Cross-application Android privacy disclosure dynamic detection method based on MCP protocol and LLM

Abstract

The invention discloses a cross-application Android privacy disclosure dynamic detection method based on an MCP protocol and an LLM, which is used for detecting privacy information disclosure of an address book in an Android APK, and comprises the following steps: unpacking and decompiling an Android APK file, obtaining an Android Manifest.xml file and a Small file set, taking the obtained file as input, injecting a Small code called by a log method into a target APK file by an Instrumentor module, and sending the Android APK file to a server; after instrumentation is completed, an application program is repackaged for subsequent operation, a repackaged APK file is deployed to an Android simulator or a test machine containing a Logger module to operate, an LLM is used for controlling an MCP server side to trigger a complete leakage path aiming at the whole android life cycle and cross-multi-application jump in the program operation process, a method sequence related to privacy leakage is obtained, and the privacy leakage is completed. When a program runs, the Logger module conducts Trace on a whole smali code and is responsible for recording runtime information after instrumentation, the runtime information comprises the sequence of method calling, parameter transmission, the state of a register and the like and writing the runtime information into a log file, then a to-be-analyzed smali Logger result set is transmitted into the Analyzer module, and the Analyzer module sends the to-be-analyzed smali Logger result set to the Logger module. The method comprises the following steps: analyzing runtime data (such as a method call chain, a register state and a stain mark) collected by Logger, matching sensitive APIs (Application Program Interface), and finally judging whether data flow leakage from Source (stain source) to Sink (dangerous API) is caused or not. The invention provides a dynamic taint analysis method aiming at Android byte-level Smali codes, and the method improves the coverage rate of dynamic taint analysis and ensures the expandability while effectively solving the problems that the taint is not reachable, and the taint analysis cannot be across applications and ICC (International Circuit Communication) (Inter-Component Communication, Inter-Component Communication).

Description

Technical Field

[0001] The present invention belongs to the technical field of dynamic detection of privacy leakage of Android application programs, and in particular relates to a cross-application Android privacy leakage dynamic detection method based on the MCP protocol and LLM. Background Art

[0002] Dynamic taint analysis is usually carried out in the real runtime environment or sandbox simulation environment of Android applications, by real-time monitoring of the program execution process to track the flow of sensitive data. In the complex runtime interaction scenarios of Android, capturing dynamically triggered inter-component communication (ICC), asynchronous event callbacks, and cross-process data transfer paths is the core challenge of building an accurate taint propagation model. Specifically, dynamic taint analysis first needs to identify the source point (such as user input events triggering privacy API calls) and the convergence point (such as network requests to send encrypted data) at runtime, mark memory operations and system calls through instrumentation technology, and update the taint label status in real time based on data flow dependencies. By observing the actual execution path of the program, it is possible to verify whether there is a reachable sensitive data flow from the source point to the convergence point.

[0003] Existing dynamic taint analysis often combines virtual machine monitoring, system hooking, and symbolic execution. While dynamic taint analysis offers higher accuracy, it faces challenges in improving code coverage while reducing time and space overhead to avoid high resource consumption. Furthermore, traditional dynamic taint analysis struggles to address the propagation and triggering of dynamic taints across multiple applications. To this end, this chapter proposes a novel dynamic taint analysis method that combines dynamic code injection, the MCP protocol, and large language model technology to address these issues. This method, without modifying the original APK code, allows us to insert target logging code into APK files using a logger and an instrumenter. Using the MCP server, we can manipulate multiple apps, simulating real input to actively trigger the execution of target method sequences, capturing their behavior and performing customized analysis. Finally, by analyzing the actively triggered taint analysis logs, we can detect sensitive information leaks. This method not only leverages the high accuracy of dynamic taint analysis but also effectively balances code coverage with time and space complexity, resolving the problem of false positives in malicious behavior identification and providing a new and reliable solution for dynamic taint analysis.

[0004] By observing actual execution paths, this type of technology can handle scenarios difficult to cover with static analysis, such as dynamic code loading and reflective calls. However, traditional dynamic taint analysis struggles to trigger taints when jumping across multiple applications, further leading to inherent limitations such as insufficient execution coverage and incomplete test case coverage, leading to missed detections. A cross-application dynamic detection method for Android privacy leaks based on the MCP protocol and LLM can effectively provide more triggered taints for dynamic taint analysis. This method not only addresses the propagation issues of taint analysis across multiple application jumps and improves code coverage, but also reduces engineering costs and improves analysis accuracy.

[0005] Through the above analysis, the problems and defects of the existing technology are as follows:

[0006] Existing dynamic taint analysis often faces high time and space complexity problems when expanding code coverage, and is extremely dependent on the actual triggered execution path. However, traditional dynamic taint analysis tools have path coverage blind spots, and the code coverage for multi-branch conditions and hidden trigger logic (such as timer delayed loading) is insufficient, which may miss potential contaminated paths. In addition, the traditional dynamic analysis triggering method is too cumbersome to engineer, requiring engineers to have rich dynamic analysis experience and knowledge reserves, which has a high consumption of personnel costs. Finally, both dynamic and static analysis can realize the migration reasoning of global contamination states across lifecycle events, but it is difficult to perform automated taint triggering for taint analysis across applications, which further reduces the efficiency of dynamic taint analysis and increases engineering costs. Summary of the Invention

[0007] In response to the problems existing in the prior art, the present invention provides an LLM-driven dynamic detection method for privacy leakage of Android applications.

[0008] The present invention is implemented as follows: an LLM protocol-driven Android application privacy leakage dynamic detection method includes:

[0009] Step 1: Unpack and decompile the Android APK file to obtain the Smali file set, which is then passed to the Instrumentator module to inject the Smali code of the log method call into the target APK file, i.e., perform instrumentation to record the method call sequence and taint propagation information. After instrumentation is completed, the application is repackaged for subsequent operation.

[0010] Step 2: Deploy the repackaged APK file to an Android emulator containing the Logger module and run it. During program execution, LLM is used to manipulate the MCP server to trigger the complete leakage path for the entire Android lifecycle and multi-application jumps, thereby obtaining the method sequence related to privacy leakage.

[0011] Step 3: Trace the entire smali code. While the program is running, the Logger module is responsible for recording the runtime information after the instrumentation, including the order of method calls, parameter passing, and register status, and writing it to the log file.

[0012] In step 4, the Logger result set Analyzer module compares the duplication of tainted parameters and return values within the method at the dangerous API to determine if the taint has been leaked. A machine learning algorithm is then used to train and classify the extracted multi-dimensional features, filtering out abnormal behavior patterns. This distinguishes between malicious programs that mimic normal application behavior (such as secretly exploiting user contact information) and normal application behavior, generating highly accurate taint analysis results.

[0013] Furthermore, in step 1, the AndroidManifest.xml and Dex files are extracted from the Android APK file and decompiled to generate the Smali file set for analysis. The Instrumentator module then instruments all unofficial code sections based on the principle of over-approximation. The files are read and written to temporary files. After instrumentation is complete, the temporary files replace the original files, avoiding the time and space overhead of redundant instrumentation. This flag significantly improves the efficiency of detecting sensitive operations during dynamic analysis.

[0014] Furthermore, in step 2, the MCP module uses natural language as input, the LLM issues a taint trigger command, and the MCP client controls the MCP server. The MCP server automatically triggers taints on the tested APP on the target test machine, solving the problems of unreachable taints, taint analysis failure across applications, and ICC (Inter-Component Communication), improving the coverage of dynamic taint analysis, and recording runtime information across lifecycles, components, and multiple applications.

[0015] Furthermore, in step three, the Logger module is inserted into the application installation package via the Instrumentator, implementing log printing in Smali format. After repackaging and installing on an Android test machine or emulator, when the application runs, the Logger intercepts log output tagged with TAG and set to the debug level and writes it to the log file to be analyzed. The Logger's primary goal is to record the type of method calls and the register status returned by the method calls, providing detailed behavioral data for subsequent analysis.

[0016] Furthermore, in step 4, the Smali Logger result set to be analyzed is passed to the Analyzer module. As the core decision-making layer for dynamic taint analysis, the Analyzer module is responsible for conducting in-depth analysis of the runtime data collected by the Logger (such as method call chains, register status, and taint markers), matching sensitive APIs, and ultimately determining whether a complete leakage path from the source (taint source) to the sink (dangerous API) exists. Its core logic is to verify whether the data flow has caused a leak by correlating the propagation path of the tainted parameter with the tainted status of the return value.

[0017] Another object of the present invention is to provide a dynamic detection method for cross-application Android privacy leakage based on the MCP protocol and LLM, including:

[0018] The decompilation module is used to extract AndroidManifest.xml and Dex files from Android APK files, and decompile the Dex files to generate a set of Smali files to be analyzed;

[0019] The instrumentation module is used by Instrumentator to insert additional Smali code into the application installation package. Based on the over-approximate coverage strategy, it adopts an incremental file processing mechanism for non-system-level code in the application (such as third-party libraries and custom logic). Only the modified instrumentation content is written to the temporary cache and then replaces the original file to avoid performance redundancy caused by repeated instrumentation. When a sensitive Sink API is detected in a method call, the Sink flag is marked in the corresponding parameter. This flag can significantly improve the detection efficiency of sensitive operations in dynamic analysis, thereby efficiently capturing sensitive operation traces in dynamic analysis and simultaneously reducing runtime resource usage and false positive interference;

[0020] The MCP module, through the MCP protocol and leveraging the natural language interaction capabilities of the Large Language Model (LLM), converts user instructions (such as "simulate cross-application data sharing") into structured operation flows. Through the MCP Client-Server collaborative mechanism, it executes multi-dimensional automated triggering tasks on the target application on the test device. This module addresses issues in traditional dynamic taint analysis, such as the inability to analyze across applications, unreachable paths, and ICC (Inter-Component Communication), improving the path coverage of dynamic taint analysis while fully tracking runtime data flows across applications, components, and the entire lifecycle.

[0021] The log module is used by the Logger module to trace the entire smali code. While the program is running, the Logger module is responsible for recording the runtime information after the instrumentation, including the order of method calls, parameter passing, and register status, and writing them to the log file;

[0022] The analysis module, used by the Analyzer module, checks whether there is a path from the taint source to the sink point during actual application execution. The execution order of smali instructions is determined based on timestamps and the order in which logs are printed. Each log entry is analyzed for features: the current class, the current method, and the instruction that called the method. The log is traversed to verify that method calls are exception-compliant. During the traversal, sink points are detected, meaning the Sink flag is searched. If the flag is found, the static analysis result is true. If the flag is not found, the static analysis result is verified as false.

[0023] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the dynamic detection method for cross-application Android privacy leakage based on the MCP protocol and LLM.

[0024] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the cross-application Android privacy leakage dynamic detection method based on the MCP protocol and LLM.

[0025] Another object of the present invention is to provide an information data processing terminal, which is used to implement the cross-application Android privacy leakage dynamic detection system based on the MCP protocol and LLM.

[0026] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0027] First, the present invention discloses a cross-application Android privacy leakage dynamic detection method based on MCP protocol and LLM, which is used for detecting the leakage of contact book privacy information in Android APK, including: unpacking and decompiling the Android APK file, obtaining the AndroidManifest.xml file and the Smali file set, taking the obtained files as input, and injecting the Smali code of the log method call into the target APK file by the Instrumentator module. After the instrumentation is completed, the application is repackaged for subsequent operation, and the repackaged APK file is deployed to an Android emulator or test machine containing a Logger module for operation. During the program operation, the LLM is used to control the MCP server to trigger the complete leakage path for the entire Android life cycle and multi-application jumps, and the method sequence related to privacy leakage is obtained. While the program is running, the Logger module traces the entire smali code and is responsible for recording the runtime information after the instrumentation, including the order of method calls, parameter passing and register status, and writing it into the log file. Then, the Smali code to be analyzed is written into the log file. The Logger result set is passed to the Analyzer module, which is responsible for analyzing the runtime data collected by the Logger (such as method call chains, register states, and taint markers), matching sensitive APIs, and ultimately determining whether a data flow from the source (tainted source) to the sink (dangerous API) has been leaked. This paper proposes a dynamic taint analysis method for Android byte-level Smali code. This method effectively solves the problems of taint inaccessibility, the inability to perform taint analysis across applications, and ICC (Inter-Component Communication) while improving the coverage of dynamic taint analysis and ensuring scalability.

[0028] Second, the present invention discloses a dynamic cross-application Android privacy leakage detection method based on the MCP protocol and LLM. This method can effectively detect whether Android applications have contact information privacy leakage detection. When the detected information is leaked, the method sequence through which the leaked data flow is returned is returned. The following is a description of the advantages of each of the optimized technologies:

[0029] 1. A dynamic taint analysis module based on the MCP protocol and driven by LLM is proposed. The taint trigger command is issued through natural language, and the MCP client controls the MCP server. The MCP server automatically triggers taints on the tested APP on the target test machine. This solves the problems of Smali bytecode analysis, such as the inability of dynamic taint analysis to cross applications, unreachable taints, and ICC (Inter-Component Communication), while improving the code coverage of dynamic taint analysis.

[0030] 2. Design sensitive permission rules (such as READ_CONTACTS) and sensitive API rules (such as getDeviceId()) related to the data source (Source). Through dynamic matching, the Smali code set is screened layer by layer against the above rules. The comparison module compares the Smali file set with these rules and the Smali files with the four major component information parsed from the AndroidManifest.xml file. This eliminates unnecessary code segments associated with undeclared components, narrowing the scope of analysis and ensuring code coverage while avoiding incomplete analysis. This strategy maintains the integrity of code coverage while focusing on potential contamination paths (such as cross-component Intent transmission). It also reduces redundant analysis based on code context pruning, improving detection efficiency.

[0031] 3. A SmaliLogger instrumentation method and taint verification rules are proposed. Combining the two, the entire SmaliCode is traced and runtime information after instrumentation is recorded, including the order of method calls, parameter passing, and register status. The log files are then written to traverse the logs to verify whether the method calls are compliant. During the traversal process, convergence points are searched to ensure the integrity of the taint propagation path records.

[0032] Third, existing Android application privacy leakage detection technologies face the following technical issues:

[0033] 1. The problem of taint propagation across multiple applications: Traditional taint analysis cannot solve the problem of taint propagation across multiple applications. Even if the ICC problem is solved, it cannot detect taints that cause application jumps, which will cause the loss of taint propagation data flow and limit the comprehensiveness of dynamic taint analysis results.

[0034] 2. Accuracy Issues: Many existing methods rely on crude static analysis techniques, which may not accurately identify complex data flows and control flows, resulting in missed and false positives.

[0035] 3. Unreachable Taints: Traditional dynamic taint analysis relies on coverage of the actual execution path. When taint propagation is limited by untriggered conditional branches, critical data flows cannot reach the detection endpoint (Sink), resulting in a broken taint path. Although taint markers exist, they cannot be captured by dynamic taint analysis, resulting in missed detections and reduced taint coverage.

[0036] In order to solve the above problems, the following technical solutions are proposed:

[0037] 1. This paper designs a dynamic detection method for cross-application Android privacy leakage based on the MCP protocol and LLM. Through the MCP protocol, natural language is involved in the taint analysis process, and LLM drives the triggering of cross-application taints, solving the problem of taint propagation across multiple applications.

[0038] 2. A method for automatically triggering taints is proposed, which abandons the traditional method of generating random taint inputs, simulates real input to trigger taints, ensures that conditional branches are fully triggered under real inputs, and solves the problem of unreachable taints.

[0039] 3. An advanced taint analysis technology is proposed. By cooperating with the Logger and the Analyzer, the application is accurately instrumented and the taint marker registers are tracked. Based on the over-approximate coverage strategy, non-system-level code within the application (such as third-party libraries and custom logic) is detected. This can significantly improve the detection efficiency of sensitive operations in dynamic analysis and solve the accuracy problem. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a flow chart of a dynamic detection method for cross-application Android privacy leakage based on the MCP protocol and LLM provided by an embodiment of the present invention.

[0041] Figure 2 This is a structural block diagram of a cross-application Android privacy leakage dynamic detection system based on the MCP protocol and LLM provided by an embodiment of the present invention.

[0042] Figure 3 This is an overall framework diagram of the cross-application Android privacy leakage dynamic detection method based on the MCP protocol and LLM provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0044] like Figure 1As shown, an embodiment of the present invention provides a dynamic detection method for cross-application Android privacy leakage based on the MCP protocol and LLM, including the following steps:

[0045] S101, the decompilation module is used to extract AndroidManifest.xml and Dex files from the Android APK file, and decompile the Dex file to generate a Smali file set to be analyzed;

[0046] S102, the Instrumentator module inserts additional Smali code into the application installation package. Based on the over-approximate coverage strategy, when it detects that a sensitive Sink API is involved in a method call, it marks the Sink flag in the corresponding parameter.

[0047] In step S103, the MCP module leverages the natural language interaction capabilities of the Large Language Model (LLM) to convert user instructions (such as "simulate cross-application data sharing") into structured operation flows. Through the MCP client-server collaborative mechanism, it executes multi-dimensional automated triggering tasks on the target application on the test device, while fully tracking runtime data flows across applications, components, and the entire lifecycle.

[0048] S104: The Logger module traces the entire smali code. While the program is running, the Logger module is responsible for recording the runtime information after the instrumentation, including the order of method calls, parameter passing, and register status, and writes it to the log file.

[0049] In step S105, the Analyzer module checks whether there is a path from the taint source to the convergence point during actual application execution. The smali instruction execution order is determined based on the timestamps and log printing order. Each log entry is analyzed for its characteristics: the current class, the current method, and the instruction that called the method. The log is then traversed to verify that the method call is compliant with the exception, and convergence points are identified during the traversal process.

[0050] In S101, the embodiment of the present invention provides extracting AndroidManifest.xml and Dex files from the Android APK file, and decompiling the Dex files to generate a Smali file set to be analyzed.

[0051] In S102, the instrumentator module, according to the over-approximation principle, instruments all unofficial code. It reads files and writes them to temporary files. After instrumentation is complete, the temporary files replace the original files, avoiding the time and space overhead of redundant instrumentation. This flag significantly improves the efficiency of detecting sensitive operations during dynamic analysis.

[0052] In S103, the MCP module uses natural language as input, the LLM issues a taint trigger command, the MCP client controls the MCP server, and the MCP server automatically triggers taints on the tested app on the target test machine. This solves the problems of unreachable taints, inability to perform taint analysis across applications, and ICC (Inter-Component Communication), improves the coverage of dynamic taint analysis, and records runtime information across lifecycles, components, and multiple applications.

[0053] In S104, an embodiment of the present invention provides a Logger module that is inserted into the application installation package via the Instrumentator, implementing log printing in Smali format. After being repackaged and installed on an Android test machine or emulator, when the application runs, the Logger intercepts log output tagged with TAG and set to debug level and writes it to the log file to be analyzed. The Logger's primary purpose is to record the type of method calls and the register status returned by the method calls, providing detailed behavioral data support for subsequent analysis.

[0054] In S105, the Smali Logger result set to be analyzed is passed to the Analyzer module. As the core decision-making layer for dynamic taint analysis, the Analyzer module is responsible for conducting in-depth analysis of the runtime data collected by the Logger (such as method call chains, register status, and taint markers), matching sensitive APIs, and ultimately determining whether a complete leakage path exists from the source (taint source) to the sink (dangerous API). Its core logic is to verify whether the data flow has caused a leak by correlating the propagation path of the tainted parameter with the tainted status of the return value.

[0055] like Figure 2 As shown, an embodiment of the present invention provides a byte-level static detection system for Android application privacy leakage, including:

[0056] The decompilation module is used to extract AndroidManifest.xml and Dex files from Android APK files, and decompile the Dex files to generate a set of Smali files to be analyzed;

[0057] The instrumentation module is used by Instrumentator to insert additional Smali code into the application installation package. Based on the over-approximate coverage strategy, it adopts an incremental file processing mechanism for non-system-level code in the application (such as third-party libraries and custom logic). Only the modified instrumentation content is written to the temporary cache, and then the original file is replaced to avoid performance redundancy caused by repeated instrumentation. When a sensitive Sink API is detected in a method call, the Sink flag is marked in the corresponding parameter. This flag can significantly improve the detection efficiency of sensitive operations in dynamic analysis, thereby efficiently capturing sensitive operation trajectories in dynamic analysis and simultaneously reducing runtime resource usage and false alarm interference.

[0058] The MCP module, through the MCP protocol and leveraging the natural language interaction capabilities of the Large Language Model (LLM), converts user instructions (such as "simulate cross-application data sharing") into structured operation flows. Through the MCP Client-Server collaborative mechanism, it executes multi-dimensional automated triggering tasks on the target application on the test device. This module addresses issues in traditional dynamic taint analysis, such as the inability to analyze across applications, unreachable paths, and ICC (Inter-Component Communication), improving the path coverage of dynamic taint analysis while fully tracking runtime data flows across applications, components, and the entire lifecycle.

[0059] The log module is used by the Logger module to trace the entire smali code. While the program is running, the Logger module is responsible for recording the runtime information after the instrumentation, including the order of method calls, parameter passing, and register status, and writing it to the log file;

[0060] The analysis module, used by the Analyzer module, checks whether there is a path from the taint source to the sink point during actual application execution. The execution order of smali instructions is determined based on timestamps and the order in which logs are printed. Each log entry is analyzed for features: the current class, the current method, and the instruction that called the method. The log is traversed to verify that method calls are exception-compliant. During the traversal, sink points are detected, meaning the Sink flag is searched. If the flag is found, the static analysis result is true. If the flag is not found, the static analysis result is verified as false.

[0061] An embodiment of the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor performs the steps of the cross-application Android privacy leakage dynamic detection method based on the MCP protocol and LLM.

[0062] An embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor performs the steps of the cross-application Android privacy leakage dynamic detection method based on the MCP protocol and LLM.

[0063] An embodiment of the present invention provides an information data processing terminal, which is used to implement the cross-application Android privacy leakage dynamic detection system based on the MCP protocol and LLM.

Claims

1. A dynamic detection method for cross-application Android privacy leakage based on MCP protocol and LLM, characterized by: The following steps are involved: Step 1: Unpack and decompile the Android APK file to obtain the Smali file set, which is then passed to the Instrumentator module to inject the Smali code of the log method call into the target APK file, i.e., perform instrumentation to record the method call sequence and taint propagation information. After instrumentation is completed, the application is repackaged for subsequent operation. Step 2: Deploy the repackaged APK file to an Android emulator containing the Logger module and run it. During program execution, LLM is used to manipulate the MCP server to trigger the complete leakage path for the entire Android lifecycle and multi-application jumps, thereby obtaining the method sequence related to privacy leakage. Step 3: Trace the entire smali code. While the program is running, the Logger module is responsible for recording the runtime information after the instrumentation, including the order of method calls, parameter passing, and register status, and writing it to the log file. In step 4, the Logger result set Analyzer module compares the duplication of tainted parameters and return values within the method at the dangerous API to determine if the taint has been leaked. A machine learning algorithm is then used to train and classify the extracted multi-dimensional features, filtering out abnormal behavior patterns. This distinguishes between malicious programs that mimic normal application behavior (such as secretly exploiting user contact information) and normal application behavior, generating highly accurate taint analysis results.

2. The cross-application Android privacy leakage dynamic detection method based on MCP protocol and LLM according to claim 1 is characterized in that: In step 1, the AndroidManifest.xml and Dex files are extracted from the Android APK file and decompiled to generate the Smali file set for analysis. The Instrumentator module then instruments all unofficial code sections based on the principle of over-approximation. The files are read and written to temporary files. After instrumentation is complete, the temporary files replace the original files, avoiding the time and space overhead of redundant instrumentation. This flag significantly improves the efficiency of detecting sensitive operations during dynamic analysis.

3. The cross-application Android privacy leakage dynamic detection method based on MCP protocol and LLM according to claim 1 is characterized in that: In step 2, the automated taint trigger module uses natural language as input, the LLM issues a taint trigger command, the MCP client controls the MCP server, and the MCP server automatically triggers taints on the tested APP on the target test machine. This solves the problems of unreachable taints, inability to perform taint analysis across applications, and ICC (Inter-Component Communication), improves the coverage of dynamic taint analysis, and records runtime information across life cycles, components, and multiple applications.

4. The cross-application Android privacy leakage dynamic detection method based on MCP protocol and LLM according to claim 1 is characterized in that: In step three, the Logger module is inserted into the application installation package via the Instrumentator, implementing log printing in Smali format. After repackaging and installing on an Android test machine or emulator, when the application runs, the Logger intercepts log output tagged with TAG and set to the debug level and writes it to the log file to be analyzed. The Logger's primary goal is to record the type of method calls and the register status returned by the method calls, providing detailed behavioral data for subsequent analysis.

5. The cross-application Android privacy leakage dynamic detection method based on MCP protocol and LLM according to claim 1 is characterized in that: In step 4, the Smali Logger result set to be analyzed is passed to the Analyzer module. As the core decision-making layer for dynamic taint analysis, the Analyzer module is responsible for conducting in-depth analysis of the runtime data collected by the Logger (such as method call chains, register states, and taint markers), matching sensitive APIs, and ultimately determining whether a complete leakage path exists from the source (taint source) to the sink (dangerous API). Its core logic is to verify whether the data flow has caused a leak by correlating the propagation path of the tainted parameter with the tainted status of the return value.

6. A cross-application Android privacy leakage dynamic detection system based on the MCP protocol and LLM, which implements the cross-application Android privacy leakage dynamic detection method based on the MCP protocol and LLM as described in any one of claims 1 to 5, characterized in that: The cross-application Android privacy leakage dynamic detection system based on the MCP protocol and LLM includes: The decompilation module is used to extract AndroidManifest.xml and Dex files from Android APK files, and decompile the Dex files to generate a set of Smali files to be analyzed; The instrumentation module is used by Instrumentator to insert additional Smali code into the application installation package. Based on the over-approximate coverage strategy, it adopts an incremental file processing mechanism for non-system-level code in the application (such as third-party libraries and custom logic). Only the modified instrumentation content is written to the temporary cache, and then the original file is replaced to avoid performance redundancy caused by repeated instrumentation. When a sensitive Sink API is detected in a method call, the Sink flag is marked in the corresponding parameter. This flag can significantly improve the detection efficiency of sensitive operations in dynamic analysis, thereby efficiently capturing sensitive operation trajectories in dynamic analysis and simultaneously reducing runtime resource usage and false alarm interference. The MCP module, through the MCP protocol and leveraging the natural language interaction capabilities of the Large Language Model (LLM), converts user instructions (such as "simulate cross-application data sharing") into structured operation flows. Through the MCP Client-Server collaborative mechanism, it executes multi-dimensional automated triggering tasks on the target application on the test device. This module addresses issues such as the inability to cross applications, unreachable paths, and ICC (Inter-Component Communication) in traditional dynamic taint analysis, improving the path coverage of dynamic taint analysis while fully tracking runtime data flows across applications, components, and the entire lifecycle. The log module is used by the Logger module to trace the entire smali code. While the program is running, the Logger module is responsible for recording the runtime information after the instrumentation, including the order of method calls, parameter passing, and register status, and writing it to the log file; The analysis module, used by the Analyzer module, checks whether there is a path from the taint source to the sink point during actual application execution. The execution order of smali instructions is determined based on timestamps and the order in which logs are printed. Each log entry is analyzed for features: the current class, the current method, and the instruction that called the method. The log is traversed to verify that method calls are exception-compliant. During the traversal, sink points are detected, meaning the Sink flag is searched. If the flag is found, the static analysis result is true. If the flag is not found, the static analysis result is verified as false.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the cross-application Android privacy leakage dynamic detection method based on the MCP protocol and LLM according to any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor performs the steps of the cross-application Android privacy leakage dynamic detection method based on the MCP protocol and LLM according to any one of claims 1 to 5.

9. An information data processing terminal, configured to implement the cross-application Android privacy leakage dynamic detection system based on the MCP protocol and LLM as claimed in claim 6.

Images