Data security-oriented mobile application dynamic and static dual-combination detection method and system

Abstract

The invention relates to the technical field of data security detection, in particular to a data security-oriented mobile application dynamic and static dual-combination detection method and system. The method comprises the following steps: collecting basic information of a target mobile application from a plurality of heterogeneous data sources, and constructing a basic data set of the mobile application information; performing decompilation and static analysis based on the installation file in the resource library, and outputting a static risk feature vector in combination with the sensitive data operation rule set; dynamically running a target application in the controlled sandbox environment, monitoring network traffic, system calling and file operation behavior sequences, and outputting a dynamic behavior risk feature vector; and fusing the two types of feature vectors, and inputting the fused feature vectors into a risk assessment model to generate a comprehensive data security risk assessment report. According to the method, a comprehensive evaluation system is constructed by fusing static and dynamic risk features, and full-dimension coverage of the security risk of the mobile application is realized.

Description

Technical Field

[0001] This invention relates to the field of data security detection technology, and more specifically, to a method and system for combined dynamic and static detection of mobile applications for data security. Background Technology

[0002] Mobile application data security detection technology is a key technology for protecting user privacy and data security. It is mainly used to conduct risk assessments on various mobile applications such as life services, live streaming, transportation, and games, and to prevent user information leakage and financial losses by identifying security risks such as permission abuse, data leakage, and malicious behavior. However, existing technical solutions that rely on either static or dynamic detection have significant limitations. Static detection can only analyze application code and configuration information and cannot capture runtime dynamic behavior risks; while dynamic detection can monitor real-time application operations, it is difficult to cover potential vulnerabilities at the code level, and the lack of an effective fusion mechanism between the two types of detection results leads to insufficient accuracy in risk assessment and makes it difficult to adapt to the scenario-based security needs of different types of applications. In view of this, this invention provides a method and system for mobile application data security that combines static and dynamic detection. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for combined static and dynamic detection of mobile applications for data security, in order to solve the problem that the existing technical solutions that rely on single static detection or dynamic detection have obvious limitations and are difficult to adapt to the scenario-based security needs of different types of applications.

[0004] To achieve the above objectives, the present invention aims to provide a method for combined dynamic and static detection of mobile applications for data security, comprising the following steps:

[0005] S1. Collect basic information of the target mobile application from multiple heterogeneous data sources, clean, transform and normalize it according to unified data standards and specifications, and build a basic dataset of mobile application information.

[0006] S2. Extract the installation file of the target mobile application from the mobile application information basic dataset, use decompilation tools to obtain the decompiled code and manifest file, identify the newly added permissions that have not been declared, and output a static risk feature vector based on the decompiled code through control flow graph and data flow analysis techniques.

[0007] S3. Real-time monitoring of network traffic, system calls, and file operation behavior sequences generated during the operation of the target mobile application. Through behavior sequence modeling and traffic analysis technology, dynamic behavior risk feature vectors are output.

[0008] S4. The static risk feature vector and the dynamic behavioral risk feature vector are fused together and input into the pre-trained risk assessment model to generate a comprehensive data security risk assessment report.

[0009] As a further improvement to this technical solution, in S1, the basic information includes the installation package structure, permission list, API call sequence, resource files, and metadata.

[0010] As a further improvement to this technical solution, in step S1, the specific steps involved in cleaning, transforming, and normalizing the data according to unified data standards and specifications to construct the basic dataset for mobile application information are as follows:

[0011] The collected permission list is compared with a preset standard valid permission library, and all permissions not included in the library are removed.

[0012] Analyze the frequency of API calls and remove API call records with a frequency below a preset threshold;

[0013] Check the package name and version number in the metadata and mark any missing records;

[0014] A fixed-order list of all standard permissions is created, and the actual list of permissions for the application is converted into a binary vector to form a permission feature vector.

[0015] Count the number of times each API is called and sort it by type to form an API call frequency vector;

[0016] The resource files are hashed and weighted according to their distribution throughout the resource library to form a resource file feature vector.

[0017] One-hot encoding is used to convert textual metadata into numerical vectors, forming metadata feature vectors.

[0018] Min-Max normalization is applied to the permission feature vector, API call frequency vector, resource file feature vector, and metadata feature vector to obtain the corresponding standardized feature vectors.

[0019] All standardized feature vectors are associated and integrated based on the application identifier and timestamp in the metadata to construct a unified basic dataset of mobile application information.

[0020] As a further improvement to this technical solution, in step S2, the specific steps involved in using a decompilation tool to obtain the decompiled code and manifest file, and identifying the newly added permissions that have not been declared, are as follows:

[0021] Extract the installation file of the target mobile application from the mobile application information dataset, use a decompilation tool to unpack and decompile the installation package file, and obtain its decompiled code and manifest file;

[0022] Extract the actual declared permission set P of the application from the manifest file. manifest Simultaneously, the permission feature vector V corresponding to the application is retrieved from the mobile application information base dataset. perm ;

[0023] Using a predefined standard permission mapping table, the permission feature vector V is... perm Reverse decoding to a collection of permission source strings

[0024] Based on the actual declared permission set P manifest and the permission source string set P resource It checks whether there are permissions in the permission set that are not in the permission source string set, thereby identifying newly added permissions that have not been declared.

[0025] As a further improvement to this technical solution, in step S2, the specific steps involved in outputting the static risk feature vector through control flow graph and data flow analysis techniques are as follows:

[0026] Based on the decompiled code, a regular expression-based pattern matching method is used to convert the decompiled code into a sequence of tokens.

[0027] Based on the marked sequences, the LR parsing algorithm is used to construct an abstract syntax tree from the marked sequences;

[0028] The abstract syntax tree is traversed using a depth-first algorithm, and a predefined code generation template is matched for each syntax node to convert the abstract syntax tree into a linear three-address code instruction sequence;

[0029] Based on the linear three-address code instruction sequence, basic blocks are partitioned and connected by recognizing jump instructions and tags to obtain a control flow graph with basic blocks as nodes and control flow paths as edges.

[0030] Based on the method call instructions and component declaration information in the linear three-address code instruction sequence, a function call graph depicting the call relationship between methods is obtained by parsing the call target signature and combining it with class hierarchy analysis method;

[0031] Define the data source and data aggregation point of the sensitive data to be tracked by using a preset set of sensitive data operation rules;

[0032] Based on control flow graphs and function call graphs, and combined with a pre-defined set of sensitive data operation rules, the data flow path of sensitive data from the data source to the data aggregation point is traced through inter-process data flow analysis.

[0033] A risk score is assigned to each data flow path from the data source to the data aggregation point to obtain a risk path score. path ;

[0034] Calculate the scores for all risk paths and aggregate them to generate a static risk feature vector V. static The static risk feature vector has a dimension of k, which corresponds to k types of risk. The value of each dimension is the weighted total score of the path of that type of risk.

[0035] As a further improvement to this technical solution, the specific steps involved in S3 for real-time monitoring of the network traffic, system calls, and file operation sequences generated during the operation of the target mobile application are as follows:

[0036] By capturing all HTTP and HTTPS requests issued by the application, key fields including the target domain, request method, parameter content, and data size are extracted and recorded as a network traffic sequence (Net). Seq ;

[0037] By monitoring application process system calls using system-level hooking technology, file read / write operations, process creation, and external device access operations are recorded, forming a system call sequence (Syscall). Seq ;

[0038] Real-time monitoring of application file operations on local storage, recording file creation, modification, and deletion operations, and generating file operation sequences.

[0039] As a further improvement to this technical solution, in step S3, the specific steps involved in outputting the dynamic behavioral risk feature vector through behavioral sequence modeling and traffic analysis technology are as follows:

[0040] For network traffic sequences Net Seq System call sequence Syscall Seq File operation sequence Divide the time window into segments, each with a length of T seconds;

[0041] Network traffic sequences within a time window (Net) Seq The network request frequency F is obtained by counting the total number of requests and dividing by the window duration. net Simultaneously, the data transmission content in the network traffic sequence within the time window is analyzed, sensitive data types are identified and their transmission volume is statistically analyzed, and the data outflow risk value R is calculated. net ;

[0042] Based on file operation sequence within the time window By filtering the set of sensitive paths and counting the total number of operation entries, the number of accesses to sensitive files, F, is obtained.file ;

[0043] Syscall based on the system call sequence within the time window Seq The system call anomaly level A is obtained by assigning a risk weight to each call and calculating the weighted sum over a unit of time. sys Simultaneously, the system call sequence within the time window is compared with a preset malicious behavior pattern library, and the proportion of matched abnormal patterns is statistically analyzed to obtain the behavior abnormality degree A. behavior ;

[0044] The network request frequency F within each time window net Risk value R of data leakage net Number of accesses to sensitive files (F) file System call anomaly degree A sys Degree of behavioral abnormality A behavior Arranged in chronological order, construct a dynamic behavior feature matrix Dyn Matrix ;

[0045] Based on the dynamic behavior feature matrix Dyn Matrix The matrix is ​​normalized using Min-Max, and the dynamic behavioral risk value (Risk) is calculated through weighted aggregation. dynamic ;

[0046] Dynamic behavioral risk value (Risk) dynamic With the normalized dynamic behavior feature matrix Dyn Matrix By combining these features, a dynamic behavioral risk feature vector V is constructed. dynamic .

[0047] As a further improvement to this technical solution, the specific steps involved in feature fusion of the static risk feature vector and the dynamic behavioral risk feature vector in step S4 are as follows:

[0048] The static risk feature vector V static With dynamic behavioral risk feature vector V dynamic The concatenated feature vector V is obtained by concatenating the feature dimensions. cat ;

[0049] The original eigenvector V is obtained through principal component analysis. cat Mapped to a uniform-dimensional feature vector V pca ;

[0050] For a uniform dimension feature vector V pca Each dimension is standardized using the Min-Max normalization method to obtain the fused feature vector.

[0051] As a further improvement to this technical solution, the specific steps involved in S4, where the data is input into the pre-trained risk assessment model to generate a comprehensive data security risk assessment report, are as follows:

[0052] Construct a risk assessment model based on a multilayer perceptron, with the fused feature vector as its input. The output is the overall risk score, Risk. final The risk assessment model consists of an input layer, two hidden layers, and an output layer. The number of nodes in the input layer is equal to the dimension D of the fused feature vector. The number of nodes in the first hidden layer is d1, the number of nodes in the second hidden layer is d2, and the number of nodes in the output layer is 1. The activation function used is ReLU, and the output layer uses the Sigmoid function.

[0053] Historical dynamic and static monitoring data from four typical applications in Yantai City—life services, live streaming, transportation, and gaming—along with corresponding real risk labels, were used as the training set to supervise the training of the risk assessment model. Each sample in the training set includes a fused feature vector. and the true risk label y true Cross-entropy is used as the loss function, and the Adam optimizer is used for parameter updates.

[0054] The fusion feature vector of the application under test Input the trained risk assessment model and calculate its comprehensive risk score, Risk. final ;

[0055] Based on the comprehensive risk score The risk level is determined by the value of the Risk score. final Less than the low-risk threshold θ low If the overall risk score is low, it is considered low risk; final Exceeding the high-risk threshold θ high If the overall risk score is Risk, it is considered high risk; final Between the low-risk threshold θ low and high-risk threshold θ high Between these levels, it is classified as medium risk;

[0056] Generate a comprehensive data security risk assessment report, which includes basic application information and a static risk feature vector V. static Dynamic behavioral risk feature vector V dynamic Comprehensive Risk Score final Risk levels and risk recommendations for typical application scenarios in Yantai City.

[0057] On the other hand, the present invention provides a mobile application dynamic and static dual-combination detection system for data security, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the steps of the mobile application dynamic and static dual-combination detection method for data security described above.

[0058] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0059] 1. This mobile application dynamic and static dual-mode detection method and system for data security, through the collaboration of static parsing (decompilation, control flow graph and data flow analysis) and dynamic monitoring (network traffic, system calls, and file operation tracking in a controlled sandbox environment), integrates static risk feature vectors and dynamic behavioral risk feature vectors to construct a comprehensive evaluation system. Compared with the limitations of traditional single static detection, which cannot capture runtime risks, and single dynamic detection, which cannot cover potential vulnerabilities at the code level, this method achieves full-dimensional coverage of mobile application security risks and solves the problems of incomplete risk identification and single evaluation dimensions in traditional detection methods.

[0060] 2. This mobile application dynamic and static dual detection method and system for data security trains a risk assessment model based on data from typical application scenarios in Yantai City (life services, live streaming, transportation, and gaming applications). It achieves feature dimension alignment and fusion through principal component analysis and generates dynamic risk suggestions by setting scenario-based weights (e.g., life services are concerned about location information leakage, and live streaming is concerned about the transmission of privacy data). Compared with the shortcomings of traditional general-purpose detection models that lack scenario adaptability and have insufficient targeted risk suggestions, this method significantly improves the accuracy of risk assessment and the practicality of suggestions, and can accurately match the security detection needs of different types of mobile applications. Attached Figure Description

[0061] Figure 1 This is a flowchart of the overall method of the present invention. Detailed Implementation

[0062] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0063] Example 1:

[0064] Please see Figure 1 As shown, this embodiment provides a method for combined dynamic and static detection of mobile applications for data security, including the following steps:

[0065] S1. Collect basic information of the target mobile application from multiple heterogeneous data sources, clean, transform and normalize it according to unified data standards and specifications, and build a basic dataset of mobile application information.

[0066] Among them, multiple heterogeneous data sources include official app store distribution channels, third-party app hosting platforms, network traffic mirror nodes, and mobile terminal application clients;

[0067] The target mobile applications include those for life services, live streaming, transportation, and games / entertainment in Yantai City.

[0068] In this embodiment, the basic information includes the installation package structure of the target mobile application, the declared permission list, the API call sequence in the code, the digital fingerprint of the resource files, and the version and developer metadata;

[0069] The installation package structure refers to the file organization within the mobile application installation package, including folder hierarchy and the distribution and relationships of various files (such as code files, resource files, configuration files, etc.).

[0070] The declared permission list is the various operation permissions that the application requests from the system;

[0071] API (Application Programming Interface) is a predefined function or interface that developers call during programming to achieve specific functionalities; an API call sequence is a collection of API calls in the order of execution in the application code, reflecting the process by which the application implements functions through the interface;

[0072] Resource files are non-code files required for application operation (such as images, audio, text, configuration files, etc.); digital fingerprints are unique strings calculated from resource files using hash algorithms (such as MD5, SHA-1, etc.), and can be used to quickly verify the integrity of files (whether they have been tampered with) or identify the uniqueness of files.

[0073] Version metadata refers to version-related information such as the application's version number, version update time, and changelog; developer metadata refers to information about the application's developers or development team, such as developer name, development company, contact information, and signature information, used to identify the application's development entity and version iteration status.

[0074] In this embodiment, the specific steps involved in constructing the basic dataset of mobile application information are as follows:

[0075] The collected permission list is compared with a preset standard valid permission library, and all permissions not included in the library are removed.

[0076] Analyze the frequency of API calls and remove API call records with a frequency below a preset threshold;

[0077] Examine key fields such as package name and version number in the metadata and mark any records that are missing;

[0078] A fixed-order list of all standard permissions is created, and the actual list of permissions for the application is converted into a binary vector to form a permission feature vector; where each bit indicates whether the permission exists at the corresponding position.

[0079] Count the number of times each API is called and sort it by type to form an API call frequency vector;

[0080] The resource files are hashed and weighted according to their distribution throughout the resource library to form a resource file feature vector.

[0081] One-hot encoding is used to convert textual metadata into numerical vectors, forming metadata feature vectors.

[0082] Min-Max normalization is applied to the permission feature vector, API call frequency vector, resource file feature vector, and metadata feature vector to obtain the corresponding standardized feature vectors.

[0083] All standardized feature vectors are associated and integrated based on the application identifier and timestamp in the metadata to construct a unified basic dataset of mobile application information.

[0084] R app ={V perm V api V res V meta ,T timestamp ID app}

[0085] Among them, R app V represents a complete data record of a mobile application in the mobile application information dataset; perm V is the permission feature vector. api For API calls, feature vector, V res V is the feature vector of the resource file. meta T is the metadata feature vector. timestamp For timestamps, ID app Use a unique identifier for the application.

[0086] S2. Extract the installation file of the target mobile application from the mobile application information basic dataset, use decompilation tools to obtain the decompiled code and manifest file, identify the newly added permissions that have not been declared, and output a static risk feature vector based on the decompiled code through control flow graph and data flow analysis techniques.

[0087] Specifically, in this embodiment, the specific steps involved in decompiling the installation files based on the mobile application information dataset are as follows:

[0088] Extract the installation file of the target mobile application from the mobile application information base dataset, and use decompilation tools (such as Apktool, Jadx) to unpack and decompile the installation package file to obtain its decompiled code (Smal i or Java) and manifest file;

[0089] Smali is an assembly language used by the Android virtual machine; Java source code is the application's program code; the manifest file records the application's basic information, permission declarations, and other key content.

[0090] Extract the actual declared permission set P of the application from the manifest file. manifest Simultaneously, the permission feature vector V corresponding to the application is retrieved from the mobile application information base dataset. perm ;

[0091] Using a predefined standard permission mapping table, the permission feature vector V is... perm Reverse decoding to the permission source string set P resource ;

[0092] The standard permission mapping table is a predefined, fixed-order list of permissions, where each index position uniquely corresponds to a system permission string, used for bidirectional conversion between permission feature vectors and readable permission sets;

[0093] Based on the actual declared permission set P manifest and the permission source string set P resource It checks whether there are permissions in the permission set that are not in the permission source string set, thereby identifying newly added permissions that have not been declared.

[0094] In this embodiment, the specific steps involved in outputting a static risk feature vector by combining control flow graph and data flow analysis techniques with a preset set of sensitive data operation rules are as follows:

[0095] Based on the decompiled code, a regular expression-based pattern matching method is used to convert the decompiled code into a sequence of tokens.

[0096] Specifically, the regular expression-based pattern matching method drives a finite automaton to scan and match the source code character stream by predefining a series of regular expressions that describe lexical units (such as identifiers and keywords), thereby segmenting it into tags with classification and attributes.

[0097] Based on the marked sequences, the LR parsing algorithm is used to construct an abstract syntax tree from the marked sequences;

[0098] Specifically, the LR analysis algorithm maintains a state stack and a symbol stack, and queries a pre-generated action table based on the current state and input tags to determine operations such as shift, reduce, accept or report errors, thereby deriving the syntax structure of the source code from the bottom up.

[0099] The abstract syntax tree is traversed using a depth-first algorithm, and a predefined code generation template is matched for each syntax node (such as an expression or control statement) to convert the abstract syntax tree into a linear three-address code instruction sequence.

[0100] Specifically, the code generation template defines how to generate code by specifying the corresponding three-address code instruction mode and generation logic for each syntactic structure (such as if statement, arithmetic operation);

[0101] Based on the linear three-address code instruction sequence, basic blocks are partitioned and connected by recognizing jump instructions and tags to obtain a control flow graph with basic blocks as nodes and control flow paths as edges.

[0102] Based on method call instructions (such as invoke-*) and component declaration information in the linear three-address code instruction sequence, a function call graph depicting the call relationship between methods is obtained by parsing the call target signature and combining it with class hierarchy analysis methods.

[0103] Among them, class hierarchy analysis analyzes the inheritance relationship of all classes and resolves all possible dynamic target method implementations for each virtual method call, thereby establishing a complete and accurate call edge in the call graph;

[0104] Define the data source and data aggregation point of the sensitive data to be tracked (such as location, IMEI, and contacts) by using a preset set of sensitive data operation rules;

[0105] Specifically, a set of rules for handling sensitive data is defined, including the following rule formats:

[0106] Rule i :IF(Source type =locationANDSink type =network send )

[0107] THENrisklevel =high

[0108] Among them, Source type Indicates the data source type, such as location information, IMEI (International Mobile Equipment Identity), etc.; Sink type Indicates the data export type, such as sending over a network or storing to a local file; risk level This indicates the risk level of the route; here, "high" indicates high risk.

[0109] Based on control flow graphs and function call graphs, and combined with a pre-defined set of sensitive data operation rules, the data flow path of sensitive data from the data source to the data aggregation point is traced through inter-process data flow analysis.

[0110] Specifically, the core mechanism of inter-process data flow analysis lies in defining data sources and data aggregation points based on a preset set of sensitive data operation rules. When the analysis reaches the method call point, the target method is called to map the caller data carrying tainted status to the formal parameters of the called method. After the called method is executed, its return value and the tainted status of side effects are passed back to the calling context. By iteratively executing this cross-function data status transfer, when the marked sensitive data reaches the data aggregation point defined by the rule set, the system can identify a complete, cross-process sensitive data leakage risk path from the source to the exit.

[0111] A risk score is assigned to each data flow path from the data source to the data aggregation point to obtain a risk path score. path ;

[0112]

[0113] Among them, w1 is the risk level weight coefficient, w2 is the node weight coefficient, and w3 is the API call weight coefficient. These are set according to typical application scenarios in Yantai City (such as life service applications that are more concerned about location information leakage) and are used to adjust the importance of different factors in the scoring; risk level Risk levels defined in the rule set (quantified numerically, e.g., high=3, medium=2, low=1); path length The number of nodes in the data flow path reflects the propagation complexity; the more nodes, the more complex the propagation process. This indicates the weight of the API calls involved in the path within the preset risk API library; a higher value indicates a greater risk for that API call. path A risk path score is used to quantify the degree of risk of the path;

[0114] Calculate the scores for all risk paths and aggregate them to generate a static risk feature vector V.static The static risk feature vector has dimension k, corresponding to k types of risks (such as privilege abuse, data leakage, malicious code embedding, etc.), and the value of each dimension is the weighted total score of the risk path for that type.

[0115]

[0116] Among them, category i This represents the i-th type of risk; for example, when i=1, category1 might represent abuse of privileges. (total) paths,i Score represents the total number of paths for the i-th type of risk. path,j V represents the score of the j-th risk path; static [i] represents the value of the i-th dimension in the static risk feature vector, corresponding to the normalized score of the i-th risk category; max(*) is the maximum value function, calculated by dividing by max(1, total). paths,i Normalization is performed to avoid bias caused by different numbers of paths, making the scores of different risk categories more comparable; k represents the static risk feature vector V. static The dimension is the total number of risk categories.

[0117] S3. Real-time monitoring of network traffic, system calls, and file operation behavior sequences generated during the operation of the target mobile application. Through behavior sequence modeling and traffic analysis technology, dynamic behavior risk feature vectors are output.

[0118] In this embodiment, a controlled sandbox environment is constructed, a standard Android system image is configured, the target mobile application is installed, and user interaction scripts simulating typical application scenarios in Yantai City are used.

[0119] Among them, user interaction scripts include location query for life service applications, route planning for transportation applications, and video streaming operations for live streaming applications;

[0120] Deploy a network traffic monitoring agent in a sandbox environment. By capturing all HTTP and HTTPS requests issued by the application, extract key fields including the target domain name, request method, parameter content, and data volume, and record them as a network traffic sequence (Net). Seq ;

[0121] Net Seq ={(domain n ,method n ,param n size n timestamp n |n=1,2,...,N}

[0122] Among them, NetSeq To capture application network traffic sequences, domain n The target domain name for the nth network request; method n It refers to the method used in the nth network request (such as GET, POST, etc.); param n It is the parameter content carried by the nth network request; The size of the data in the nth network request; timestamp n It is the timestamp of the nth network request; n is the index of the request in the sequence, and N represents the total number of network requests;

[0123] By monitoring application process system calls using system-level hooking technology, file read / write operations, process creation, and external device access operations are recorded, forming a system call sequence (Syscall). Seq ;

[0124] Syscall Seq ={(call type,m ,target path,m timestamp m |m=1,2,...,M}

[0125] Among them, Syscall Seq It is the monitored sequence of system calls; call type,m The type of the m-th system call (e.g., open, read, write, etc.); target path,m It is the target path of the m-th system call; timestamp m It is the timestamp of the m-th call; m is the index of the system call in the sequence, and M represents the total number of system calls;

[0126] Real-time monitoring of application file operations on local storage, recording file creation, modification, and deletion operations, and generating file operation sequences.

[0127]

[0128] in, It is a recorded sequence of file operations; op type,p The type of the p-th file operation (e.g., create, modify, delete); file path,p It is the file path for the p-th operation; hash value,p It is the hash value obtained by calculating the file content using the SHA-256 algorithm in the p-th operation, used to verify file integrity; timestamp pIt is the timestamp of the p-th operation; p is the index of the file operation in the sequence, and P represents the total number of file operations;

[0129] In this embodiment, the network traffic sequence Net Seq System call sequence Syscall Seq File operation sequence Divide the time window into segments, each with a length of T seconds;

[0130] Network traffic sequences within a time window (Net) Seq The network request frequency F is obtained by counting the total number of requests and dividing by the window duration. net Simultaneously, the data transmission content in the network traffic sequence within the time window is analyzed, sensitive data types are identified and their transmission volume is statistically analyzed, and the data outflow risk value R is calculated. net ;

[0131]

[0132] Among them, F net This represents the frequency of network requests per unit of time; count(Net Seq ) represents the total number of requests in the network traffic sequence within this time window; T is the length of the time window (set to 60 seconds based on the typical scenario in Yantai City);

[0133]

[0134] Among them, risk level,n For the risk level of the data type transmitted in the nth network request, size n Its data size; R net This is the data leakage risk value, used to measure the degree of risk of sensitive data being leaked over the network per unit of time;

[0135] Based on file operation sequence within the time window By filtering the set of sensitive paths and counting the total number of operation entries, the number of accesses to sensitive files, F, is obtained. file ;

[0136]

[0137] Among them, F file It represents the number of times a sensitive file is accessed within a time window; count(*) indicates the number of operations in the file operation sequence whose paths belong to the sensitive path set; It is a pre-defined set of sensitive paths, including directories that store sensitive information such as contacts and location cache;

[0138] Syscall based on the system call sequence within the time windowSeq The system call anomaly level A is obtained by assigning a risk weight to each call and calculating the weighted sum over a unit of time. sys Simultaneously, the system call sequence within the time window is compared with a preset malicious behavior pattern library, and the proportion of matched abnormal patterns is statistically analyzed to obtain the behavior abnormality degree A. behavior ;

[0139]

[0140] Among them, A sys Indicates the degree of abnormality of the system call; risk weight (call type,m ) represents the risk weight corresponding to the type of the m-th system call (the higher the risk, the greater the weight);

[0141]

[0142] Among them, abnormal pattern,m For call sequence fragments that match a predefined malicious behavior pattern library, count(*) is a counting function; total patterns It is the total number of all call patterns in the system call sequence within that time window; A behavior This represents the degree of behavioral abnormality; a higher value indicates a stronger degree of abnormality.

[0143] The network request frequency F within each time window net Risk value R of data leakage net Number of accesses to sensitive files (F) file System call anomaly degree A sys Degree of behavioral abnormality A behavior Arranged in chronological order, construct a dynamic behavior feature matrix Dyn Matrix ;

[0144]

[0145] Among them, Dyn Matrix This is a dynamic behavior feature matrix with a feature dimension of 5.

[0146] Based on the dynamic behavior feature matrix Dyn Matrix The matrix is ​​normalized using Min-Max, and the dynamic behavioral risk value (Risk) is calculated through weighted aggregation. dynamic ;

[0147]

[0148] Where, α i It is the weight coefficient of the i-th feature dimension in typical application scenarios in Yantai City (set according to the importance of the scenario); featurei Risk is the normalized eigenvalue of the i-th dimension in the dynamic behavior feature matrix. dynamic This represents a dynamic behavioral risk value.

[0149] Dynamic behavioral risk value (Risk) dynamic With the normalized dynamic behavior feature matrix Dyn Matrix By combining these features, a dynamic behavioral risk feature vector V is constructed. dynamic ;

[0150] V dynamic =

[0151] Risk dynamic ,norm(F net ),norm(R net ),norm(F file ),norm(A sys ),norm(A behavior )]

[0152] Among them, norm(F net ) represents the normalized network request frequency, norm(R) net ) represents the normalized risk value for the outward transmission of sensitive data, and norm(F) file ) represents the normalized number of accesses to sensitive files, norm(A) sys ) represents the normalized system call anomaly score, norm(A) behavior V represents the normalized score for behavioral abnormalities. dynamic It is a multi-dimensional quantitative representation of the risks of dynamic behavior in applications.

[0153] S4. The static risk feature vector and the dynamic behavioral risk feature vector are fused together and input into the pre-trained risk assessment model to generate a comprehensive data security risk assessment report.

[0154] Specifically, in this embodiment, the static risk feature vector V is... static With dynamic behavioral risk feature vector V dynamic The concatenated feature vector V is obtained by concatenating the feature dimensions. cat ;

[0155] V cat =[V static V dynamic ]

[0156] in, This is the original feature vector after concatenation;

[0157] The original eigenvector V is obtained through principal component analysis. cat Mapped to a uniform-dimensional feature vector Vpca ;

[0158] V pca =(V cat -μ)P

[0159] in, The mean vector of features in the training set; This results in a unified-dimensional feature vector. The PCA projection matrix is ​​composed of the eigenvectors of the first D principal components.

[0160] Specifically, dimensional alignment is performed using principal component analysis. First, N is collected. v The static risk feature vector V of a historical application sample static With dynamic behavioral risk feature vector V dynamic Form an N v An initial matrix of (k+6) rows and columns is generated. Then, the mean μ of each feature dimension of the initial matrix is ​​calculated and centered. Next, the covariance matrix of the centered data is calculated, and the matrix is ​​eigenvalued and sorted in descending order of eigenvalues. Based on a preset cumulative contribution rate threshold (e.g., 95%), the first D principal component directions are selected to form a projection matrix P with dimensions (k+6)×D. Finally, the centered original feature data is projected onto these principal component directions to obtain a feature representation with a unified dimension of D. For static risk feature vectors and dynamic behavioral risk feature vectors of new applications, centered processing is performed first, and then the projection matrix P is used to convert them into D-dimensional features.

[0161] For a uniform dimension feature vector V pca Each dimension is standardized using the Min-Max normalization method to obtain the fused feature vector.

[0162] In this embodiment, a risk assessment model based on a multilayer perceptron is constructed, with its input being a fused feature vector. The output is the overall risk score, Risk. final The risk assessment model consists of an input layer, two hidden layers, and an output layer. The number of nodes in the input layer is equal to the dimension D of the fused feature vector. The number of nodes in the first hidden layer is d1 (e.g., 128), the number of nodes in the second hidden layer is d2 (e.g., 64), and the number of nodes in the output layer is 1. The activation function used is ReLU, and the output layer uses the Sigmoid function to constrain the comprehensive risk score within the range [0,1].

[0163] Risk assessment model:

[0164]

[0165] Where W1 is the weight matrix of the first hidden layer, W2 is the weight matrix of the second hidden layer, W3 is the weight matrix of the output layer, b1 is the bias term of the first hidden layer, b2 is the bias term of the second hidden layer, and b3 is the bias term of the output layer; ReLU(*) is the ReLU activation function of the hidden layer; Sigmoid(*) is the Sigmoid activation function of the output layer; Risk final The comprehensive risk score ranges from 0 to 1, with a value closer to 1 indicating a higher risk.

[0166] Historical dynamic and static monitoring data from four typical applications in Yantai City—life services, live streaming, transportation, and gaming—along with corresponding real risk labels, were used as the training set to supervise the training of the risk assessment model. Each sample in the training set includes a fused feature vector. and the true risk label y true Cross-entropy is used as the loss function, and the Adam optimizer is used for parameter updates.

[0167] The loss function is defined as:

[0168] Loss = -[y true ·log(Risk final )+(1-y true )·log(1-Risk final )]

[0169] Where Loss is the cross-entropy loss function; y true The labels are the real risk labels in the training set, where 0 represents low risk and 1 represents high risk.

[0170] The Adam optimizer is used to update parameters, with an initial learning rate of 0.001, a batch size of 32, and 100 training epochs.

[0171] The fusion feature vector of the application under test Input the trained risk assessment model and calculate its comprehensive risk score, Risk. final ;

[0172] Based on the comprehensive risk score Risk final The risk level is determined by the value of the Risk score. final Less than the low-risk threshold θ low (e.g., 0.3) is considered low risk; if the overall risk score is Risk... final Exceeding the high-risk threshold θ high (e.g., 0.7) is considered high risk; if the overall risk score is Risk... final Between the low-risk threshold θ low and high-risk threshold θ highBetween these levels, it is classified as medium risk;

[0173] Generate a comprehensive data security risk assessment report, which includes basic application information and a static risk feature vector V. static Dynamic behavioral risk feature vector V dynamic Comprehensive Risk Score final Risk levels and risk recommendations for typical application scenarios in Yantai City;

[0174] The risk recommendations are dynamically generated based on the application type. For example, for lifestyle service applications, the focus is on the risk of location information leakage; for live streaming applications, the focus is on the leakage of user privacy data and malicious billing; for transportation applications, the focus is on the leakage of travel routes and abuse of permissions; and for games and entertainment applications, the focus is on malicious advertising and irrelevant permission requests.

[0175] Example 2:

[0176] This embodiment provides a mobile application dynamic and static dual-detection system for data security, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the steps of the mobile application dynamic and static dual-detection method for data security described in any one of Embodiment 1.

[0177] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for combined dynamic and static detection of mobile applications for data security, characterized in that, Includes the following steps: S1. Collect basic information of the target mobile application from multiple heterogeneous data sources, clean, transform and normalize it according to unified data standards and specifications, and build a basic dataset of mobile application information. S2. Extract the installation file of the target mobile application from the mobile application information basic dataset, use decompilation tools to obtain the decompiled code and manifest file, identify the newly added permissions that have not been declared, and output a static risk feature vector based on the decompiled code through control flow graph and data flow analysis techniques. S3. Real-time monitoring of network traffic, system calls, and file operation behavior sequences generated during the operation of the target mobile application. Through behavior sequence modeling and traffic analysis technology, dynamic behavior risk feature vectors are output. S4. The static risk feature vector and the dynamic behavioral risk feature vector are fused together and input into the pre-trained risk assessment model to generate a comprehensive data security risk assessment report.

2. The mobile application dynamic and static dual detection method for data security according to claim 1, characterized in that: In S1, the basic information includes the installation package structure, permission list, API call sequence, resource files, and metadata.

3. The mobile application dynamic and static dual detection method for data security according to claim 2, characterized in that: In step S1, the specific steps involved in cleaning, transforming, and normalizing the data according to unified data standards and specifications to construct the basic dataset for mobile application information are as follows: The collected permission list is compared with a preset standard valid permission library, and all permissions not included in the library are removed. Analyze the frequency of API calls and remove API call records with a frequency below a preset threshold; Check the package name and version number in the metadata and mark any missing records; A fixed-order list of all standard permissions is created, and the actual list of permissions for the application is converted into a binary vector to form a permission feature vector. Count the number of times each API is called and sort it by type to form an API call frequency vector; The resource files are hashed and weighted according to their distribution throughout the resource library to form a resource file feature vector. One-hot encoding is used to convert textual metadata into numerical vectors, forming metadata feature vectors. Min-Max normalization is applied to the permission feature vector, API call frequency vector, resource file feature vector, and metadata feature vector to obtain the corresponding standardized feature vectors. All standardized feature vectors are associated and integrated based on the application identifier and timestamp in the metadata to construct a unified basic dataset of mobile application information.

4. The mobile application dynamic and static dual detection method for data security according to claim 1, characterized in that: In step S2, the specific steps involved in using a decompilation tool to obtain the decompiled code and manifest file, and identifying newly added permissions that have not been declared, are as follows: Extract the installation file of the target mobile application from the mobile application information dataset, use a decompilation tool to unpack and decompile the installation package file, and obtain its decompiled code and manifest file; Extract the actual declared permission set P of the application from the manifest file. manifest Simultaneously, the permission feature vector V corresponding to the application is retrieved from the mobile application information base dataset. perm ; Using a predefined standard permission mapping table, the permission feature vector V is... perm Reverse decoding to the permission source string set P resource ; Based on the actual declared permission set P manifest and the permission source string set P resource It checks whether there are permissions in the permission set that are not in the permission source string set, thereby identifying newly added permissions that have not been declared.

5. The mobile application dynamic and static dual detection method for data security according to claim 4, characterized in that: In step S2, the specific steps involved in outputting the static risk feature vector through control flow graph and data flow analysis techniques are as follows: Based on the decompiled code, a regular expression-based pattern matching method is used to convert the decompiled code into a sequence of tokens. Based on the marked sequences, the LR parsing algorithm is used to construct an abstract syntax tree from the marked sequences; The abstract syntax tree is traversed using a depth-first algorithm, and a predefined code generation template is matched for each syntax node to convert the abstract syntax tree into a linear three-address code instruction sequence; Based on the linear three-address code instruction sequence, basic blocks are partitioned and connected by recognizing jump instructions and tags to obtain a control flow graph with basic blocks as nodes and control flow paths as edges. Based on the method call instructions and component declaration information in the linear three-address code instruction sequence, a function call graph depicting the call relationship between methods is obtained by parsing the call target signature and combining it with class hierarchy analysis method; Define the data source and data aggregation point of the sensitive data to be tracked by using a preset set of sensitive data operation rules; Based on control flow graphs and function call graphs, and combined with a pre-defined set of sensitive data operation rules, the data flow path of sensitive data from the data source to the data aggregation point is traced through inter-process data flow analysis. A risk score is assigned to each data flow path from the data source to the data aggregation point to obtain a risk path score. path ; Calculate the scores for all risk paths and aggregate them to generate a static risk feature vector V. static The static risk feature vector has a dimension of k, which corresponds to k types of risk. The value of each dimension is the weighted total score of the path of that type of risk.

6. The mobile application dynamic and static dual detection method for data security according to claim 1, characterized in that: In step S3, the specific steps involved in real-time monitoring of the network traffic, system calls, and file operation sequences generated during the operation of the target mobile application are as follows: By capturing all HTTP and HTTPS requests issued by the application, key fields including the target domain, request method, parameter content, and data size are extracted and recorded as a network traffic sequence (Net). Seq ; By monitoring application process system calls using system-level hooking technology, file read / write operations, process creation, and external device access operations are recorded, forming a system call sequence (Syscall). Seq ; Real-time monitoring of application file operations on local storage, recording file creation, modification, and deletion operations, and generating file operation sequences.

7. The mobile application dynamic and static dual detection method for data security according to claim 6, characterized in that: In step S3, the specific steps involved in outputting the dynamic behavioral risk feature vector through behavioral sequence modeling and traffic analysis techniques are as follows: For network traffic sequences Net Seq System call sequence Syscall Seq File operation sequence Divide the time window into segments, each with a length of T seconds; Network traffic sequences within a time window (Net) Seq The network request frequency F is obtained by counting the total number of requests and dividing by the window duration. net Simultaneously, the data transmission content in the network traffic sequence within the time window is analyzed, sensitive data types are identified and their transmission volume is statistically analyzed, and the data outflow risk value R is calculated. net ; Based on file operation sequence within the time window By filtering the set of sensitive paths and counting the total number of operation entries, the number of accesses to sensitive files, F, is obtained. file ; Syscall based on the system call sequence within the time window Seq The system call anomaly level A is obtained by assigning a risk weight to each call and calculating the weighted sum over a unit of time. sys Simultaneously, the system call sequence within the time window is compared with a preset malicious behavior pattern library, and the proportion of matched abnormal patterns is statistically analyzed to obtain the behavior abnormality degree A. behavior ; The network request frequency F within each time window net Risk value R of data leakage net Number of accesses to sensitive files (F) file System call anomaly degree A sys Degree of behavioral abnormality A behavior Arranged in chronological order, construct a dynamic behavior feature matrix Dyn Matrix ; Based on the dynamic behavior feature matrix Dyn Matrix The matrix is ​​normalized using Min-Max, and the dynamic behavioral risk value (Risk) is calculated through weighted aggregation. dynamic ; Dynamic behavioral risk value (Risk) dynamic With the normalized dynamic behavior feature matrix Dyn Matrix By combining these features, a dynamic behavioral risk feature vector V is constructed. dynamic .

8. The mobile application dynamic and static dual detection method for data security according to claim 1, characterized in that: In step S4, the specific steps involved in feature fusion of the static risk feature vector and the dynamic behavioral risk feature vector are as follows: The static risk feature vector V static With dynamic behavioral risk feature vector V dynamic The concatenated feature vector V is obtained by concatenating the feature dimensions. cat ; The original eigenvector V is obtained through principal component analysis. cat Mapped to a uniform-dimensional feature vector V pca ; For a uniform dimension feature vector V pca Each dimension is standardized using the Min-Max normalization method to obtain the fused feature vector.

9. The mobile application dynamic and static dual detection method for data security according to claim 8, characterized in that: In step S4, the specific steps involved in inputting the pre-trained risk assessment model to generate a comprehensive data security risk assessment report are as follows: Construct a risk assessment model based on a multilayer perceptron, with the fused feature vector as its input. The output is the overall risk score, Risk. final The risk assessment model consists of an input layer, two hidden layers, and an output layer. The number of nodes in the input layer is equal to the dimension D of the fused feature vector. The number of nodes in the first hidden layer is d1, the number of nodes in the second hidden layer is d2, and the number of nodes in the output layer is 1. The activation function used is ReLU, and the output layer uses the Sigmoid function. Historical dynamic and static monitoring data from four typical applications in Yantai City—life services, live streaming, transportation, and gaming—along with corresponding real risk labels, were used as the training set to supervise the training of the risk assessment model. Each sample in the training set includes a fused feature vector. and the true risk label y true Cross-entropy is used as the loss function, and the Adam optimizer is used for parameter updates. The fusion feature vector of the application under test Input the trained risk assessment model and calculate its comprehensive risk score, Risk. final ; Based on the comprehensive risk score Risk final The risk level is determined by the value of the Risk score. final Less than the low-risk threshold θ low If the overall risk score is low, it is considered low risk; final Exceeding the high-risk threshold θ high If the overall risk score is Risk, it is considered high risk; final Between the low-risk threshold θ low and high-risk threshold θ high Between these levels, it is classified as medium risk; Generate a comprehensive data security risk assessment report, which includes basic application information and a static risk feature vector V. static Dynamic behavioral risk feature vector V dynamic Comprehensive Risk Score final Risk levels and risk recommendations for typical application scenarios in Yantai City.

10. A mobile application dynamic and static dual-detection system for data security, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: The processor executes a computer program to implement the steps of the mobile application dynamic and static dual-detection method for data security as described in any one of claims 1-9.

Images