Mobile application security detection method and device, computer device and storage medium

Abstract

Embodiments of the present application disclose a mobile application security detection method and device, a computer device and a storage medium. The method comprises: obtaining an installation package file of a target mobile application, and obtaining a decompiled file of the installation package file; performing static risk detection on the decompiled file according to a static risk analysis rule to obtain a static risk analysis result; configuring a dynamic plug-in Hook point for the target mobile application according to the static risk analysis result; running the target mobile application, and obtaining running behavior data of the target mobile application through the Hook point; performing dynamic risk detection on the running behavior data according to a dynamic risk analysis rule to obtain a dynamic risk analysis result; performing feature matching on a preset malicious software feature library and the decompiled file to obtain a malicious software analysis result; and generating a security detection result of the target mobile application according to each analysis result. The security detection accuracy of the mobile application can be improved by implementing the method of the embodiments of the present application.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to security detection methods, devices, computer equipment and storage media for mobile applications. Background Technology

[0002] With the rapid development of the mobile internet, the number of mobile applications has exploded. While providing convenient services, these applications also face serious privacy and security risks. Currently, mobile application privacy and security detection technologies are mainly divided into two categories: static detection tools and dynamic detection tools.

[0003] Static analysis tools (such as Fortify and QARK) primarily identify explicit vulnerabilities by analyzing application code and configuration files. However, static analysis tools can only identify permission declarations in AndroidManifest and cannot trace the actual call paths and contexts of sensitive APIs, making it difficult to determine whether permissions have been abused.

[0004] While dynamic detection tools can monitor application runtime behavior, they only record whether APIs are called, lacking accurate timestamps and complete call stacks, making it impossible to determine the compliance of call timing and creating detection blind spots.

[0005] It is evident that existing mobile application privacy and security detection technologies suffer from problems such as difficulty in determining whether permissions have been abused and the existence of detection blind spots, resulting in low security detection accuracy. To ensure the security of mobile applications, there is an urgent need for a method to improve the accuracy of mobile application security detection. Summary of the Invention

[0006] This application provides a method, apparatus, computer equipment, and storage medium for security detection of mobile applications, which can improve the accuracy of security detection of mobile applications.

[0007] In a first aspect, embodiments of this application provide a security detection method for a mobile application, comprising:

[0008] Obtain the installation package file of the target mobile application, and decompile the installation package file to obtain the decompiled file of the installation package file;

[0009] The decompiled file is subjected to static risk detection according to the preset static risk analysis rules, and the static risk analysis results are obtained.

[0010] Configure dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results;

[0011] Run the target mobile application and obtain the running behavior data of the target mobile application through the Hook point;

[0012] The operational behavior data is dynamically risk detected according to preset dynamic risk analysis rules to obtain dynamic risk analysis results;

[0013] Based on a preset malware signature database and the decompiled file, feature matching is performed to obtain malware analysis results;

[0014] The security detection results of the target mobile application are generated based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results.

[0015] Secondly, embodiments of this application also provide a security detection device for mobile applications, comprising:

[0016] The static analysis unit is used to obtain the installation package file of the target mobile application, and to decompile the installation package file to obtain the decompiled file of the installation package file; and to perform static risk detection on the decompiled file according to preset static risk analysis rules to obtain static risk analysis results.

[0017] The dynamic analysis unit is used to configure Hook points for dynamic instrumentation of the target mobile application based on the static risk analysis results; run the target mobile application and obtain the running behavior data of the target mobile application through the Hook points; and perform dynamic risk detection on the running behavior data according to preset dynamic risk analysis rules to obtain dynamic risk analysis results.

[0018] The malware analysis unit is used to perform feature matching based on a preset malware feature library and the decompiled file to obtain malware analysis results;

[0019] The result generation unit is used to generate security detection results for the target mobile application based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results.

[0020] Thirdly, embodiments of this application also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0021] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a processor, can implement the above-described method.

[0022] This application provides a method, apparatus, computer device, and storage medium for security detection of mobile applications. The method includes: obtaining an installation package file of a target mobile application and decompiling the installation package file to obtain a decompiled file; performing static risk detection on the decompiled file according to preset static risk analysis rules to obtain static risk analysis results; configuring dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results; running the target mobile application and obtaining runtime behavior data of the target mobile application through the Hook points; performing dynamic risk detection on the runtime behavior data according to preset dynamic risk analysis rules to obtain dynamic risk analysis results; performing feature matching based on a preset malware signature library and the decompiled file to obtain malware analysis results; and generating a security detection result for the target mobile application based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results. On the one hand, the embodiments of this application combine static risk analysis, dynamic risk analysis, and malware analysis to perform security testing on the target mobile application, which can cross-verify vulnerabilities and achieve high security testing accuracy. On the other hand, this application instructs the target mobile application to configure dynamic instrumentation Hook points through the results of static risk analysis, eliminating the need to configure Hook points for every monitoring point of the target mobile application, enabling accurate dynamic detection of data, and reducing dynamic monitoring resources. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A flowchart illustrating the security detection method for mobile applications provided in this application embodiment;

[0025] Figure 2 A schematic diagram of a sub-process of the security detection method for mobile applications provided in an embodiment of this application;

[0026] Figure 3 This is another schematic diagram of a sub-process of the security detection method for mobile applications provided in the embodiments of this application;

[0027] Figure 4 This is another schematic diagram of a sub-process of the security detection method for mobile applications provided in the embodiments of this application;

[0028] Figure 5 This is another schematic diagram of a sub-process of the security detection method for mobile applications provided in the embodiments of this application;

[0029] Figure 6 A schematic block diagram of a security detection device for mobile applications provided in an embodiment of this application;

[0030] Figure 7 A schematic block diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0031] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0033] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0034] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0035] This application provides a mobile application security detection method, apparatus, computer equipment, and storage medium, which can solve the problems of insufficient static detection depth, blind spots in dynamic detection, lack of compliance comparison, and low detection efficiency in existing mobile application privacy and security detection technologies. It provides a mobile application privacy and security detection method that features multi-module collaboration, heterogeneous feature fusion, and compliance verification support, thereby achieving comprehensive, accurate, and efficient detection of mobile application privacy and security risks.

[0036] The execution subject of the mobile application security detection method can be the mobile application security detection device provided in the embodiments of this application, or a computer device that integrates the mobile application security detection device. The mobile application security detection device can be implemented in hardware or software, and the computer device can be a terminal or a server.

[0037] Figure 1 This is a flowchart illustrating the security detection method for mobile applications provided in this application. Figure 1 As shown, the method includes the following steps S110-S170.

[0038] S110. Obtain the installation package file of the target mobile application, and decompile the installation package file to obtain the decompiled file of the installation package file.

[0039] In this embodiment, the target mobile application is the application that needs to be tested for privacy and security. The installation package file can be an APK (Android application package) or an IPA (iOS platform-specific application installation package format) file.

[0040] In this application, the installation package file is decompiled using a pre-defined decompilation tool, such as apktool (a reverse engineering tool for Android APK files) or jadx (an open-source Android Dex / APK decompilation tool).

[0041] The decompiled files include the code, resource files, configuration files, etc., corresponding to the installation package files, which are used for subsequent detection of potential risks.

[0042] S120. Perform static risk detection on the decompiled file according to the preset static risk analysis rules to obtain the static risk analysis results.

[0043] Specifically, in some embodiments, please refer to Figure 2 Step S120 includes:

[0044] S1201. Generate the abstract syntax tree of the decompiled file, and determine whether the abstract syntax tree contains a preset dangerous call chain by traversing the abstract syntax tree to obtain the first risk analysis result.

[0045] In this embodiment, an abstract syntax tree (AST) corresponding to the decompiled file is generated. Then, by traversing the syntax nodes of the AST in a structured manner, the preset dangerous function call relationships and execution links are accurately located, solving the problem that traditional regular expression matching cannot capture code logic relationships.

[0046] S1202. According to the preset regular expression matching rules, the decompiled file is hard-coded and sensitive path identification is performed to obtain the second risk analysis result.

[0047] This embodiment utilizes preset regular expression matching rules to perform text scanning on decompiled readable files (code, configuration files), accurately identifying hard-coded sensitive information and sensitive path access characteristics, complementing AST analysis and covering static risks of "superficial and fixed format".

[0048] Hardcoding includes hard-coded keys / passwords (sensitive information such as keys, passwords, and tokens stored in plaintext in the code according to the corresponding regular expression matching rules), hard-coded server information (unencrypted server IP, domain name, and interface address matched by the corresponding regular expression matching rules), and sensitive paths (sensitive directory access paths hard-coded in the code matched by the corresponding regular expression matching rules).

[0049] S1203. Parse the description file of the target mobile application, perform dangerous permission combination and / or excessive permission identification processing on the target mobile application, and obtain the third risk analysis result.

[0050] In this embodiment, the description file of the target mobile application can be AndroidManifest.xml. The target mobile application can be identified by pre-set dangerous permission combinations and pre-set excessive permissions. That is, it can be identified whether there are pre-set dangerous permission combinations or pre-set excessive permissions in the description file corresponding to the target mobile application.

[0051] Furthermore, different rules for identifying excessive permissions are set for different types of mobile applications, that is, different excessive permissions are preset for different mobile applications.

[0052] For example, for weather apps, permissions such as reading call logs, sending text messages, and installing applications are excessive permissions; for text editing apps, permissions such as precise location tracking and reading text messages are excessive permissions.

[0053] A dangerous permission combination contains at least two permissions. If a mobile application has all the permissions in a dangerous permission combination, then the application is considered to have a dangerous permission combination.

[0054] For example, reading SMS messages and making network requests is a dangerous permission combination; precise location tracking, background location tracking, and network requests are a dangerous permission combination (the background continuously collects and uploads the user's location); reading call logs and sending SMS messages are a dangerous permission combination.

[0055] S1204. Determine the static risk analysis result based on the first risk analysis result, the second risk analysis result, and the third risk analysis result.

[0056] In this embodiment, the risk analysis data contained in the first risk analysis result, the second risk analysis result, and the third risk analysis result are used as static risk analysis results.

[0057] Furthermore, the static risk analysis results include a vulnerability list, risk levels (different vulnerabilities correspond to different risk levels), and recommended remediation solutions.

[0058] S130. Configure dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results.

[0059] In this embodiment, the target mobile application is dynamically instrumented using the vulnerability list in the static risk analysis results. High-risk targets are first accurately screened through static analysis, and then Hook points are configured specifically in the dynamic analysis to avoid inefficiency and performance loss caused by indiscriminate instrumentation.

[0060] For example, static risk analysis results can reveal which sensitive APIs (vulnerability lists) are used in the code (decompiled files), and dynamic risk analysis can use Frida (a lightweight, cross-platform dynamic instrumentation tool) scripts to hook the call information of these sensitive APIs.

[0061] Specifically, dynamic instrumentation includes injecting code via Frida and hooking key functions.

[0062] This embodiment supports custom script extensibility: it allows users to write Frida scripts for specific scenarios (such as encryption algorithm key generation logic, plaintext leakage in network communication), which is far more flexible than the fixed rules of static tools.

[0063] S140. Run the target mobile application and obtain the running behavior data of the target mobile application through the Hook point.

[0064] In this embodiment, the application is run on a simulator or a real device, and its runtime behavior (such as network communication, file operations, and API calls) is monitored in real time.

[0065] In some embodiments, specifically, please refer to Figure 3 The step of obtaining the target mobile application's runtime behavior data through the Hook point includes:

[0066] S1401. Dynamically configure the monitoring scripts corresponding to each Hook according to the runtime context of the target mobile application.

[0067] S1402. Obtain the running behavior data of the target mobile application through the Hook and the corresponding monitoring script.

[0068] In this embodiment, different monitoring scripts are preset for different Hook point types (the Hook point type is determined based on the inserted node type when instrumenting). The monitoring script is used to indicate which data should be intercepted for the corresponding second Hook, thereby achieving accurate data acquisition.

[0069] Specifically, during dynamic analysis in this embodiment, the instrumentation strategy can be dynamically selected based on the application runtime context (such as the current Activity (one of the core components of an Android application, responsible for the visual interface that interacts with the user) and network requests): Frida scripts are automatically injected to intercept keys for Secure Sockets Layer (SSL) communication (network communication class); path sensitivity (such as whether / data / data / is accessed) is monitored in real time for file operations. It can be seen that this embodiment can reduce the performance loss caused by irrelevant instrumentation.

[0070] Specifically, this embodiment achieves traffic interception by integrating Mitmproxy (an open-source interactive HTTPS proxy tool) or Burp Suite (a powerful web application security testing tool) to intercept HTTP / HTTPS traffic, and achieves behavior monitoring by recording file read / write, system calls, Intent broadcasts, etc.

[0071] S150. Perform dynamic risk detection on the operational behavior data according to the preset dynamic risk analysis rules to obtain dynamic risk analysis results.

[0072] In some embodiments, the dynamic risk analysis rule specifically includes multiple dynamic risk analysis sub-rules; please refer to [link to relevant documentation]. Figure 4 Step S150 includes:

[0073] S1501. Based on the Hook point type of the Hook point corresponding to the running behavior data and the preset correspondence between the Hook point type and the dynamic risk analysis sub-rules, determine the dynamic risk analysis sub-rules corresponding to each of the running behavior data.

[0074] S1502. Perform dynamic risk detection on the corresponding operational behavior data according to the dynamic risk analysis sub-rules to obtain the dynamic risk analysis results.

[0075] In this embodiment, different dynamic risk analysis sub-rules are preset for different Hook point types. For each Hook point, after the corresponding operation behavior data is obtained, dynamic risk detection is performed on the operation behavior data through the corresponding dynamic risk analysis sub-rules to obtain the dynamic risk analysis result of the operation behavior data of each Hook point.

[0076] The types of Hook points include sensitive API call classes, file operation classes, network communication classes, dynamically loaded classes, and cross-process communication classes.

[0077] Specifically, the runtime behavior data collected by Hook points for sensitive API calls includes sensitive data such as device ID and location. The corresponding dynamic risk analysis sub-rules include: sensitive API call timing compliance rules, SDK over-declaration call rules, and permission abuse behavior rules. The runtime behavior data collected by Hook points for file operations includes data corresponding to file read and write behaviors. The corresponding dynamic risk analysis sub-rules include: sensitive data storage rules and background silent behavior rules (determining whether background read and write are performed). The runtime behavior data collected by Hook points for network communication includes network transmission data. The corresponding dynamic risk analysis sub-rules include: network communication security rules and rules for determining communication with malicious IPs (combined with a malicious IP database). The runtime behavior data collected by Hook points for dynamic loading includes runtime loading module data. The corresponding dynamic risk analysis sub-rules include: dynamic loading risk rules and malicious module feature matching rules. The runtime behavior data collected by Hook points for cross-process communication includes interaction data between applications. The corresponding dynamic risk analysis sub-rules include: cross-process communication risk rules and sensitive data leakage rules (determining whether private data is transmitted).

[0078] This embodiment uses Frida script injection to monitor in real time the timing of calls to sensitive APIs such as "TelephonyManager.getDeviceId()" (an API used in the Android system to obtain a unique device identifier), determining whether they comply with privacy compliance requirements (e.g., calls made after user authorization). It also performs dynamic code loading analysis: detecting malicious modules loaded at runtime via reflection or DexClassLoader (class loader) (malicious module signature matching rules), compensating for the blind spots of static analysis.

[0079] In this embodiment, the dynamic risk analysis results include: dynamic behavior logs, calls to sensitive APIs, captured network traffic, screenshots, and vulnerability reports.

[0080] S160. Based on the preset malware feature library and the decompiled file, feature matching is performed to obtain malware analysis results.

[0081] In this embodiment, the malware signature database contains multiple malicious features, such as malware signature matching features, blacklist matching features, and novel threat intelligence features. Among them:

[0082] Malware signature matching features: Known malware signatures collected by platforms such as VirusTotal (an online security detection service), and YARA (an open-source pattern matching tool) rule matching results, such as application core code snippets matching the signature of a banking Trojan.

[0083] Blacklist matching characteristics: such as application package name, developer information, server IP / domain name being included in the malicious blacklist by security vendors;

[0084] New threat intelligence: characteristics of recently emerging malware variants (such as the dynamic behavior patterns of new ransomware families), and signature markers of malicious SDKs in supply chain attacks, adapting to the patent requirement of "responding to new attack patterns".

[0085] In this embodiment, the malware analysis results include the matched malicious features and the threat level of the corresponding malicious features.

[0086] S170. Generate the security detection result of the target mobile application based on the static risk analysis result, the dynamic risk analysis result, and the malware analysis result.

[0087] In this embodiment, the security detection results of the target mobile application are generated by combining the static risk analysis results, dynamic risk analysis results, and malware analysis results.

[0088] In some embodiments, please refer to Figure 5 Step S170 includes:

[0089] S1701. Obtain the weights corresponding to the static risk analysis results, the dynamic risk analysis results, and the malware analysis results respectively through a weighted voting mechanism.

[0090] S1702. Generate the security detection result of the target mobile application based on the static risk analysis result, the dynamic risk analysis result, the malware analysis result, and the corresponding weights.

[0091] In this embodiment, the method provided can be applied to a variety of different detection scenarios, including pre-launch product detection, enterprise internal application security management, malware detection, and security self-testing and vulnerability patching during the development phase.

[0092] Different weight configuration rules can be pre-configured for different detection scenarios. Then, the target weight configuration rules are determined based on the current detection scenario of the target mobile application. Based on the weight configuration rules, the weights corresponding to static risk analysis results, dynamic risk analysis results, and malware analysis results are determined respectively.

[0093] Furthermore, a static risk analysis model, a dynamic risk analysis model, and a malware analysis model are provided. Step S1702 includes: extracting static risk features from the static risk analysis results, extracting dynamic risk features from the dynamic risk analysis model, and extracting malware analysis features from the malware analysis results; then inputting the static risk features into the static risk analysis model to obtain a static risk score, inputting the dynamic risk features into the dynamic risk analysis model to obtain a dynamic risk score, and inputting the malware analysis features into the malware analysis model to obtain a malware risk score; then, based on the static risk score, the dynamic risk score, and the malware risk score, as well as the corresponding weights obtained in step S1702, calculating the target risk score of the target software, and determining the security detection result based on the target risk score.

[0094] Different risk ranges can be set for different risk scores, and the risk range corresponding to the target risk score is determined as the safety detection result.

[0095] In this embodiment, after obtaining the security detection results, a visual security report is further generated by combining the static risk analysis results, dynamic risk analysis results, and malware analysis results. The vulnerability details can be accessed through this visual security report.

[0096] Specifically, a template engine is used: Jinja2 (a modern Python-based template engine) generates visual security reports in HTML / PDF format using Django (an open-source web framework based on Python) templates. The severity of vulnerabilities is then assessed based on the Common Vulnerability Scoring System (CVSS), classifying them as high / medium / low risk.

[0097] Furthermore, the method provided in this embodiment utilizes Kotlin (a statically typed programming language) coroutines to implement asynchronous non-blocking scheduling of the detection task, supporting high-concurrency testing (such as scanning 10 APKs simultaneously). In this case, before obtaining the installation package file of the target mobile application, the method further includes:

[0098] Obtain installation package files corresponding to multiple mobile applications, and construct coroutines corresponding to each of the installation package files, wherein the target mobile application is included among the multiple mobile applications; determine the priority of each mobile application according to a preset priority rule; allocate runtime resources to the corresponding coroutines according to the priority.

[0099] The preset priority rules include different priorities for different detection scenarios. In this embodiment, the detection scenarios of each mobile application are obtained, and then the priority of each mobile application is determined based on the detection scenarios of each mobile application. Finally, the corresponding running resources are allocated to different coroutines based on each priority, with higher priority receiving more resources than lower priority.

[0100] At this point, obtaining the installation package file of the target mobile application includes: obtaining the installation package file of the target mobile application through the coroutine corresponding to the target mobile application.

[0101] This embodiment provides a coroutine task queue, a priority determination unit, and a resource allocator; wherein the task queue dynamically adjusts the coroutine execution order according to the detection type, thereby improving resource utilization.

[0102] In summary, this embodiment obtains the installation package file of the target mobile application and decompiles the installation package file to obtain a decompiled file; performs static risk detection on the decompiled file according to preset static risk analysis rules to obtain static risk analysis results; configures dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results; runs the target mobile application and obtains the target mobile application's runtime behavior data through the Hook points; performs dynamic risk detection on the runtime behavior data according to preset dynamic risk analysis rules to obtain dynamic risk analysis results; performs feature matching based on a preset malware signature library and the decompiled file to obtain malware analysis results; and generates a security detection result for the target mobile application based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results. On the one hand, the embodiments of this application combine static risk analysis, dynamic risk analysis, and malware analysis to perform security testing on the target mobile application, which can cross-verify vulnerabilities and achieve high security testing accuracy. On the other hand, this application instructs the target mobile application to configure dynamic instrumentation Hook points through the results of static risk analysis, eliminating the need to configure Hook points for every monitoring point of the target mobile application, enabling accurate dynamic detection of data, and reducing dynamic monitoring resources.

[0103] Figure 6 This is a schematic block diagram of a security detection device for a mobile application provided in an embodiment of this application. Figure 6 As shown, corresponding to the above-described mobile application security detection method, this application also provides a mobile application security detection device 600. This mobile application security detection device 600 includes a unit for executing the above-described mobile application security detection method, and can be configured in a terminal or server. Specifically, please refer to... Figure 6The security detection device 600 for the mobile application includes a static analysis unit 601, a dynamic analysis unit 602, a malware analysis unit 603, and a result generation unit 604, wherein:

[0104] The static analysis unit 601 is used to obtain the installation package file of the target mobile application, and to decompile the installation package file to obtain the decompiled file of the installation package file; and to perform static risk detection on the decompiled file according to the preset static risk analysis rules to obtain the static risk analysis result.

[0105] The dynamic analysis unit 602 is used to configure Hook points for dynamic instrumentation of the target mobile application based on the static risk analysis results; run the target mobile application and obtain the running behavior data of the target mobile application through the Hook points; and perform dynamic risk detection on the running behavior data according to preset dynamic risk analysis rules to obtain dynamic risk analysis results.

[0106] The malware analysis unit 603 is used to perform feature matching based on a preset malware feature library and the decompiled file to obtain malware analysis results;

[0107] The result generation unit 604 is used to generate the security detection result of the target mobile application based on the static risk analysis result, the dynamic risk analysis result, and the malware analysis result.

[0108] In some embodiments, when the static analysis unit 601 performs the step of performing static risk detection on the decompiled file according to preset static risk analysis rules and obtaining static risk analysis results, it is specifically used for:

[0109] An abstract syntax tree (AST) of the decompiled file is generated. The AST is then traversed to determine whether it contains a pre-defined dangerous call chain, thus obtaining the first risk analysis result.

[0110] Based on preset regular expression matching rules, the decompiled file is hard-coded and sensitive path identification is performed to obtain the second risk analysis result;

[0111] The description file of the target mobile application is parsed, and dangerous permission combinations and / or excessive permission identification processing are performed on the target mobile application to obtain the third risk analysis result;

[0112] The static risk analysis result is determined based on the first risk analysis result, the second risk analysis result, and the third risk analysis result.

[0113] In some embodiments, when the dynamic analysis unit 602 performs the step of obtaining the runtime behavior data of the target mobile application through the Hook point, it is specifically used for:

[0114] The monitoring scripts corresponding to each Hook are dynamically configured according to the runtime context of the target mobile application.

[0115] The runtime behavior data of the target mobile application is obtained through the Hook and the corresponding monitoring script.

[0116] In some embodiments, the dynamic risk analysis rules include multiple dynamic risk analysis sub-rules; when the dynamic analysis unit 602 executes the step of performing dynamic risk detection on the operational behavior data according to the preset dynamic risk analysis rules to obtain dynamic risk analysis results, it is specifically used for:

[0117] Based on the Hook point type corresponding to the Hook point of the operational behavior data and the preset correspondence between the Hook point type and the dynamic risk analysis sub-rules, determine the dynamic risk analysis sub-rules corresponding to each of the operational behavior data.

[0118] Dynamic risk detection is performed on the corresponding operational behavior data according to the dynamic risk analysis sub-rules to obtain the dynamic risk analysis results.

[0119] In some embodiments, the Hook point types include sensitive API call classes, file operation classes, network communication classes, dynamically loaded classes, and inter-process communication classes.

[0120] In some embodiments, when the result generation unit 604 performs the step of generating the security detection result of the target mobile application based on the static risk analysis result, the dynamic risk analysis result, and the malware analysis result, it is specifically used for:

[0121] The weights corresponding to the static risk analysis results, the dynamic risk analysis results, and the malware analysis results are obtained through a weighted voting mechanism.

[0122] The security detection results of the target mobile application are generated based on the static risk analysis results, the dynamic risk analysis results, the malware analysis results, and the corresponding weights.

[0123] In some embodiments, the mobile application security detection device 600 further includes:

[0124] A resource allocation unit is used to obtain installation package files corresponding to multiple mobile applications, and construct coroutines corresponding to multiple installation package files, wherein the multiple mobile applications include the target mobile application; determine the priority of each mobile application according to a preset priority rule; and allocate running resources to the corresponding coroutines according to the priority.

[0125] At this point, obtaining the installation package file of the target mobile application includes:

[0126] The installation package file of the target mobile application is obtained through the coroutine corresponding to the target mobile application.

[0127] In summary, on the one hand, the embodiments of this application combine static risk analysis, dynamic risk analysis, and malware analysis to perform security testing on the target mobile application, which can cross-verify vulnerabilities and achieve high security testing accuracy; on the other hand, this application instructs the target mobile application to configure dynamic instrumentation Hook points through the results of static risk analysis, eliminating the need to configure Hook points for every monitoring point of the target mobile application, enabling accurate dynamic detection of data, and reducing dynamic monitoring resources.

[0128] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned mobile application security detection device and each unit can be referred to the corresponding description in the foregoing method embodiments. For the sake of convenience and brevity, it will not be repeated here.

[0129] The aforementioned mobile application security detection device can be implemented as a computer program, which can, for example... Figure 7 It runs on the computer device shown.

[0130] Please see Figure 7 , Figure 7 This is a schematic block diagram of a computer device 700 provided in an embodiment of this application. The computer device 700 can be a terminal or a server. The terminal can be an electronic device with communication functions, such as a smartphone, tablet, laptop, desktop computer, personal digital assistant, or wearable device. The server can be a standalone server or a server cluster composed of multiple servers.

[0131] See Figure 7 The computer device 700 includes a processor 702, a memory, and a network interface 705 connected via a system bus 701. The memory may include a non-volatile storage medium 703 and internal memory 704.

[0132] The non-volatile storage medium 703 may store an operating system 7031 and a computer program 7032. The computer program 7032 includes program instructions that, when executed, cause the processor 702 to perform a security detection method for a mobile application.

[0133] The processor 702 provides computing and control capabilities to support the operation of the entire computer device 700.

[0134] The internal memory 704 provides an environment for the execution of the computer program 7032 in the non-volatile storage medium 703. When the computer program 7032 is executed by the processor 702, the processor 702 can execute a security detection method for a mobile application.

[0135] This network interface 705 is used for network communication with other devices. Those skilled in the art will understand that... Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 700 to which the present application is applied. The specific computer device 700 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0136] The processor 702 is used to run a computer program 7032 stored in the memory to perform the following steps:

[0137] Obtain the installation package file of the target mobile application, and decompile the installation package file to obtain the decompiled file of the installation package file;

[0138] The decompiled file is subjected to static risk detection according to the preset static risk analysis rules, and the static risk analysis results are obtained.

[0139] Configure dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results;

[0140] Run the target mobile application and obtain the running behavior data of the target mobile application through the Hook point;

[0141] The operational behavior data is dynamically risk detected according to preset dynamic risk analysis rules to obtain dynamic risk analysis results;

[0142] Based on a preset malware signature database and the decompiled file, feature matching is performed to obtain malware analysis results;

[0143] The security detection results of the target mobile application are generated based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results.

[0144] It should be understood that in the embodiments of this application, the processor 702 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0145] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program includes program instructions and can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0146] Therefore, this application also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When executed by a processor, the program instructions cause the processor to perform the following steps:

[0147] Obtain the installation package file of the target mobile application, and decompile the installation package file to obtain the decompiled file of the installation package file;

[0148] The decompiled file is subjected to static risk detection according to the preset static risk analysis rules, and the static risk analysis results are obtained.

[0149] Configure dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results;

[0150] Run the target mobile application and obtain the running behavior data of the target mobile application through the Hook point;

[0151] The operational behavior data is dynamically risk detected according to preset dynamic risk analysis rules to obtain dynamic risk analysis results;

[0152] Based on a preset malware signature database and the decompiled file, feature matching is performed to obtain malware analysis results;

[0153] The security detection results of the target mobile application are generated based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results.

[0154] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0155] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0156] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0157] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0158] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0159] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A security detection method for mobile applications, characterized in that, include: Obtain the installation package file of the target mobile application, and decompile the installation package file to obtain the decompiled file of the installation package file; The decompiled file is subjected to static risk detection according to the preset static risk analysis rules, and the static risk analysis results are obtained. Configure dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results; Run the target mobile application and obtain the running behavior data of the target mobile application through the Hook point; The operational behavior data is dynamically risk detected according to preset dynamic risk analysis rules to obtain dynamic risk analysis results; Based on a preset malware signature database and the decompiled file, feature matching is performed to obtain malware analysis results; The security detection results of the target mobile application are generated based on the static risk analysis results, the dynamic risk analysis results, and the malware analysis results. The step of performing static risk detection on the decompiled file according to preset static risk analysis rules to obtain static risk analysis results includes: An abstract syntax tree (AST) of the decompiled file is generated. The AST is then traversed to determine whether it contains a pre-defined dangerous call chain, thus obtaining the first risk analysis result. Based on preset regular expression matching rules, the decompiled file is hard-coded and sensitive path identification is performed to obtain the second risk analysis result; The description file of the target mobile application is parsed, and dangerous permission combinations and / or excessive permission identification processing are performed on the target mobile application to obtain the third risk analysis result; The static risk analysis result is determined based on the first risk analysis result, the second risk analysis result, and the third risk analysis result. The dynamic risk analysis rules include multiple dynamic risk analysis sub-rules; the step of performing dynamic risk detection on the operational behavior data according to the preset dynamic risk analysis rules to obtain dynamic risk analysis results includes: Based on the Hook point type corresponding to the Hook point of the operational behavior data and the preset correspondence between the Hook point type and the dynamic risk analysis sub-rules, determine the dynamic risk analysis sub-rules corresponding to each of the operational behavior data. Dynamic risk detection is performed on the corresponding operational behavior data according to the dynamic risk analysis sub-rules to obtain the dynamic risk analysis results.

2. The method according to claim 1, characterized in that, The step of obtaining the target mobile application's runtime behavior data through the Hook point includes: The monitoring scripts corresponding to each Hook are dynamically configured according to the runtime context of the target mobile application. The runtime behavior data of the target mobile application is obtained through the Hook and the corresponding monitoring script.

3. The method according to claim 1, characterized in that, The types of Hook points include sensitive API call classes, file operation classes, network communication classes, dynamically loaded classes, and cross-process communication classes.

4. The method according to claim 1, characterized in that, The step of generating a security detection result for the target mobile application based on the static risk analysis result, the dynamic risk analysis result, and the malware analysis result includes: The weights corresponding to the static risk analysis results, the dynamic risk analysis results, and the malware analysis results are obtained through a weighted voting mechanism. The security detection results of the target mobile application are generated based on the static risk analysis results, the dynamic risk analysis results, the malware analysis results, and the corresponding weights.

5. The method according to claim 1, characterized in that, Before obtaining the installation package file of the target mobile application, the method further includes: Obtain the installation package files corresponding to multiple mobile applications, and construct the coroutines corresponding to the multiple installation package files, wherein the target mobile application is included among the multiple mobile applications; The priority of each mobile application is determined according to preset priority rules. Allocate runtime resources to the corresponding coroutines according to the priority; The process of obtaining the installation package file of the target mobile application includes: The installation package file of the target mobile application is obtained through the coroutine corresponding to the target mobile application.

6. A security detection device for mobile applications, characterized in that, include: The static analysis unit is used to obtain the installation package file of the target mobile application and decompile the installation package file to obtain the decompiled file of the installation package file. The decompiled file is subjected to static risk detection according to the preset static risk analysis rules, and the static risk analysis results are obtained. The dynamic analysis unit is used to configure dynamic instrumentation Hook points for the target mobile application based on the static risk analysis results; run the target mobile application; and obtain the running behavior data of the target mobile application through the Hook points. The operational behavior data is dynamically risk detected according to preset dynamic risk analysis rules to obtain dynamic risk analysis results; The malware analysis unit is used to perform feature matching based on a preset malware feature library and the decompiled file to obtain malware analysis results; The result generation unit is used to generate a security detection result of the target mobile application based on the static risk analysis result, the dynamic risk analysis result, and the malware analysis result. When the static analysis unit performs the step of performing static risk detection on the decompiled file according to preset static risk analysis rules and obtaining static risk analysis results, it is specifically used for: An abstract syntax tree (AST) of the decompiled file is generated. The AST is then traversed to determine whether it contains a pre-defined dangerous call chain, thus obtaining the first risk analysis result. Based on preset regular expression matching rules, the decompiled file is hard-coded and sensitive path identification is performed to obtain the second risk analysis result; The description file of the target mobile application is parsed, and dangerous permission combinations and / or excessive permission identification processing are performed on the target mobile application to obtain the third risk analysis result; The static risk analysis result is determined based on the first risk analysis result, the second risk analysis result, and the third risk analysis result. The dynamic risk analysis rules include multiple dynamic risk analysis sub-rules; when the dynamic analysis unit executes the step of performing dynamic risk detection on the operational behavior data according to the preset dynamic risk analysis rules to obtain dynamic risk analysis results, it is specifically used for: Based on the Hook point type corresponding to the Hook point of the operational behavior data and the preset correspondence between the Hook point type and the dynamic risk analysis sub-rules, determine the dynamic risk analysis sub-rules corresponding to each of the operational behavior data. Dynamic risk detection is performed on the corresponding operational behavior data according to the dynamic risk analysis sub-rules to obtain the dynamic risk analysis results.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the security detection method for mobile applications as described in any one of claims 1-5.

8. A storage medium, characterized in that, The storage medium stores a computer program, which includes program instructions that, when executed by a processor, cause the processor to perform the security detection method for mobile applications as described in any one of claims 1-5.

Images