining at least one pre-selected jar package set; wherein each pre-selected jar package in the pre-selected jar package set includes a second string that is identical to the current first string and whose call information matches the call information of the current first string; a component analysis module 203 for screening a target jar package from the at least one pre-selected jar package set and determining the target jar package as a component of the DEX file; wherein the first string statistic of the target jar package meets the statistic condition, and the first string statistic of the target jar package is determined based on a third string in the target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string.

[0129] In an optional embodiment, determining the preselected jar package set corresponding to the current first string includes: querying the original jar package set corresponding to the current first string from a pre-built feature library; wherein each original jar package in the original jar package set includes a fourth string that is the same as the current first string; judging whether the call information of the fourth string in each original jar package matches the call information of the current first string; wherein the call information of the fourth string in each original jar package is queried from the feature library; if the call information of the fourth string in any original jar package in the original jar package set does not match the call information of the current first string, deleting the original jar package from the original jar package set to obtain the preselected jar package set.

[0130] In an optional embodiment, the device also includes: a feature library construction module, which is used to store the second string set of the current jar package and the calling information of each second string in the second string set as a mapping relationship in the database for each jar package in the multiple jar packages to obtain a feature library.

[0131] In an optional embodiment, the call information includes the number of calls; the determination of whether the call information of the fourth string in each original jar package matches the call information of the current first string includes: for each original jar package in the original jar package set, comparing the number of calls of the fourth string in the current original jar package and the number of calls of the current first string; if the number of calls of the fourth string in the current original jar package is greater than the number of calls of the current first string, determining that the call information of the fourth string in the current original jar package does not match the call information of the current first string; if the number of calls of the fourth string in the current original jar package is less than or equal to the number of calls of the current first string, determining that the call information of the fourth string in the current original jar package matches the call information of the current first string.

[0132] In an optional embodiment, the screening of target jar packages from at least one preselected jar package set includes: determining a first string statistic for each preselected jar package in at least one preselected jar package set; taking a preselected jar package with the largest first string statistic in at least one preselected jar package set as a current target jar package; deleting a target string set of the current target jar package from the first string set; wherein the target string set includes a fifth string in the current target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string; and re-executing the preselected jar package set determination operation and the target jar package screening operation for the updated first string set until an end condition is met.

[0133] In an optional embodiment, the component analysis module 203 is further used to, when there are at least two pre-selected jar packages with the largest first string statistic in at least one pre-selected jar package set, use the pre-selected jar package with the largest second string statistic among the at least two pre-selected jar packages as the current target jar package; wherein the first string statistic of each pre-selected jar package is determined based on the number of target strings and the total number of strings in each pre-selected jar package, the number of target strings in each pre-selected jar package is the total number of sixth strings in each pre-selected jar package that are identical to any first string in the first string set and whose call information matches the call information of the first string, and the second string statistic of each pre-selected jar package is the total number of strings in each pre-selected jar package.

[0134] In an optional embodiment, the termination condition includes that at least one newly obtained pre-selected jar package set is empty.

[0135] In an optional embodiment, determining the target jar package as a component of the DEX file includes: determining a component corresponding to the target jar package as a component of the DEX file.

[0136] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0137] The third embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed by a computer, the computer implements the method described in the first embodiment of the present application and can achieve the same beneficial effects.

[0138] The method described in the first embodiment of the present application can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in each embodiment of the present application are executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM (Open Application Model), or other programmable device.

[0139] A computer program or instruction can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, a computer program or instruction can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. A computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server or data center that integrates one or more available media. Available media can be magnetic media, such as floppy disks, hard disks, or magnetic tapes; optical media, such as digital video disks; or semiconductor media, such as solid-state drives. The computer-readable storage medium can be volatile or non-volatile, or can include both volatile and non-volatile types of storage media.

[0140] Please see Figure 4 , Figure 4This is a schematic diagram of the structure of an electronic device provided in the fourth embodiment of the present application. The fourth embodiment of the present application provides an electronic device 30, comprising a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; when the processor 301 executes the computer program, it implements the method described in the first embodiment of the present application and can achieve the same beneficial effects as described above.

[0141] The processor 301 may implement the method described in the first embodiment of the present application when reading the computer program from the memory 302 via the bus 303 and executing the computer program.

[0142] Processor 301 can process digital signals and can include various computing architectures, such as a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of multiple instruction sets. In some examples, processor 301 can be a microprocessor.

[0143] The memory 302 can be used to store instructions executed by the processor 301 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all functions of one or more modules described in the embodiments of this application. The processor 301 of this embodiment can be used to execute the instructions in the memory 302 to implement the method described in the first embodiment of this application. The memory 302 includes dynamic random access memory, static random access memory, flash memory, optical storage, or other memory known to those skilled in the art.

[0144] The fifth embodiment of the present application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method described in the first embodiment of the present application, and can achieve the same beneficial effects as the method.

[0145] In summary, the embodiments of the present application provide an Android DEX file SCA analysis method, program product, device and medium, wherein the Android DEX file SCA analysis method includes: obtaining a first string set of the DEX file, and the call information of each first string in the first string set; for each first string in the first string set, determining a preselected jar package set corresponding to the current first string, and obtaining at least one preselected jar package set; wherein each preselected jar package in the preselected jar package set includes a second string that is identical to the current first string and whose call information matches the call information of the current first string; screening a target jar package from at least one preselected jar package set, and determining the target jar package as a component of the DEX file; wherein the first string statistic of the target jar package meets the statistic condition, and the first string statistic of the target jar package is determined based on a third string in the target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string. The embodiment of the present application determines, for each first string in the DEX file, a set of preselected jar packages corresponding to the current first string based on the current first string and the calling information of the current first string, to obtain at least one preselected jar package set, and determines the first string statistics of each preselected jar package based on a third string in each preselected jar package that is identical to any first string in the DEX file and whose calling information matches the calling information of the first string, filters out a target jar package whose first string statistics meet the statistical condition from the at least one preselected jar package set, determines the target jar package as a component of the DEX file, and can accurately analyze the jar package contained in the DEX file based on the string and the string calling information, thereby achieving accurate analysis of the DEX file and improving the efficiency of Android software component analysis.

[0146] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0147] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0148] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0149] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0150] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0151] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. An Android DEX file SCA analysis method, characterized in that: include: Obtaining a first string set of a DEX file and call information of each first string in the first string set; For each first string in the first string set, determining a preselected jar package set corresponding to the current first string, to obtain at least one preselected jar package set; wherein each preselected jar package in the preselected jar package set includes a second string that is the same as the current first string and whose call information matches the call information of the current first string; A target jar package is screened from the at least one preselected jar package set, and the target jar package is determined as a component of the DEX file; wherein, a first string statistic of the target jar package satisfies a statistical condition, and the first string statistic of the target jar package is determined based on a third string in the target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string.

2. The method according to claim 1, characterized in that The determining of the preselected jar package set corresponding to the current first character string includes: Querying a set of original jar packages corresponding to the current first string from a pre-built feature library; wherein each original jar package in the set of original jar packages includes a fourth string identical to the current first string; Determining whether the calling information of the fourth string in each of the original jar packages matches the calling information of the current first string; wherein the calling information of the fourth string in each of the original jar packages is queried from the feature library; When the calling information of the fourth string in any original jar package in the original jar package set does not match the calling information of the current first string, the original jar package is deleted from the original jar package set to obtain the pre-selected jar package set.

3. The method according to claim 2, characterized in that The method further comprises: For each jar package in the multiple jar packages, the second string set of the current jar package and the calling information of each second string in the second string set are stored in the database as a mapping relationship to obtain the feature library.

4. The method according to claim 2, characterized in that The call information includes the number of calls; The determining whether the calling information of the fourth character string in each of the original jar packages matches the calling information of the current first character string includes: For each original jar package in the original jar package set, comparing the number of calls of the fourth string in the current original jar package with the number of calls of the current first string; If the number of calls of the fourth character string in the current original jar package is greater than the number of calls of the current first character string, it is determined that the call information of the fourth character string in the current original jar package does not match the call information of the current first character string; If the number of calls of the fourth string in the current original jar package is less than or equal to the number of calls of the current first string, it is determined that the call information of the fourth string in the current original jar package matches the call information of the current first string.

5. The method according to claim 1, wherein The screening of the target jar package from the at least one pre-selected jar package set includes: Determine a first string statistic of each pre-selected jar package in the at least one pre-selected jar package set; The pre-selected jar package with the largest first string statistic in the at least one pre-selected jar package set is used as the current target jar package; Deleting a target string set of the current target jar package from the first string set; wherein the target string set includes a fifth string in the current target jar package that is identical to any first string in the first string set and whose call information matches the call information of the first string; The preselected jar package set determination operation and the target jar package screening operation are re-executed for the updated first string set until the end condition is met.

6. The method according to claim 5, characterized in that The method further comprises: In the case that there are at least two pre-selected jar packages with the largest first string statistics in the at least one pre-selected jar package set, the pre-selected jar package with the largest second string statistics among the at least two pre-selected jar packages is used as the current target jar package; Among them, the first string statistics of each preselected jar package are determined based on the number of target strings and the total number of strings in each preselected jar package, the number of target strings in each preselected jar package is the total number of sixth strings in each preselected jar package that are identical to any first string in the first string set and whose call information matches the call information of the first string, and the second string statistics of each preselected jar package is the total number of strings in each preselected jar package.

7. The method according to claim 5, characterized in that The end condition includes that at least one newly obtained pre-selected jar package set is empty.

8. The method according to any one of claims 1 to 7, characterized in that Determining the target jar package as a component of the DEX file includes: The components corresponding to the target jar package are determined as the components of the DEX file.

9. A computer program product, characterized in that The computer program product comprises instructions which, when executed by a computer, cause the computer to implement the method according to any one of claims 1 to 8.

10. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 8.

Images