Security detection method and device of mobile application, computer equipment and storage medium

Abstract

The embodiment of the invention discloses a security detection method and device of a mobile application, computer equipment and a storage medium. The method comprises the following steps: acquiring an installation package file of a target mobile application, and acquiring a decompiled file of the installation package file; performing static risk detection on the decompiled file according to a static risk analysis rule to obtain a static risk analysis result; configuring a Hook point of dynamic instrumentation for the target mobile application according to a static risk analysis result; running the target mobile application, and obtaining running behavior data of the target mobile application through the Hook point; performing dynamic risk detection on the operation behavior data according to a dynamic risk analysis rule to obtain a dynamic risk analysis result; performing feature matching on a preset malicious software feature library and the decompiled file to obtain a malicious software analysis result; and generating a security detection result of the target mobile application according to each analysis result. By implementing the method provided by the embodiment of the invention, the security detection precision of the mobile application can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet, and particularly relates to a security detection method and device of a mobile application, a computer device and a storage medium. BACKGROUND

[0002] With the rapid development of mobile Internet, the number of mobile applications has increased explosively. While providing convenient services, various applications also face severe privacy security risks. Current mobile application privacy security detection technologies mainly include static detection tools and dynamic detection tools.

[0003] The static detection tools (such as Fortify and QARK) mainly identify explicit vulnerabilities by analyzing application codes and configuration files. However, the static detection tools can only identify permission declarations in AndroidManifest, and cannot track actual calling paths and context environments of sensitive APIs, which makes it difficult to determine whether the permissions are misused.

[0004] The dynamic detection tools can monitor application runtime behaviors, but only record whether APIs are called, lack accurate time stamps and complete call stacks, and cannot determine calling compliance, which has detection blind spots.

[0005] It can be seen that the existing mobile application privacy security detection technologies have problems such as difficulty in determining whether the permissions are misused and detection blind spots, and have low security detection precision. In order to ensure the security of mobile applications, a method is urgently needed to improve the security detection precision of mobile applications. SUMMARY

[0006] The embodiments of the present application provide a security detection method and device of a mobile application, a computer device and a storage medium, which can improve the security detection precision of mobile applications.

[0007] In a first aspect, the embodiments of the present application provide a security detection method of a mobile application, which includes: obtaining an installation package file of a target mobile application, and performing decompilation processing on the installation package file to obtain a decompiled file of the installation package file; performing static risk detection on the decompiled file according to a preset static risk analysis rule to obtain a static risk analysis result; configuring a Hook point of dynamic instrumentation for the target mobile application according to the static risk analysis result; running the target mobile application, and obtaining running behavior data of the target mobile application through the Hook point; performing dynamic risk detection on the running behavior data according to a preset dynamic risk analysis rule to obtain a dynamic risk analysis result; According to the preset malware feature library and the decompiled file, feature matching is performed to obtain a malware analysis result; According to the static risk analysis result, the dynamic risk analysis result, and the malware analysis result, a security detection result of the target mobile application is generated.

[0008] In a second aspect, the embodiments of the present application further provide a security detection device of a mobile application, which comprises: A static analysis unit is configured to obtain an installation package file of a target mobile application, perform decompilation processing on the installation package file to obtain a decompiled file of the installation package file, and perform static risk detection on the decompiled file according to a preset static risk analysis rule to obtain a static risk analysis result. A dynamic analysis unit is configured to configure a Hook point of dynamic plug-in according to the static risk analysis result, run the target mobile application, obtain running behavior data of the target mobile application through the Hook point, perform dynamic risk detection on the running behavior data according to a preset dynamic risk analysis rule, and obtain a dynamic risk analysis result. A malware analysis unit is configured to perform feature matching according to a preset malware feature library and the decompiled file to obtain a malware analysis result. A result generation unit is configured to generate a security detection result of the target mobile application according to the static risk analysis result, the dynamic risk analysis result, and the malware analysis result.

[0009] In a third aspect, the embodiments of the present application further provide a computer device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the above method when executing the computer program.

[0010] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program, the computer program comprises program instructions, and the program instructions can implement the above method when executed by a processor.

[0011] The embodiment of the present application provides a mobile application security detection method, device, computer equipment and storage medium. The method comprises the following steps: obtaining an installation package file of a target mobile application, and performing decompilation processing on the installation package file to obtain a decompilation file of the installation package file; performing static risk detection on the decompilation file according to a preset static risk analysis rule to obtain a static risk analysis result; configuring a dynamic plug-in Hook point of the target mobile application according to the static risk analysis result; running the target mobile application, and obtaining running behavior data of the target mobile application through the Hook point; performing dynamic risk detection on the running behavior data according to a preset dynamic risk analysis rule to obtain a dynamic risk analysis result; performing feature matching according to a preset malicious software feature library and the decompilation file to obtain a malicious software analysis result; and generating a security detection result of the target mobile application according to the static risk analysis result, the dynamic risk analysis result and the malicious software analysis result. On the one hand, the embodiment of the present application combines static risk analysis, dynamic risk analysis and malicious software analysis to perform security detection on the target mobile application, which can cross-verify vulnerabilities and has high security detection precision; on the other hand, the embodiment of the present application configures the dynamic plug-in Hook point of the target mobile application according to the static risk analysis result, and does not need to configure a Hook point for each monitoring point of the target mobile application, so that accurate dynamic detection of data can be realized and dynamic monitoring resources can be reduced. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0013] Figure 1 A flowchart of a mobile application security detection method provided by the embodiment of the present application is shown in the figure. Figure 2 A sub-flowchart of a mobile application security detection method provided by the embodiment of the present application is shown in the figure. Figure 3 Another sub-flowchart of a mobile application security detection method provided by the embodiment of the present application is shown in the figure. Figure 4 Another sub-flowchart of a mobile application security detection method provided by the embodiment of the present application is shown in the figure. Figure 5 Another sub-flowchart of a mobile application security detection method provided by the embodiment of the present application is shown in the figure. Figure 6 A schematic block diagram of a mobile application security detection device provided by the embodiment of the present application is shown in the figure. Figure 7 The schematic block diagram of the computer device provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0014] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0015] It should be understood that, when used in the specification and the appended claims, the terms "comprise" and "include" indicate the presence of the described features, integers, steps, operations, elements, and / or components, but do not exclude one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0016] It should also be understood that the terms used in the specification of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification and the appended claims of the present application, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0017] It should be further understood that the term "and / or" used in the specification and the appended claims of the present application refers to any combination of one or more of the associated listed items and all possible combinations thereof, and includes these combinations.

[0018] The embodiments of the present application provide a mobile application security detection method, device, computer device and storage medium, which can solve the problems of insufficient static detection depth, blind area in dynamic detection, lack of compliance comparison, low detection efficiency and the like in the existing mobile application privacy security detection technology, provide a mobile application privacy security detection method supporting compliance verification, which is multi-module cooperative and heterogeneous feature fusion, and realize comprehensive, accurate and efficient detection of mobile application privacy security risks.

[0019] The execution subject of the mobile application security detection method can be a mobile application security detection device provided by the embodiments of the present application, or a computer device integrated with the mobile application security detection device, wherein the mobile application security detection device can be realized in the form of hardware or software, and the computer device can be a terminal or a server.

[0020] Figure 1 is a flowchart of the mobile application security detection method provided by the embodiments of the present application. As shown in Figure 1As shown, the method includes steps S110-S170.

[0021] S110, an installation package file of a target mobile application is acquired, and the installation package file is decompiled to obtain a decompiled file of the installation package file.

[0022] In this embodiment, the target mobile application is an application that currently needs to be detected for privacy security, and the installation package file can be specifically an APK (Android application package) / IPA (iOS platform exclusive application installation package format) file.

[0023] The installation package file is decompiled by a preset decompilation tool, which can be an apktool (a reverse engineering tool for Android APK files), jadx (an open-source Android Dex / APK decompilation tool), or the like.

[0024] The decompiled file includes code, resource files, configuration files, and the like corresponding to the installation package file, and is used for subsequent detection of potential risks.

[0025] S120, a static risk analysis rule is preset to perform static risk detection on the decompiled file to obtain a static risk analysis result.

[0026] Specifically, in some embodiments, referring to Figure 2 , step S120 includes: S1201, an abstract syntax tree of the decompiled file is generated, and it is determined whether a preset dangerous call chain is included in the abstract syntax tree by traversing the abstract syntax tree to obtain a first risk analysis result.

[0027] In this embodiment, an abstract syntax tree (AST) corresponding to the decompiled file is generated, and then the syntax nodes of the AST are traversed in a structured manner to accurately locate a preset dangerous function call relationship and an execution link, thereby solving the problem that a traditional regular matching cannot capture code logic association.

[0028] S1202, a regular matching rule is preset to perform hard coding and sensitive path identification processing on the decompiled file to obtain a second risk analysis result.

[0029] In this embodiment, a preset regular matching rule is used to perform text scanning on the readable file (code, configuration file) after decompilation, accurately identify hard-coded sensitive information and sensitive path access features, and form a complement to AST analysis, thereby covering static risks in a “surface” and fixed format.

[0030] Hard coding includes hard-coded keys / codes (corresponding to regular matching rules matching the keys, passwords, tokens and other sensitive information stored in plaintext in the code), hard-coded server information (matching the unencrypted server IP, domain name, interface address through corresponding regular matching rules), and sensitive paths (matching the hard-coded sensitive directory access paths in the code through corresponding regular matching rules).

[0031] S1203, analyze the description file of the target mobile application, and perform dangerous permission combination and / or excessive permission identification processing on the target mobile application to obtain a third risk analysis result.

[0032] In this embodiment, the description file of the target mobile application can be AndroidManifest.xml, and the target mobile application can be subjected to dangerous permission combination and / or excessive permission identification processing through preset dangerous permission combinations and preset excessive permissions, i.e., whether the preset dangerous permission combinations or the preset excessive permissions exist in the description file corresponding to the target mobile application is identified.

[0033] Further, different excessive permission identification rules are set for different types of mobile applications, i.e., different excessive permissions are preset for different mobile applications.

[0034] For example, for weather apps, the permissions of reading call records, sending messages, and installing applications are excessive permissions, and for text editing apps, the permissions of precise positioning and reading messages are excessive permissions.

[0035] Among them, the dangerous permission combination contains at least two permissions, and when the mobile application simultaneously possesses all the permissions in the dangerous permission combination, it is judged that the application has the dangerous permission combination.

[0036] For example, reading messages and network requests are a dangerous permission combination, precise positioning, background positioning and network requests are a dangerous permission combination (continuously collecting user location and uploading in the background), and reading call records and sending messages are a dangerous permission combination.

[0037] S1204, determining the static risk analysis result according to the first risk analysis result, the second risk analysis result and the third risk analysis result.

[0038] In this embodiment, the risk analysis data contained in the first risk analysis result, the second risk analysis result and the third risk analysis result is taken as the static risk analysis result.

[0039] Further, the static risk analysis result includes a vulnerability list, a risk level (different vulnerabilities correspond to different risk levels) and a recommended repair scheme.

[0040] S130. Configure dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results.

[0041] In this embodiment, the target mobile application is dynamically instrumented using the vulnerability list in the static risk analysis results. High-risk targets are first accurately screened through static analysis, and then Hook points are configured specifically in the dynamic analysis to avoid inefficiency and performance loss caused by indiscriminate instrumentation.

[0042] For example, static risk analysis results can reveal which sensitive APIs (vulnerability lists) are used in the code (decompiled files), and dynamic risk analysis can use Frida (a lightweight, cross-platform dynamic instrumentation tool) scripts to hook the call information of these sensitive APIs.

[0043] Specifically, dynamic instrumentation includes injecting code via Frida and hooking key functions.

[0044] This embodiment supports custom script extensibility: it allows users to write Frida scripts for specific scenarios (such as encryption algorithm key generation logic, plaintext leakage in network communication), which is far more flexible than the fixed rules of static tools.

[0045] S140. Run the target mobile application and obtain the running behavior data of the target mobile application through the Hook point.

[0046] In this embodiment, the application is run on a simulator or a real device, and its runtime behavior (such as network communication, file operations, and API calls) is monitored in real time.

[0047] In some embodiments, specifically, please refer to Figure 3 The step of obtaining the target mobile application's runtime behavior data through the Hook point includes: S1401. Dynamically configure the monitoring scripts corresponding to each Hook according to the runtime context of the target mobile application.

[0048] S1402. Obtain the running behavior data of the target mobile application through the Hook and the corresponding monitoring script.

[0049] In this embodiment, different monitoring scripts are preset for different Hook point types (the Hook point type is determined based on the inserted node type when instrumenting). The monitoring script is used to indicate which data should be intercepted for the corresponding second Hook, thereby achieving accurate data acquisition.

[0050] Specifically, during dynamic analysis in this embodiment, the instrumentation strategy can be dynamically selected based on the application runtime context (such as the current Activity (one of the core components of an Android application, responsible for the visual interface that interacts with the user) and network requests): Frida scripts are automatically injected to intercept keys for Secure Sockets Layer (SSL) communication (network communication class); path sensitivity (such as whether / data / data / is accessed) is monitored in real time for file operations. It can be seen that this embodiment can reduce the performance loss caused by irrelevant instrumentation.

[0051] Specifically, this embodiment achieves traffic interception by integrating Mitmproxy (an open-source interactive HTTPS proxy tool) or Burp Suite (a powerful web application security testing tool) to intercept HTTP / HTTPS traffic, and achieves behavior monitoring by recording file read / write, system calls, Intent broadcasts, etc.

[0052] S150. Perform dynamic risk detection on the operational behavior data according to the preset dynamic risk analysis rules to obtain dynamic risk analysis results.

[0053] In some embodiments, the dynamic risk analysis rule specifically includes multiple dynamic risk analysis sub-rules; please refer to [link to relevant documentation]. Figure 4 Step S150 includes: S1501. Based on the Hook point type of the Hook point corresponding to the running behavior data and the preset correspondence between the Hook point type and the dynamic risk analysis sub-rules, determine the dynamic risk analysis sub-rules corresponding to each of the running behavior data.

[0054] S1502. Perform dynamic risk detection on the corresponding operational behavior data according to the dynamic risk analysis sub-rules to obtain the dynamic risk analysis results.

[0055] In this embodiment, different dynamic risk analysis sub-rules are preset for different Hook point types. For each Hook point, after the corresponding operation behavior data is obtained, dynamic risk detection is performed on the operation behavior data through the corresponding dynamic risk analysis sub-rules to obtain the dynamic risk analysis result of the operation behavior data of each Hook point.

[0056] The types of Hook points include sensitive API call classes, file operation classes, network communication classes, dynamically loaded classes, and cross-process communication classes.

[0057] Specifically, the runtime behavior data collected by Hook points for sensitive API calls includes sensitive data such as device ID and location. The corresponding dynamic risk analysis sub-rules include: sensitive API call timing compliance rules, SDK over-declaration call rules, and permission abuse behavior rules. The runtime behavior data collected by Hook points for file operations includes data corresponding to file read and write behaviors. The corresponding dynamic risk analysis sub-rules include: sensitive data storage rules and background silent behavior rules (determining whether background read and write are performed). The runtime behavior data collected by Hook points for network communication includes network transmission data. The corresponding dynamic risk analysis sub-rules include: network communication security rules and rules for determining communication with malicious IPs (combined with a malicious IP database). The runtime behavior data collected by Hook points for dynamic loading includes runtime loading module data. The corresponding dynamic risk analysis sub-rules include: dynamic loading risk rules and malicious module feature matching rules. The runtime behavior data collected by Hook points for cross-process communication includes interaction data between applications. The corresponding dynamic risk analysis sub-rules include: cross-process communication risk rules and sensitive data leakage rules (determining whether private data is transmitted).

[0058] This embodiment uses Frida script injection to monitor in real time the timing of calls to sensitive APIs such as "TelephonyManager.getDeviceId()" (an API used in the Android system to obtain a unique device identifier), determining whether they comply with privacy compliance requirements (e.g., calls made after user authorization). It also performs dynamic code loading analysis: detecting malicious modules loaded at runtime via reflection or DexClassLoader (class loader) (malicious module signature matching rules), compensating for the blind spots of static analysis.

[0059] In this embodiment, the dynamic risk analysis results include: dynamic behavior logs, calls to sensitive APIs, captured network traffic, screenshots, and vulnerability reports.

[0060] S160. Based on the preset malware feature library and the decompiled file, feature matching is performed to obtain malware analysis results.

[0061] In this embodiment, the malware signature database contains multiple malicious features, such as malware signature matching features, blacklist matching features, and novel threat intelligence features. Among them: Malware signature matching features: Known malware signatures collected by platforms such as VirusTotal (an online security detection service), and YARA (an open-source pattern matching tool) rule matching results, such as application core code snippets matching the signature of a banking Trojan. Blacklist matching characteristics: such as application package name, developer information, server IP / domain name being included in the malicious blacklist by security vendors; New threat intelligence: characteristics of recently emerging malware variants (such as the dynamic behavior patterns of new ransomware families), and signature markers of malicious SDKs in supply chain attacks, adapting to the patent requirement of "responding to new attack patterns".

[0062] In this embodiment, the malware analysis results include the matched malicious features and the threat level of the corresponding malicious features.

[0063] S170. Generate the security detection result of the target mobile application based on the static risk analysis result, the dynamic risk analysis result, and the malware analysis result.

[0064] In this embodiment, the security detection results of the target mobile application are generated by combining the static risk analysis results, dynamic risk analysis results, and malware analysis results.

[0065] In some embodiments, please refer to Figure 5 Step S170 includes: S1701. Obtain the weights corresponding to the static risk analysis results, the dynamic risk analysis results, and the malware analysis results respectively through a weighted voting mechanism.

[0066] S1702. Generate the security detection result of the target mobile application based on the static risk analysis result, the dynamic risk analysis result, the malware analysis result, and the corresponding weights.

[0067] In this embodiment, the method provided can be applied to a variety of different detection scenarios, including pre-launch product detection, enterprise internal application security management, malware detection, and security self-testing and vulnerability patching during the development phase.

[0068] Different weight configuration rules can be pre-configured for different detection scenarios. Then, the target weight configuration rules are determined based on the current detection scenario of the target mobile application. Based on the weight configuration rules, the weights corresponding to static risk analysis results, dynamic risk analysis results, and malware analysis results are determined respectively.

[0069] Furthermore, a static risk analysis model, a dynamic risk analysis model, and a malware analysis model are provided. Step S1702 includes: extracting static risk features from the static risk analysis results, extracting dynamic risk features from the dynamic risk analysis model, and extracting malware analysis features from the malware analysis results; then inputting the static risk features into the static risk analysis model to obtain a static risk score, inputting the dynamic risk features into the dynamic risk analysis model to obtain a dynamic risk score, and inputting the malware analysis features into the malware analysis model to obtain a malware risk score; then, based on the static risk score, the dynamic risk score, and the malware risk score, as well as the corresponding weights obtained in step S1702, calculating the target risk score of the target software, and determining the security detection result based on the target risk score.

[0070] Different risk ranges can be set for different risk scores, and the risk range corresponding to the target risk score is determined as the safety detection result.

[0071] In this embodiment, after obtaining the security detection results, a visual security report is further generated by combining the static risk analysis results, dynamic risk analysis results, and malware analysis results. The vulnerability details can be accessed through this visual security report.

[0072] Specifically, a template engine is used: Jinja2 (a modern Python-based template engine) generates visual security reports in HTML / PDF format using Django (an open-source web framework based on Python) templates. The severity of vulnerabilities is then assessed based on the Common Vulnerability Scoring System (CVSS), classifying them as high / medium / low risk.

[0073] Furthermore, the method provided in this embodiment utilizes Kotlin (a statically typed programming language) coroutines to implement asynchronous non-blocking scheduling of the detection task, supporting high-concurrency testing (such as scanning 10 APKs simultaneously). In this case, before obtaining the installation package file of the target mobile application, the method further includes: Obtain installation package files corresponding to multiple mobile applications, and construct coroutines corresponding to each of the installation package files, wherein the target mobile application is included among the multiple mobile applications; determine the priority of each mobile application according to a preset priority rule; allocate runtime resources to the corresponding coroutines according to the priority. The preset priority rules include different priorities for different detection scenarios. In this embodiment, the detection scenarios of each mobile application are obtained, and then the priority of each mobile application is determined based on the detection scenarios of each mobile application. Finally, the corresponding running resources are allocated to different coroutines based on each priority, with higher priority receiving more resources than lower priority.

[0074] At this point, obtaining the installation package file of the target mobile application includes: obtaining the installation package file of the target mobile application through the coroutine corresponding to the target mobile application.

[0075] This embodiment provides a coroutine task queue, a priority determination unit, and a resource allocator; wherein the task queue dynamically adjusts the coroutine execution order according to the detection type, thereby improving resource utilization.

[0076] In summary, this embodiment obtains the installation package file of the target mobile application and decompiles the installation package file to obtain a decompiled file; performs static risk detection on the decompiled file according to preset static risk analysis rules to obtain static risk analysis results; configures dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results; runs the target mobile application and obtains the target mobile application's runtime behavior data through the Hook points; performs dynamic risk detection on the runtime behavior data according to preset dynamic risk analysis rules to obtain dynamic risk analysis results; performs feature matching based on a preset malware signature library and the decompiled file to obtain malware analysis results; and generates a security detection result for the target mobile application based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results. On the one hand, the embodiments of this application combine static risk analysis, dynamic risk analysis, and malware analysis to perform security testing on the target mobile application, which can cross-verify vulnerabilities and achieve high security testing accuracy. On the other hand, this application instructs the target mobile application to configure dynamic instrumentation Hook points through the results of static risk analysis, eliminating the need to configure Hook points for every monitoring point of the target mobile application, enabling accurate dynamic detection of data, and reducing dynamic monitoring resources.

[0077] Figure 6 This is a schematic block diagram of a security detection device for a mobile application provided in an embodiment of this application. Figure 6 As shown, corresponding to the above-described mobile application security detection method, this application also provides a mobile application security detection device 600. This mobile application security detection device 600 includes a unit for executing the above-described mobile application security detection method, and can be configured in a terminal or server. Specifically, please refer to... Figure 6The security detection device 600 for the mobile application includes a static analysis unit 601, a dynamic analysis unit 602, a malware analysis unit 603, and a result generation unit 604, wherein: The static analysis unit 601 is used to obtain the installation package file of the target mobile application, and to decompile the installation package file to obtain the decompiled file of the installation package file; and to perform static risk detection on the decompiled file according to the preset static risk analysis rules to obtain the static risk analysis result. The dynamic analysis unit 602 is used to configure Hook points for dynamic instrumentation of the target mobile application based on the static risk analysis results; run the target mobile application and obtain the running behavior data of the target mobile application through the Hook points; and perform dynamic risk detection on the running behavior data according to preset dynamic risk analysis rules to obtain dynamic risk analysis results. The malware analysis unit 603 is used to perform feature matching based on a preset malware feature library and the decompiled file to obtain malware analysis results; The result generation unit 604 is used to generate the security detection result of the target mobile application based on the static risk analysis result, the dynamic risk analysis result, and the malware analysis result.

[0078] In some embodiments, when the static analysis unit 601 performs the step of performing static risk detection on the decompiled file according to preset static risk analysis rules and obtaining static risk analysis results, it is specifically used for: An abstract syntax tree (AST) of the decompiled file is generated. The AST is then traversed to determine whether it contains a pre-defined dangerous call chain, thus obtaining the first risk analysis result. Based on preset regular expression matching rules, the decompiled file is hard-coded and sensitive path identification is performed to obtain the second risk analysis result; The description file of the target mobile application is parsed, and dangerous permission combinations and / or excessive permission identification processing are performed on the target mobile application to obtain the third risk analysis result; The static risk analysis result is determined based on the first risk analysis result, the second risk analysis result, and the third risk analysis result.

[0079] In some embodiments, when the dynamic analysis unit 602 performs the step of obtaining the runtime behavior data of the target mobile application through the Hook point, it is specifically used for: The monitoring scripts corresponding to each Hook are dynamically configured according to the runtime context of the target mobile application. The runtime behavior data of the target mobile application is obtained through the Hook and the corresponding monitoring script.

[0080] In some embodiments, the dynamic risk analysis rules include multiple dynamic risk analysis sub-rules; when the dynamic analysis unit 602 executes the step of performing dynamic risk detection on the operational behavior data according to the preset dynamic risk analysis rules to obtain dynamic risk analysis results, it is specifically used for: Based on the Hook point type corresponding to the Hook point of the operational behavior data and the preset correspondence between the Hook point type and the dynamic risk analysis sub-rules, determine the dynamic risk analysis sub-rules corresponding to each of the operational behavior data. Dynamic risk detection is performed on the corresponding operational behavior data according to the dynamic risk analysis sub-rules to obtain the dynamic risk analysis results.

[0081] In some embodiments, the Hook point types include sensitive API call classes, file operation classes, network communication classes, dynamically loaded classes, and inter-process communication classes.

[0082] In some embodiments, when the result generation unit 604 performs the step of generating the security detection result of the target mobile application based on the static risk analysis result, the dynamic risk analysis result, and the malware analysis result, it is specifically used for: The weights corresponding to the static risk analysis results, the dynamic risk analysis results, and the malware analysis results are obtained through a weighted voting mechanism. The security detection results of the target mobile application are generated based on the static risk analysis results, the dynamic risk analysis results, the malware analysis results, and the corresponding weights.

[0083] In some embodiments, the mobile application security detection device 600 further includes: A resource allocation unit is used to obtain installation package files corresponding to multiple mobile applications, and construct coroutines corresponding to multiple installation package files, wherein the multiple mobile applications include the target mobile application; determine the priority of each mobile application according to a preset priority rule; and allocate running resources to the corresponding coroutines according to the priority. At this point, obtaining the installation package file of the target mobile application includes: The installation package file of the target mobile application is obtained through the coroutine corresponding to the target mobile application.

[0084] In summary, on the one hand, the embodiments of this application combine static risk analysis, dynamic risk analysis, and malware analysis to perform security testing on the target mobile application, which can cross-verify vulnerabilities and achieve high security testing accuracy; on the other hand, this application instructs the target mobile application to configure dynamic instrumentation Hook points through the results of static risk analysis, eliminating the need to configure Hook points for every monitoring point of the target mobile application, enabling accurate dynamic detection of data, and reducing dynamic monitoring resources.

[0085] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned mobile application security detection device and each unit can be referred to the corresponding description in the foregoing method embodiments. For the sake of convenience and brevity, it will not be repeated here.

[0086] The aforementioned mobile application security detection device can be implemented as a computer program, which can, for example... Figure 7 It runs on the computer device shown.

[0087] Please see Figure 7 , Figure 7 This is a schematic block diagram of a computer device 700 provided in an embodiment of this application. The computer device 700 can be a terminal or a server. The terminal can be an electronic device with communication functions, such as a smartphone, tablet, laptop, desktop computer, personal digital assistant, or wearable device. The server can be a standalone server or a server cluster composed of multiple servers.

[0088] See Figure 7 The computer device 700 includes a processor 702, a memory, and a network interface 705 connected via a system bus 701. The memory may include a non-volatile storage medium 703 and internal memory 704.

[0089] The non-volatile storage medium 703 may store an operating system 7031 and a computer program 7032. The computer program 7032 includes program instructions that, when executed, cause the processor 702 to perform a security detection method for a mobile application.

[0090] The processor 702 provides computing and control capabilities to support the operation of the entire computer device 700.

[0091] The internal memory 704 provides an environment for the execution of the computer program 7032 in the non-volatile storage medium 703. When the computer program 7032 is executed by the processor 702, the processor 702 can execute a security detection method for a mobile application.

[0092] This network interface 705 is used for network communication with other devices. Those skilled in the art will understand that... Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 700 to which the present application is applied. The specific computer device 700 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0093] The processor 702 is used to run a computer program 7032 stored in the memory to perform the following steps: Obtain the installation package file of the target mobile application, and decompile the installation package file to obtain the decompiled file of the installation package file; The decompiled file is subjected to static risk detection according to the preset static risk analysis rules, and the static risk analysis results are obtained. Configure dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results; Run the target mobile application and obtain the running behavior data of the target mobile application through the Hook point; The operational behavior data is dynamically risk detected according to preset dynamic risk analysis rules to obtain dynamic risk analysis results; Based on a preset malware signature database and the decompiled file, feature matching is performed to obtain malware analysis results; The security detection results of the target mobile application are generated based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results.

[0094] It should be understood that in the embodiments of this application, the processor 702 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0095] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program includes program instructions and can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0096] Therefore, this application also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When executed by a processor, the program instructions cause the processor to perform the following steps: Obtain the installation package file of the target mobile application, and decompile the installation package file to obtain the decompiled file of the installation package file; The decompiled file is subjected to static risk detection according to the preset static risk analysis rules, and the static risk analysis results are obtained. Configure dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results; Run the target mobile application and obtain the running behavior data of the target mobile application through the Hook point; The operational behavior data is dynamically risk detected according to preset dynamic risk analysis rules to obtain dynamic risk analysis results; Based on a preset malware signature database and the decompiled file, feature matching is performed to obtain malware analysis results; The security detection results of the target mobile application are generated based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results.

[0097] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0098] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0099] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0100] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0101] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0102] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for security detection of mobile applications, characterized in that, The method comprises the following steps: obtaining an installation package file of a target mobile application, and performing decompilation processing on the installation package file to obtain a decompiled file of the installation package file; performing static risk detection on the decompiled file according to a preset static risk analysis rule to obtain a static risk analysis result; configuring a dynamic plug-in Hook point for the target mobile application according to the static risk analysis result; running the target mobile application and obtaining running behavior data of the target mobile application through the Hook point; performing dynamic risk detection on the running behavior data according to a preset dynamic risk analysis rule to obtain a dynamic risk analysis result; performing feature matching according to a preset malicious software feature library and the decompiled file to obtain a malicious software analysis result; generating a security detection result of the target mobile application according to the static risk analysis result, the dynamic risk analysis result and the malicious software analysis result.

2. The method of claim 1, wherein, The static risk detection on the decompiled file according to the preset static risk analysis rule to obtain the static risk analysis result comprises the following steps: generating an abstract syntax tree of the decompiled file, determining whether a preset dangerous call chain is contained in the abstract syntax tree by traversing the abstract syntax tree, and obtaining a first risk analysis result; performing hard coding and sensitive path identification processing on the decompiled file according to a preset regular matching rule to obtain a second risk analysis result; parsing a description file of the target mobile application, and performing dangerous permission combination and / or excessive permission identification processing on the target mobile application to obtain a third risk analysis result; determining the static risk analysis result according to the first risk analysis result, the second risk analysis result and the third risk analysis result.

3. The method of claim 1, wherein, The obtaining of the running behavior data of the target mobile application through the Hook point comprises the following steps: dynamically configuring a monitoring script corresponding to each Hook according to a context of the target mobile application during running; obtaining the running behavior data of the target mobile application through the Hook and the corresponding monitoring script.

4. The method of claim 1, wherein, The dynamic risk analysis rule comprises a plurality of dynamic risk analysis sub-rules; the dynamic risk detection on the running behavior data according to the preset dynamic risk analysis rule to obtain the dynamic risk analysis result comprises the following steps: determining a dynamic risk analysis sub-rule corresponding to each running behavior data according to a Hook point type of the corresponding Hook point of the running behavior data and a preset correspondence between Hook point types and dynamic risk analysis sub-rules; performing dynamic risk detection on the corresponding running behavior data according to the dynamic risk analysis sub-rule to obtain the dynamic risk analysis result.

5. The method of claim 4, wherein, The Hook point type comprises a sensitive API call type, a file operation type, a network communication type, a dynamic loading type and a cross-process communication type.

6. The method of claim 1, wherein, The generation of the security detection result of the target mobile application according to the static risk analysis result, the dynamic risk analysis result and the malicious software analysis result comprises the following steps: The static risk analysis result, the dynamic risk analysis result, and the malware analysis result correspond to respective weights obtained through a weighted voting mechanism; A security detection result of the target mobile application is generated according to the static risk analysis result, the dynamic risk analysis result, the malware analysis result, and the respective weights.

7. The method of claim 1, wherein, Before the installation package file of the target mobile application is obtained, the method further includes: Obtaining installation package files respectively corresponding to a plurality of mobile applications, and constructing a plurality of coroutines respectively corresponding to the installation package files, wherein the plurality of mobile applications include the target mobile application; Determining a priority respectively corresponding to each mobile application according to a preset priority rule; Allocating a running resource to the corresponding coroutine according to the priority; The installation package file of the target mobile application is obtained by the following steps: The installation package file of the target mobile application is obtained by the target mobile application corresponding to the coroutine.

8. A security detection apparatus of a mobile application, characterized by, The method includes the following steps: A static analysis unit is configured to obtain an installation package file of a target mobile application, and to perform a decompilation process on the installation package file to obtain a decompiled file of the installation package file; A static risk detection is performed on the decompiled file according to a preset static risk analysis rule to obtain a static risk analysis result; A dynamic analysis unit is configured to configure a Hook point of dynamic insertion according to the static risk analysis result, to run the target mobile application, and to obtain running behavior data of the target mobile application through the Hook point; A dynamic risk detection is performed on the running behavior data according to a preset dynamic risk analysis rule to obtain a dynamic risk analysis result; A malware analysis unit is configured to perform feature matching according to a preset malware feature library and the decompiled file to obtain a malware analysis result; A result generation unit is configured to generate a security detection result of the target mobile application according to the static risk analysis result, the dynamic risk analysis result, and the malware analysis result.

9. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the security detection method of the mobile application according to any one of claims 1-7.

10. A storage medium, characterized by The storage medium stores a computer program, and the computer program includes program instructions which, when executed by a processor, cause the processor to execute the security detection method of the mobile application according to any one of claims 1-7.

Images