Penetration testing method and system for mobile application of swan gap system

Abstract

The invention relates to a penetration test method and system for mobile applications of a swan monk system, and the method comprises the steps: obtaining a current version installation package, extracting static asset data, and capturing dynamic behavior data; constructing a threat model for the gap distributed architecture; generating a penetration test case set through the threat model, and deploying and executing the penetration test case set; inputting the heterogeneous security telemetry data into the risk identification model, and executing a preset corresponding processing strategy; generating a penetration test report based on the risk judgment information and the execution result of the processing strategy; in conclusion, according to the penetration testing method and system for the mobile application of the swan-mong system, the threat model for the swan-mong distributed architecture is constructed, and the dynamic stain tracking and fuzzy testing technology is integrated, so that the cross-equipment safety risk is systematically detected; the method has the effects of effectively identifying the cross-equipment security threats in the swan-gap distributed architecture and improving the comprehensiveness and accuracy of the penetration test.

Description

Technical Field

[0001] This application relates to the technical field of mobile application security testing, and in particular to a penetration testing method and system for HarmonyOS mobile applications. Background Technology

[0002] In the field of mobile operating systems, HarmonyOS's distributed design concept enables cross-device capability sharing and collaborative computing, marking an evolution from a single-device ecosystem to a "super virtual terminal." This architectural innovation dramatically expands the attack surface of applications, no longer limited to the internal workings of a single device, but extending to the communication bus between devices, shared system services, and diverse peripheral connections.

[0003] Currently, most penetration testing practices in the industry are based on security assumptions about traditional monolithic operating systems. Their technical approaches primarily rely on detecting the application's code and behavior, fundamentally lacking a framework for understanding security risks in distributed, collaborative environments. This manifests in the fact that existing detection processes are often isolated and static, failing to depict the complex interaction logic of data and permissions in dynamic, multi-device environments. For example, an application may behave normally on a single device, but its cross-device calls could lead to invisible data leaks or permission boundary breaches—risks that traditional single-device monitoring models cannot detect. Furthermore, traditional test case libraries and vulnerability models struggle to cover new vulnerability patterns arising from distributed architectures, resulting in insufficient testing depth and leaving numerous potential security threats lurking in the interactive processes of device collaboration. Summary of the Invention

[0004] To address the aforementioned shortcomings, this application provides a penetration testing method and system for HarmonyOS mobile applications.

[0005] The above-mentioned objective of this application is achieved through the following technical solution: A penetration testing method for HarmonyOS mobile applications, comprising the following steps: Obtain the current version installation package of the target mobile application, extract static asset data, and run the target mobile application in a preset sandbox environment to capture dynamic behavior data; A threat model targeting the HarmonyOS distributed architecture is built based on static asset data and dynamic behavioral data. A set of penetration test cases is generated using a threat model, and then deployed and executed in a distributed testing environment that integrates a dynamic taint tracking engine and a fuzz testing engine. The heterogeneous security telemetry data output by the dynamic taint tracking engine and the fuzz test engine are input into the pre-trained risk identification model, and the preset corresponding processing strategy is executed based on the risk judgment information output by the risk identification model. A penetration test report is generated based on the risk assessment information and the results of the execution of the handling strategies.

[0006] In a preferred embodiment, this application can be further configured as follows: the steps of obtaining the current version installation package of the target mobile application, extracting static asset data, and running the target mobile application in a preset sandbox environment to capture dynamic behavior data include the following steps: Deploy a preset sandbox environment, which includes a sandbox cluster simulating several HarmonyOS terminal devices; Deploy the target mobile application in a sandbox cluster and simulate user operations, system events, and cross-device service call requests based on static asset data to traverse multiple key execution paths of the target mobile application in the sandbox cluster. By embedding probes into the sandbox cluster, the system monitors and collects multi-link interaction data generated by the target mobile application during operation under multiple key execution paths. The multi-link interaction data includes cross-device communication traffic, system service interaction information, and peripheral operation information. Dynamic behavioral data is constructed based on multi-link interaction data.

[0007] In a preferred embodiment, this application can be further configured as follows: the step of deploying the target mobile application in a sandbox cluster and simulating user operations, system events, and cross-device service call requests based on static asset data to traverse multiple key execution paths of the target mobile application in the sandbox cluster includes the following steps: Identify component declaration information and permission request information in static asset data, perform semantic analysis, and determine whether there are any potentially risky interaction interfaces. When there are potentially risky interaction interfaces, a corresponding risk test sequence is generated based on the semantic analysis results. The risk test sequence includes a combination of test parameters and a cross-device call chain. Execute risk test sequences in the sandbox cluster and construct corresponding pre-defined concurrent stress scenarios; Monitor and record abnormal behavior paths of the target mobile application under concurrent pressure scenarios, and use these as traversal results of key execution paths.

[0008] In a preferred embodiment, this application can be further configured as follows: the step of constructing a threat model for the HarmonyOS distributed architecture based on static asset data and dynamic behavioral data includes the following steps: Construct an application threat graph, wherein the nodes of the application threat graph include application components, system services, device types, permissions and capabilities, and the edges of the application threat graph include component call relationships, service binding relationships, data flow relationships and permission dependency relationships; Static asset data and dynamic behavior data are mapped to nodes and edges of an application threat graph, and a pre-set graph mining algorithm is used to identify subgraph structures with high connectivity, which represent potential cross-device attack paths. Identify the complexity of potential cross-device attack paths and their associated sensitive resources, determine threat priorities based on complexity and sensitive resources, and build threat models.

[0009] In a preferred embodiment, this application can be further configured as follows: the step of mapping static asset data and dynamic behavior data to nodes and edges of an application threat graph, and identifying subgraph structures with high connectivity using a preset graph mining algorithm, wherein the subgraph structures represent potential cross-device attack paths, includes the following steps: Extract cross-device interaction events from dynamic behavior data, identify the temporal relationships of cross-device interaction events, and construct an interaction event sequence based on these temporal relationships; Static asset data is mapped to the static structure of the application threat graph, and the sequence of interactive events is transformed into time-stamped temporal edges in the application threat graph to construct a spatiotemporal threat graph. The frequent subgraph mining algorithm is executed on the spatiotemporal threat map. The execution process of the frequent subgraph mining algorithm includes: obtaining a dynamic frequency threshold, setting time window constraints and minimum support threshold, generating candidate time series subgraphs through a preset pattern growth strategy, and iteratively filtering out frequent time series paths that meet the dynamic frequency threshold. The candidate time-series subgraphs corresponding to the selected frequent time-series paths are identified as potential cross-device attack paths.

[0010] In a preferred embodiment, this application can be further configured as follows: the frequent subgraph mining algorithm is executed on the spatiotemporal threat map, and the execution process of the frequent subgraph mining algorithm includes: obtaining a dynamic frequency threshold, setting time window constraints and a minimum support threshold, generating candidate time-series subgraphs through a preset pattern growth strategy, and iteratively filtering out frequent time-series paths that meet the dynamic frequency threshold, including the following steps: (a) Initialize the frequent subgraph mining task based on dynamic frequency threshold, time window constraint and minimum support threshold; (b) Extract all single-sided patterns that satisfy the minimum support threshold from the spatiotemporal threat map as initial frequent patterns; (c) Starting from the initial frequent pattern, add continuous temporal edges to the initial frequent pattern according to the preset pattern growth strategy to generate candidate temporal subgraphs. (d) Statistically analyze the occurrence frequency of candidate time series subgraphs in the spatiotemporal threat map and remove candidate time series subgraphs whose occurrence frequency is lower than the dynamic frequency threshold; (e) Candidate time series subgraphs that appear more frequently than the dynamic frequency threshold are considered as frequently updated patterns; (f) Starting with the frequent update pattern, iterate through steps (c) to (e) until a frequent update pattern that meets the dynamic frequency threshold can no longer be generated.

[0011] In a preferred embodiment, this application can be further configured as follows: the step of generating a penetration test case set through a threat model, and deploying and executing the penetration test case set in a distributed testing environment integrating a dynamic taint tracking engine and a fuzz testing engine, includes the following steps: Analyze the threat model to extract potential cross-device attack paths and their risk priorities; Penetration test cases are generated based on potential cross-device attack paths and their risk priorities. The penetration test cases include the initial device state, operation sequence, and test load required to trigger the potential cross-device attack path. Deploy penetration test cases to a distributed testing environment and configure a dynamic taint tracking engine and a fuzz testing engine; During concurrent execution of penetration test cases, the dynamic taint tracking engine constructs a propagation map of sensitive data streams in real time based on the operation sequence of the penetration test cases. The fuzz testing engine dynamically adjusts its testing priority based on the propagation graph of sensitive data streams.

[0012] In a preferred embodiment, this application can be further configured as follows: the heterogeneous security telemetry data includes data flow paths and abnormal behavior sequences; the step of inputting the heterogeneous security telemetry data output by the dynamic taint tracking engine and the fuzz testing engine into a pre-trained risk identification model, and executing a preset corresponding processing strategy based on the risk judgment information output by the risk identification model, includes the following steps: Spatiotemporal alignment and feature extraction are performed on the data flow path output by the dynamic taint tracking engine and the abnormal behavior sequence output by the fuzz test engine to generate standardized feature vectors; The standardized feature vectors are input into the pre-trained risk identification model, which then classifies the feature vectors and outputs risk assessment information including vulnerability type, risk level, and confidence level. Based on the risk level and vulnerability type, the corresponding handling strategy is matched and triggered from the preset strategy library.

[0013] In a preferred embodiment, this application can be further configured as follows: the step of inputting a standardized feature vector into a pre-trained risk identification model, enabling the risk identification model to classify the feature vector and output risk assessment information including vulnerability type, risk level, and confidence level, includes the following steps: Standardized feature vectors are mapped to a pre-built cybersecurity meta-knowledge graph to query and match known attack patterns, vulnerability features, and system vulnerability entities. Based on the relationships in the network security meta-knowledge graph, potential high-level security threats are inferred, and hypothetical vulnerability types are generated. Calculate the matching degree of known attack patterns and the logical rationality of high-level security threats, and generate risk assessment information based on the calculation results.

[0014] The second objective of this invention is achieved through the following technical solution: A penetration testing system for HarmonyOS mobile applications includes: The data extraction module is used to obtain the current version installation package of the target mobile application, extract static asset data, and run the target mobile application in a preset sandbox environment to capture dynamic behavior data. The model building module is used to build threat models against the HarmonyOS distributed architecture based on static asset data and dynamic behavioral data. The test execution module is used to generate a set of penetration test cases based on the threat model, and to deploy and execute the set of penetration test cases in a distributed test environment that integrates a dynamic taint tracking engine and a fuzz testing engine. The heterogeneous security telemetry data output by the dynamic taint tracking engine and the fuzz test engine are input into the pre-trained risk identification model, and the preset corresponding processing strategy is executed based on the risk judgment information output by the risk identification model. A penetration test report is generated based on the risk assessment information and the results of the execution of the handling strategies.

[0015] In summary, the penetration testing method and system for HarmonyOS mobile applications provided in this application systematically detect cross-device security risks by constructing a threat model for HarmonyOS distributed architecture and integrating dynamic taint tracking and fuzzing techniques. This effectively identifies cross-device security threats in HarmonyOS distributed architecture and improves the comprehensiveness and accuracy of penetration testing. Attached Figure Description

[0016] Figure 1 This is a flowchart of an embodiment of a penetration testing method for HarmonyOS mobile applications according to this application; Figure 2 This is a flowchart of step S10 in an embodiment of a penetration testing method for HarmonyOS mobile applications in this application; Figure 3 This is a flowchart of step S12 in an embodiment of a penetration testing method for HarmonyOS mobile applications according to this application. Detailed Implementation

[0017] The following is in conjunction with the appendix Figures 1-3 This application will be described in further detail.

[0018] In the distributed architecture of mobile operating systems, traditional penetration testing methods are typically designed only for monolithic operating systems. Their detection process is isolated and static, failing to effectively characterize the interaction logic of data and permissions in a dynamic multi-device environment. Furthermore, existing technologies lack the ability to perceive risks across extended attack surfaces such as cross-device communication buses, shared system services, and peripheral connections. This results in potential data leaks and permission boundary breaches going undetected during cross-device calls, even when applications behave normally on a single device. Moreover, this issue prevents security testing from covering new vulnerability patterns in distributed collaborative processes, impacting the comprehensiveness of penetration testing and the effectiveness of system protection mechanisms.

[0019] For example, in the testing scenario of a financial HarmonyOS mobile application, when a user initiates a payment operation through a mobile device and calls the authentication service of a tablet device, traditional penetration testing tools only monitor the behavior within a single device and fail to capture the mobile application's illegal request for biometric permissions from the tablet device during cross-device communication. In this process, the transmission path of permission requests, data flow, and the timing relationship of interactions between devices are not fully recorded, causing permission boundary crossing behavior to be ignored in the test. Specifically, the testing tools only analyze the static permission declarations of the application installation package and cannot associate them with the cross-device call chain during dynamic runtime, resulting in the omission of security vulnerabilities in the device collaboration process.

[0020] If the above issues are not addressed, security threats under the HarmonyOS distributed architecture will remain lurking in the device collaboration and interaction process for a long time, and the system attack surface will continue to expand without effective monitoring. As a result, the security protection mechanisms of mobile applications will be unable to cope with the complex risks in the evolution of "super virtual terminals," and data breaches may occur frequently, seriously damaging user privacy and system integrity. In addition, the coverage deficiencies of traditional test case libraries and vulnerability models will lead to insufficient depth of security testing, making it impossible to discover and deal with new distributed vulnerability patterns in a timely manner.

[0021] In this regard, this application proposes, in one embodiment, as follows: Figure 1 As shown, this application discloses a penetration testing method for HarmonyOS mobile applications, which specifically includes the following steps: S10: Obtain the current version installation package of the target mobile application, extract static asset data, and run the target mobile application in a preset sandbox environment to capture dynamic behavior data; In this embodiment, the target mobile application refers to a mobile application specifically developed and deployed for the HarmonyOS operating system that needs to undergo security penetration testing; static asset data refers to fixed information extracted directly from the application installation package (such as the HarmonyOS HAP package) through decompilation, parsing manifest files, etc., which is independent of program execution. Static asset data includes, but is not limited to, application metadata, component manifest information, permission information, etc.; the sandbox environment refers to the environment used to isolate and run the target mobile application. It can be implemented using virtual machine-based isolation technology or container-based lightweight isolation technology, such as using VirtualBox virtual machine or Docker container. Its main purpose is to capture dynamic behavior data during application execution under secure conditions; dynamic behavior data refers to the real-time interaction records of the target mobile application with the system environment and other devices when it runs in the sandbox cluster. Dynamic behavior data includes, but is not limited to, cross-device communication traffic, system service interaction information, peripheral operation instructions, etc.

[0022] S20: Construct a threat model targeting the HarmonyOS distributed architecture based on static asset data and dynamic behavioral data; In this embodiment, HarmonyOS distributed architecture refers to a virtualized system environment that seamlessly connects various physically independent heterogeneous devices (such as mobile phones, tablets, watches, TVs, speakers, etc.) through a distributed soft bus, enabling hardware capability sharing, seamless data flow, and cross-device application service invocation. Threat model refers to an abstract representation of security risks built for HarmonyOS distributed architecture, which can be implemented using rule-based logical models or statistical clustering models. For example, defining a set of security policy rules or applying the K-means algorithm to identify risk patterns is mainly to characterize potential security threats in cross-device interactions.

[0023] S30: Generate a set of penetration test cases through a threat model, and deploy and execute the set of penetration test cases in a distributed test environment that integrates a dynamic taint tracking engine and a fuzz testing engine; In this embodiment, the penetration test case set refers to an automated test instruction set generated based on a threat model, containing a series of specific test actions, expected goals, and test data. The purpose is to proactively and systematically verify whether the target mobile application has exploitable security vulnerabilities under the HarmonyOS distributed architecture. The dynamic taint tracking engine is a component used to monitor data flow propagation, which can be implemented using code instrumentation or binary rewriting techniques, such as inserting tracing instructions into the application code or modifying executable files. Its main purpose is to detect the propagation path of sensitive data. The fuzzing engine is a component that generates random test inputs, which can be implemented using mutation fuzzing or generative fuzzing methods, such as randomly modifying the content of input files or generating test cases based on syntax structure. Its main purpose is to discover abnormal behavior in the application. The distributed testing environment refers to an integrated testing platform containing multiple types of HarmonyOS device nodes and capable of simulating the HarmonyOS distributed soft bus communication mechanism. In the distributed testing environment, penetration test case sets targeting cross-device security threats can be deployed and executed.

[0024] S40: Input the heterogeneous security telemetry data output by the dynamic taint tracking engine and the fuzz test engine into the pre-trained risk identification model, and execute the preset corresponding processing strategy based on the risk judgment information output by the risk identification model; In this embodiment, heterogeneous security telemetry data refers to the output information from the dynamic taint tracking engine and the fuzz testing engine, which may include system call sequence data and network traffic capture data, such as resource operation logs and communication data packets recorded during application runtime. Its main purpose is to provide multi-dimensional security analysis basis. The pre-trained risk identification model refers to the trained risk classification model, which can be implemented using a neural network model or a decision tree model. For example, a convolutional neural network can be used to process feature vectors or a classification decision tree can be constructed. Its main purpose is to output risk judgment information. The preset corresponding processing strategy refers to the pre-built response rule base, which automatically executes the corresponding processing strategy according to the risk judgment information.

[0025] S50: Generate a penetration test report based on risk assessment information and the execution results of handling strategies.

[0026] In this embodiment, the penetration test report refers to the final output of the intelligent testing process, which is generated based on the risk assessment information and the execution results of the processing strategy (such as whether the vulnerability verification was successful or whether there were any new discoveries in the deep exploration).

[0027] Therefore, this application constructs a threat model by integrating static asset data and dynamic behavioral data, and performs penetration testing in a distributed testing environment. This overcomes the limitations of traditional methods that rely solely on isolated static analysis under the distributed architecture of the HarmonyOS system and cannot detect cross-device interaction security risks, thus enabling the detection of risks such as data leakage and permission boundary crossing.

[0028] Specifically, the process begins by obtaining the current version installation package of the target mobile application and extracting static asset data from it. Simultaneously, the application is run in a pre-defined sandbox environment to capture its dynamic behavior data in a distributed scenario. The static asset data includes the application's code structure and configuration information, while the dynamic behavior data covers key information such as cross-device communication traffic and system service interactions. This data collectively provides multifaceted input for subsequent threat modeling. Furthermore, based on the static asset data and dynamic behavior data, a threat model targeting the HarmonyOS distributed architecture is constructed. This model integrates component declarations, permission requests, and cross-device interaction timing relationships to form a comprehensive understanding of potential threats. A systematic description of security risks is provided. Therefore, a set of penetration test cases is generated by parsing the threat model and deployed and executed in a distributed testing environment integrating a dynamic taint tracking engine and a fuzz testing engine. This allows the testing process to focus on high-risk paths and dynamically adjust testing strategies. Specifically, the dynamic taint tracking engine monitors the propagation of sensitive data streams in real time, while the fuzz testing engine optimizes the generation of test payloads based on the propagation map. The heterogeneous security telemetry data output by both engines is input into a pre-trained risk identification model. The risk identification model classifies the feature vectors and outputs risk judgment information, thereby triggering preset processing strategies and generating a penetration test report.

[0029] For example, when testing a file-sharing application on a HarmonyOS system, the sandbox environment can be specifically implemented as a HarmonyOS device runtime environment based on a QEMU emulator, used to capture the transfer behavior of user files between mobile phones and tablets; when constructing the threat model, the calling relationship between file service components and device permissions is mapped as graph structure nodes and edges; the risk identification model can use a pre-trained support vector machine classifier to determine the vulnerability type of the input standardized feature vector; as a preferred implementation method, this solution, by integrating static and dynamic analysis, can accurately identify hidden data leakage risks in cross-device interactions, avoiding the omission of distributed security threats by traditional single-device testing methods; thus, this technical solution effectively solves the perception limitations of penetration testing under the distributed architecture of HarmonyOS system, achieves comprehensive coverage of security risks in device collaboration links, and ensures that security assessment closely fits the characteristics of distributed architecture.

[0030] Specifically, traditional sandbox environments only simulate single-device scenarios and cannot reproduce the complex interaction logic of multi-terminal collaboration under the distributed architecture of HarmonyOS. This results in dynamic behavior data capture being limited to internal device behavior, missing key link information such as cross-device communication traffic, system service interaction, and peripheral operation, and thus failing to effectively identify potential security risks caused by data flow between devices.

[0031] In this regard, this application further proposes that, in one embodiment, as Figure 2 As shown, step S10 includes: S11: Deploy a preset sandbox environment, which includes a sandbox cluster simulating several HarmonyOS terminal devices; In this embodiment, a sandbox cluster refers to a distributed simulation environment composed of multiple independent sandbox instances, which can be implemented using virtual machine clusters or containerization technology. The purpose is to restore the diversity of device types and collaborative topology relationships in the HarmonyOS system, and avoid the lack of simulation of multi-terminal interaction scenarios in a single-device environment. HarmonyOS terminal devices refer to virtual machine images that are accurately simulated by software in the sandbox environment and have a complete HarmonyOS stack and specific device capabilities. For example, a "watch sandbox" will simulate the small screen, specific sensors and low power consumption characteristics of a watch, while a "smart screen sandbox" will simulate a large screen and stronger media processing capabilities.

[0032] S12: Deploy the target mobile application in the sandbox cluster and simulate user operations, system events, and cross-device service call requests based on static asset data to traverse multiple key execution paths of the target mobile application in the sandbox cluster. In this embodiment, simulating user operations, system events, and cross-device service call requests based on static asset data refers to the automated testing strategy that utilizes a rule engine and a generative model to automatically generate and execute three types of inducing inputs based on static analysis results, thereby proactively triggering the target application's critical execution path in a distributed environment. The critical execution path refers to the code execution flow that can trigger the application's core business logic in a distributed scenario, especially those involving cross-device service calls, sensitive data operations, or permission verification. The critical execution path is the concentration point of security risks. For example, the complete chain of "initiating a print request from the mobile device, calling the printer service, and transmitting print data" is a critical execution path.

[0033] S13: By using probes embedded in the sandbox cluster, monitor and collect multi-link interaction data generated by the target mobile application during operation under multiple key execution paths. The multi-link interaction data includes cross-device communication traffic, system service interaction information, and peripheral operation information. In this embodiment, a probe refers to a non-intrusive data acquisition component embedded in various key layers of the sandbox cluster, such as the underlying communication stack of the distributed soft bus, the system call layer of the operating system, and the application runtime environment. It is used to monitor and replicate all passing interaction data losslessly and with high performance. Multi-link interaction data refers to a multi-dimensional data set that depicts the overall behavior of applications in a distributed environment from multiple different levels. This multi-link interaction data includes cross-device communication traffic, system service interaction information, and peripheral operation information, which can be achieved through network packet capture and system event log aggregation. The purpose is to completely record the temporal characteristics of data flow between devices. Cross-device communication traffic refers to the raw data packets transmitted between sandbox clusters via a simulated distributed soft bus, which is crucial for analyzing man-in-the-middle attacks and protocol vulnerabilities. System service interaction information refers to the detailed sequence and parameters of inter-process communication between applications and HarmonyOS core services (such as account and location services), used to detect privilege escalation vulnerabilities. Peripheral operation instructions refer to the instruction logs of applications attempting to bind, load drivers, and transmit data with virtual peripherals such as printers, used to detect risks such as malicious device spoofing.

[0034] S14: Construct dynamic behavioral data based on multi-link interaction data.

[0035] In this embodiment, dynamic behavior data refers to the structured behavior log formed after parsing, cleaning, associating and time-series processing of the original multi-link interaction data. Furthermore, dynamic behavior data is not the original byte stream, but a standardized data set labeled with semantic information such as "timestamp", "source device", "destination device", "operation type", and "parameter content".

[0036] Specifically, firstly, a distributed testing environment is built by deploying a sandbox cluster, enabling the sandbox cluster to simulate the coexistence of multiple terminal devices in the HarmonyOS system. Then, a target mobile application is deployed within the sandbox cluster, and test sequences of user operations, system events, and cross-device service call requests are generated using structured information from static asset data to systematically trigger multiple key execution paths. During this process, probes embedded in the sandbox cluster monitor the application's running status in real time, collecting multi-link interaction data such as cross-device communication traffic, system service interactions, and peripheral operations. Finally, the collected multi-link interaction data is integrated into structured dynamic behavioral data, forming a behavioral model covering the entire process of data flow between devices. This process, through the distributed characteristics of the sandbox cluster and the driving force of static asset data, achieves complete reproduction and data capture of cross-device interaction logic. For example, as a specific implementation method, the solution of this application is implemented as follows: The sandbox cluster consists of three virtual machines, which respectively simulate three types of HarmonyOS terminal devices: smartphones, tablets, and smartwatches; after deploying the target mobile application in the sandbox cluster, a test sequence containing device switching operations is generated based on the component declaration information in the application configuration file, such as simulating a user initiating a file sharing request from a mobile phone to a tablet; at the same time, probes implemented through eBPF technology are deployed in the kernel layer of each virtual machine to capture inter-device communication traffic and system service call logs in real time; finally, the captured cross-device communication traffic, service binding events, and peripheral operation records are integrated into a dynamic behavior dataset. Through the above technical solution, this application has achieved complete capture of cross-device interaction data under the distributed architecture of HarmonyOS, effectively making up for the blind spot of traditional single-device sandbox in the perception of data flow between devices, providing a dynamic behavioral data foundation covering distributed characteristics for subsequent threat model construction, thereby supporting the accurate identification of cross-device security risks.

[0037] Specifically, in some of the embodiments described above in this application, a method is proposed to deploy the target mobile application in a sandbox cluster and simulate user operations, system events, and cross-device service call requests based on static asset data to traverse critical execution paths. However, in its implementation, there may be a problem that the simulation operation lacks in-depth semantic analysis of the static asset data, making it impossible to systematically identify potential risky interaction interfaces. This results in blind and insufficient test case generation, and in particular, it is difficult to expose high-level security vulnerabilities in the cross-device call chain under the distributed architecture, thus limiting the depth of testing.

[0038] In this regard, this application further proposes that, in one embodiment, as Figure 3 As shown, step S12 includes: S121: Identify component declaration information and permission request information in static asset data, perform semantic analysis, and determine whether there are any potentially risky interaction interfaces; In this embodiment, component declaration information refers to the component types and their configuration parameters defined in the application installation package, which can be implemented by parsing the application manifest file; permission request information refers to the system permission list declared by the application, which can be implemented by statically scanning permission declaration statements; semantic analysis refers to the logical correlation analysis of component declaration information and permission request information, which can be implemented by reasoning methods based on rule engines; potential risk interaction interfaces refer to application components or system service interfaces that may be maliciously exploited, identified through semantic analysis. Their potential risks may stem from highly sensitive permission combinations, cross-device access exposure, or improper interface configuration. For example, a DataAbility that declares high permissions but does not have appropriate access control rules is a typical potential risk interaction interface.

[0039] S122: When there is a potentially risky interaction interface, a corresponding risk test sequence is generated based on the semantic analysis results. The risk test sequence includes a combination of test parameters and a cross-device call chain. In this embodiment, the risk test sequence refers to a set of test cases designed for potential risky interaction interfaces. It can be implemented by generating parameterized test scripts. The risk test sequence includes test parameter combinations and cross-device call chains. The test parameter combinations are the input data injected into the target interface, including normal parameters, boundary values, abnormal parameters, and maliciously constructed serialized data, used to detect defects in the processing logic. The cross-device call chain refers to the complete path that defines the potential risky interaction interface, such as: "Start on device A, execute operation X, and call the target interface Y on device B through the distributed bus".

[0040] S123: Execute risk test sequences in the sandbox cluster and construct corresponding pre-set concurrent pressure scenarios; In this embodiment, the concurrent stress scenario refers to the test conditions that simulate the high load state of a distributed environment, including high concurrent requests, resource contention, or specific timing conditions, which can be achieved by dynamically adjusting the number of concurrent users.

[0041] S124: Monitor and record the abnormal behavior paths of the target mobile application under concurrent pressure scenarios, as the traversal results of the key execution paths.

[0042] In this embodiment, abnormal behavior path refers to the path of the target mobile application that deviates from the normal execution process under pressure, which can be achieved by behavior monitoring log analysis.

[0043] Specifically, firstly, semantic analysis is performed based on static asset data to systematically identify potential risky interaction interfaces, avoiding the randomness of traditional simulation operations. Then, risk test sequences are generated based on the semantic analysis results. These sequences precisely construct test parameter combinations and cross-device call chains, ensuring that testing focuses on high-risk areas. Next, concurrent stress scenarios are dynamically constructed while executing the risk test sequences in a sandbox cluster, simulating high-load conditions in a distributed environment to trigger vulnerabilities such as race conditions or resource conflicts. Finally, abnormal behavior paths are monitored and recorded in real time, forming a complete high-risk path capture chain. The entire process uses semantic analysis to guide the generation of risk test sequences, which in turn drive the construction of concurrent stress scenarios. These scenarios effectively expose deep vulnerabilities in cross-device interactions, collectively improving the accuracy and depth of critical execution path traversal.

[0044] For example, as a preferred embodiment, the solution of this application is implemented as follows: For the installation package of HarmonyOS mobile application, its static asset data is parsed to identify a Service component declared as exportable that requests device location permission, and it is determined to be a potential risky interaction interface through semantic analysis; based on this, a risk test sequence is generated, including simulating cross-device calls to the Service and passing boundary value parameter combinations; when the sequence is executed in the sandbox cluster, high-concurrency requests are simultaneously started to simulate the device cluster load; when the application is detected to have out-of-bounds access behavior under pressure, the abnormal behavior path is recorded as the traversal result of the key execution path.

[0045] Through the above approach, this application systematically identifies potential risky interaction interfaces, enabling test case generation to focus on high-risk areas and effectively expose high-order security vulnerabilities in cross-device call chains under distributed architecture. This improves the coverage depth and accuracy of penetration testing on key execution paths.

[0046] In practical applications, some of the embodiments described above in this application propose to construct a threat model for the HarmonyOS distributed architecture based on static asset data and dynamic behavior data. However, in the implementation process, traditional methods are difficult to effectively model the complex dynamic characteristics of cross-device interactions, which makes it difficult to systematically identify potential attack paths. Furthermore, the threat priority assessment lacks quantitative basis for the correlation between path complexity and sensitive resources, which leads to a serious underestimation of security risks under the distributed architecture.

[0047] In this regard, this application further proposes that, in one embodiment, step S20 includes: S21: Construct an application threat graph, wherein the nodes of the application threat graph include application components, system services, device types, permissions and capabilities, and the edges of the application threat graph include component call relationships, service binding relationships, data flow relationships and permission dependency relationships; In this embodiment, the application threat graph refers to a structured data model used to characterize secure interaction relationships in the HarmonyOS distributed environment. It can be implemented using generalization techniques such as graph databases or adjacency matrices. Specifically, it can store the topological relationships between nodes and edges using the Neo4j graph database. Its purpose is to uniformly describe the association logic of components, services, and resources in cross-device scenarios, avoiding the fragmented analysis of distributed interactions by traditional single-device models. Application components refer to the basic units that constitute an application, such as HarmonyOS's unique PageAbility (interface), ServiceAbility (backend service), and especially ExtensionAbility (extended components for cross-application / cross-device interaction), which are the direct targets of attacks. The entry point; system services refer to the core services provided by HarmonyOS, such as account services, location services, and distributed data management services. Applications need to interact with these services, which may become targets for privilege escalation or data theft; device type refers to the type of device, such as mobile phone, tablet, watch, etc. This node is a critical node, as it extends the traditional single-device threat model to a distributed scenario, clarifying the device boundaries that attack paths may cross; permissions and capabilities refer to the system permissions and hardware capabilities declared by the application, which are the ultimate goal (privilege escalation) or means (capability abuse) pursued by attackers; component call relationships describe the calls between components within an application or across applications, such as a PageAbility starting another Service. Ability: This edge may form part of an attack chain; Service binding relationship refers to the dependency relationship between application components and system services. For example, if an application component is bound to a location service, this edge identifies a potential data leakage risk point; Data flow relationship refers to the key edge describing the flow path of sensitive data (such as user contacts) within the application and across devices, which is the core of discovering data leakage vulnerabilities; Permission dependency relationship refers to the permission required to perform an operation or access a resource. For example, a component node is connected to a "read SMS" permission node through a "permission dependency" edge, which helps to analyze permission abuse.

[0048] S22: Map static asset data and dynamic behavior data to nodes and edges of an application threat graph, and identify subgraph structures with high connectivity through a preset graph mining algorithm. The subgraph structures represent potential cross-device attack paths. In this embodiment, mapping static asset data and dynamic behavioral data to nodes and edges in an application threat graph can be understood as the process of transforming multi-source heterogeneous data into graph structure elements. This can be achieved using a data parsing engine combined with rule matching, such as extracting permission declarations from the installation package as node attributes using regular expressions, or using an event log parser to transform cross-device communication traffic into time-series edges. The purpose is to integrate static structural information with dynamic runtime behavior to provide a complete data foundation for threat modeling. The preset graph mining algorithm refers to the technical means used to analyze graph structure features to discover key subgraphs. It can be implemented using community discovery algorithms or spectral clustering, for example, based on... The modularity-optimized Louvain algorithm identifies highly connected subgraphs, aiming to quickly locate weak links in frequently interacting distributed environments without relying on specific temporal constraints. In graph theory, a highly connected subgraph structure refers to a region in a graph where nodes are closely connected. In the security context, this means that there are frequent and complex interactions between these nodes (components, services, devices). Potential cross-device attack paths refer to the specific security threats represented by highly connected subgraph structures. Potential cross-device attack paths clearly show how an attacker starts from a certain entry point on a certain device, and through a series of cross-device calls and data flows, ultimately reaches sensitive resources on the target device.

[0049] S23: Identify the complexity of potential cross-device attack paths and their associated sensitive resources, determine threat priorities based on complexity and sensitive resources, and build a threat model.

[0050] In this embodiment, the complexity of a potential cross-device attack path refers to a quantitative indicator of the path topology, which can be characterized by generalized parameters such as path length, number of device jumps, or call depth. For example, the complexity can be assessed by calculating the number of device types involved in the path, with the aim of objectively reflecting the implementation difficulty and coverage of the attack path. Associated sensitive resources refer to high-value data or system capabilities related to path interaction, which can be implemented using resource classification tags or sensitivity scoring mechanisms. For example, user identity information can be marked as a highly sensitive resource, with the aim of establishing a correlation mapping between path risk and resource value to support the objectivity of priority decision-making. Threat priority refers to the comprehensive risk level (such as high, medium, or low) calculated for each identified potential cross-device attack path based on path complexity and associated sensitive resources, used to ensure that testing resources are preferentially concentrated on dangerous threats.

[0051] Specifically, firstly, an application threat graph is constructed to establish a unified representation framework for distributed interactions. Nodes encompass key entities such as application components and system services, while edges describe call relationships and data flows, thus comprehensively depicting the topology of inter-device communication. Based on this, static asset data is mapped to the static structure of the graph, and dynamic behavioral data is transformed into dynamic edge attributes, achieving a fusion representation of multi-source data. Further, graph mining algorithms are used to perform structural analysis on the fused graph, identifying highly connected subgraphs as candidate sets of potential attack paths. This process utilizes subgraph connectivity indicators to reflect the pivotal role of paths in the distributed environment. Finally, a quantitative assessment is performed by combining path complexity indicators with the correlation of sensitive resources. For example, the number of device hops is weighted with the resource sensitivity level to generate hierarchical threat priorities, enabling the threat model to dynamically adapt to the real-time collaborative changes of the HarmonyOS architecture, forming a complete technical chain from data integration to risk quantification.

[0052] For example, as a specific implementation method, the solution of this application is implemented as follows: When testing a HarmonyOS video sharing application, the application threat graph is constructed by taking the application's playback component and background service as nodes, the device type node covering mobile phones and smart screens, the permission node marked as "location information access", and the edge relationship reflecting the component call chain and cross-device data flow; when mapping static asset data, the permission declaration is obtained by parsing the manifest file of the installation package as node attributes, and the video stream transmission events from smart screens to mobile phones captured during sandbox operation are converted into data flow edges; the community detection algorithm is used to analyze the graph, identify the highly connected subgraph composed of location service components, mobile device nodes and cross-device call edges, and determine it as a potential attack path; when evaluating the complexity of the path, it is counted that there are 3 types of device jumps and 2 service bindings involved, and the associated sensitive resource is user location information. Based on this, the threat priority is marked as high risk level, and finally a threat model focusing on the path is generated.

[0053] Through the above technical solutions, this application has achieved a systematic modeling of cross-device security risks under the HarmonyOS distributed architecture. It can accurately identify potential attack paths that are difficult to detect by traditional methods, and establish an objective threat priority assessment mechanism based on the quantitative correlation between path complexity and sensitive resources. This effectively avoids the underestimation of distributed security risks and significantly improves the penetration testing coverage depth and risk location capabilities of device collaboration.

[0054] In some of the embodiments described above in this application, a method is proposed to map static asset data and dynamic behavior data into an application threat graph and identify subgraph structures with high connectivity to characterize potential cross-device attack paths. However, in its implementation, there is a problem that the application threat graph is constructed only based on a static structure, ignoring the temporal relationship of cross-device interaction events. This may lead to difficulty in accurately capturing the dynamic attack path characteristics in a distributed environment, thus limiting the threat model's coverage of real attack scenarios.

[0055] In this regard, this application further proposes that, in one embodiment, step S22 includes: S221: Extract cross-device interaction events from dynamic behavior data, identify the temporal relationship of cross-device interaction events, and construct an interaction event sequence based on the temporal relationship; In this embodiment, a cross-device interaction event refers to a discrete operation record captured by a probe in a distributed testing environment, in which a target application is triggered on one HarmonyOS device instance and causes communication or collaboration with another device instance. For example, "Application component X on device A requests to bind service Y on device B" is an interaction event. The temporal relationship refers to the order, causal dependency, or time interval relationship between different cross-device interaction events. For example, the event "Device A calls the service of device B" must occur after the event "The service on device B is successfully bound". The interaction event sequence refers to the timeline and ordered event chain formed by sorting and connecting multiple extracted cross-device interaction events according to their actual temporal relationship. For example: Event 1: Binding service, Event 2: Sending data, Event 3: Performing operation.

[0056] S222: Map static asset data to the static structure of the application threat graph, and transform the sequence of interactive events into time-stamped temporal edges in the application threat graph to construct a spatiotemporal threat graph; In this embodiment, temporal edges refer to an enhanced type of edge in the application threat graph. They not only represent connection relationships but also include timestamp information, recording the specific time or sequence of interactions. The spatiotemporal threat graph is a dynamic graph structure in which nodes represent system entities, and edges (especially temporal edges) not only describe the structural relationships between entities but also imply the evolution of interaction behavior over time. The spatiotemporal threat graph integrates information from two dimensions: "space" (system topology) and "time" (behavioral sequence).

[0057] S223: Execute a frequent subgraph mining algorithm on the spatiotemporal threat map. The execution process of the frequent subgraph mining algorithm includes: obtaining a dynamic frequency threshold, setting time window constraints and minimum support threshold, generating candidate time-series subgraphs through a preset pattern growth strategy, and iteratively filtering out frequent time-series paths that meet the dynamic frequency threshold. In this embodiment, the frequent subgraph mining algorithm refers to an algorithm used to automatically discover common substructures or patterns with a frequency higher than a predetermined threshold from a large graph. It is used to find common and suspicious interaction patterns in a spatiotemporal threat graph. The dynamic frequency threshold refers to a screening criterion that is adaptively adjusted according to fluctuations in the testing environment. It can be implemented using a sliding window statistical model based on historical telemetry data or a real-time resource load feedback mechanism. For example, a value can be dynamically set based on historical test data or the baseline of overall interactions. Only patterns with a frequency higher than this value are considered "frequent," aiming to avoid the insufficient adaptability of fixed thresholds in complex distributed scenarios. The time window constraint refers to the time range restriction applied when performing temporal pattern mining on the spatiotemporal threat graph. It stipulates that only a series of interaction events occurring within a specific time length can be considered a complete and meaningful pattern. For example, setting the time window to 30 seconds means that when the algorithm judges whether a path consisting of events A, B, and C is "frequent," it will only count sequences of events A, B, and C occurring consecutively within any 30-second period, while other sequences will be excluded. Sequences of identical events spanning several hours are ignored; the minimum support threshold refers to the frequency statistics threshold, which defines how many times a specific pattern (such as a candidate temporal subgraph) must occur in the entire dataset (or within a time window) to be considered "frequent"; the pre-defined pattern growth strategy refers to the method of expanding candidate subgraphs. This strategy starts with small, simple frequent patterns (such as a single edge) and generates larger candidate subgraphs by gradually adding new edges or nodes. Then, it verifies whether these larger subgraphs are still frequent, aiming to reduce the computational complexity of high-dimensional graphs and focus on critical paths; a candidate temporal subgraph refers to a temporal subgraph pattern that is temporarily generated and awaits verification during the iteration of the frequent subgraph mining algorithm. It is a larger graph structure that has not yet been frequency verified, expanded from a known small frequent pattern according to the pattern growth strategy; a frequent temporal path refers to a path in the spatiotemporal threat graph that satisfies the time window constraint and has a frequency exceeding the dynamic frequency threshold, consisting of temporal edges. Typically, a frequent temporal path is a "common" interaction chain that occurs in a specific time sequence.

[0058] S224: Identify the candidate time-series subgraphs corresponding to the selected frequent time-series paths as potential cross-device attack paths.

[0059] In this embodiment, a potential cross-device attack path refers to a subgraph structure that is identified as a frequent temporal path and judged to have a high potential risk based on security knowledge (such as the permissions and data sensitivity involved in the path).

[0060] Specifically, by extracting the temporal relationships of cross-device interaction events to construct an interaction event sequence, static asset data is mapped to a static graph structure, while the event sequence is transformed into time-stamped temporal edges, forming a spatiotemporal threat graph that simultaneously contains node relationships and temporal evolution characteristics. Based on this, dynamic frequency thresholds and time window constraints are used to adjust parameters in the frequent subgraph mining process. A pattern growth strategy is used to gradually expand candidate temporal subgraphs and iteratively filter high-frequency paths, ultimately identifying frequent temporal paths that meet the dynamic frequency threshold as potential cross-device attack paths. This process ensures that the threat model can realistically simulate the continuous process of cross-device data flow, making the mining results closely correlated with dynamically changing attack vectors in the distributed environment, thus overcoming the lack of temporal dependency characterization in static graphs.

[0061] As a specific implementation method, when testing a HarmonyOS distributed application, the timing relationship of device A sending a message to device B and triggering device B to call system services is first identified from dynamic behavior data, constructing an interaction event sequence of "device A → device B → service C". Then, application component declarations are mapped as graph nodes, and the event sequence is transformed into time-stamped time-series edges, forming a spatiotemporal threat graph containing the time dimension. Next, a time window of 5 seconds and a minimum support of 3 times are set, and a candidate time-series subgraph is generated through a graph isomorphism-based edge expansion algorithm. The frequency threshold is dynamically adjusted according to the load status of the real-time test environment, and frequent paths such as "device A → device B → service C → peripheral D" are iteratively selected. Finally, this path is identified as a potential cross-device attack path and included in the threat model.

[0062] Through the above technical solutions, this application can accurately capture the dynamic attack path characteristics in a distributed environment, enabling the threat model to truly reflect the continuous process of cross-device data flow, effectively solving the problem that static graphs cannot depict the timing dependency of operations between devices, and significantly improving the detection coverage of vulnerabilities unique to distributed architectures.

[0063] Specifically, in some of the embodiments described above in this application, a frequent subgraph mining algorithm is proposed to identify potential cross-device attack paths by performing a spatiotemporal threat graph. However, in its implementation, there is a problem that the algorithm's execution process depends on static thresholds and fixed parameter settings, and it cannot dynamically adapt to the frequency fluctuations and time window changes of cross-device interaction events in the HarmonyOS distributed architecture. This results in a large amount of noise or omission of critical paths in the attack paths identified in complex multi-device environments, affecting the accuracy of the threat model and the testing efficiency.

[0064] In this regard, this application further proposes that, in one embodiment, step S223 includes: (a) Initialize the frequent subgraph mining task based on dynamic frequency threshold, time window constraint and minimum support threshold; (b) Extract all single-sided patterns that satisfy the minimum support threshold from the spatiotemporal threat map as initial frequent patterns; (c) Starting from the initial frequent pattern, add continuous temporal edges to the initial frequent pattern according to the preset pattern growth strategy to generate candidate temporal subgraphs. (d) Statistically analyze the occurrence frequency of candidate time series subgraphs in the spatiotemporal threat map and remove candidate time series subgraphs whose occurrence frequency is lower than the dynamic frequency threshold; (e) Candidate time series subgraphs that appear more frequently than the dynamic frequency threshold are considered as frequently updated patterns; (f) Starting with the frequent update pattern, iterate through steps (c) to (e) until a frequent update pattern that meets the dynamic frequency threshold can no longer be generated.

[0065] In this embodiment, the dynamic frequency threshold refers to the frequency judgment benchmark that is dynamically adjusted according to the actual distribution of cross-device interaction events in the spatiotemporal threat graph. It can be implemented using a sliding window statistical method based on historical interaction data or an adaptive algorithm based on the current test environment load. Its purpose is to avoid misjudgment problems caused by fixed thresholds in dynamic multi-device environments. The time window constraint refers to the time range boundary for limiting the temporal relationship of cross-device interaction events. It can be implemented using a dynamic window adjustment mechanism based on the communication delay characteristics between devices or a preset time interval based on business scenario requirements. Its purpose is to ensure that the identified attack path conforms to the actual time logic of device collaboration. The minimum support threshold refers to the lower limit of support for determining whether a single side has sufficient statistical significance. It can be implemented using a percentage threshold based on the graph size or an empirical value based on historical threat data. Its purpose is to filter out low-frequency noise edges and ensure the reliability of the initial frequent pattern. The initial frequent subgraph mining task refers to the task of initializing the key points required for the entire mining process before the algorithm starts the actual search. The preparatory work of configuring key parameters and setting the initial state lays the foundation for subsequent iterative calculations. The preset pattern growth strategy refers to the set of rules used to expand the initial frequent patterns to generate more complex paths. It can be implemented by a depth-first expansion strategy based on graph structure features or a breadth-first expansion strategy based on threat priority. Its purpose is to efficiently explore the potential cross-device attack path space. The initial frequent patterns refer to the set of basic temporal edges that meet the minimum support threshold. They can be implemented by a single edge or a simple path. Their purpose is to provide a high-confidence starting point for the construction of subsequent complex paths. The candidate temporal subgraph can be understood as the substructure that may represent attack paths in the spatiotemporal threat graph. It can be represented by a directed temporal graph or a weighted temporal network. Its purpose is to serve as a candidate set of potential attack paths for further screening. The frequently updated patterns refer to the set of high-frequency paths that are continuously optimized during the iteration process. They can be implemented by incremental updates or batch updates. Their purpose is to gradually approach the real threat paths and avoid the rigidity problem of static models.

[0066] Specifically, the proposed solution utilizes dynamic parameters and an iterative optimization mechanism to enable the frequent subgraph mining algorithm to adapt to the real-time changes in interactive events within the HarmonyOS distributed architecture. First, the mining task is initialized based on dynamic frequency thresholds, time window constraints, and minimum support thresholds, eliminating reliance on fixed thresholds and allowing for dynamic adjustment of the identification benchmark according to fluctuations in actual threat data. Then, a single edge satisfying the minimum support threshold is extracted from the spatiotemporal threat graph as the initial frequent pattern, ensuring the reliability of the basic path and providing a high-confidence starting point for subsequent complex path construction. Based on this, starting with the initial frequent pattern, continuous temporal edges are added to the initial frequent pattern according to a preset pattern growth strategy to generate candidate edges. The temporal subgraph, an extension method based on temporal dependencies, fully leverages the temporal characteristics of cross-device interactions to accurately capture the continuity of call chains between devices. Next, frequency statistics are performed on candidate temporal subgraphs, and dynamic frequency thresholds are used for filtering, effectively eliminating low-frequency noise paths and focusing on high-frequency key events. Then, the high-frequency candidate subgraphs are used as frequently updated patterns, allowing the algorithm to continuously optimize the identification results during iteration, gradually approaching the actual threat paths. Finally, by iteratively executing pattern growth, frequency statistics, and pattern updates until convergence, the stability and integrity of the algorithm in dynamic environments are ensured, adapting to the real-time changes in device collaborative interactions within the HarmonyOS system, ultimately achieving efficient and accurate identification of potential cross-device attack paths.

[0067] For example, as a specific implementation method, the solution of this application is implemented as follows: During the penetration testing of HarmonyOS mobile applications, after constructing the spatiotemporal threat graph, a dynamic frequency threshold is first obtained. This dynamic frequency threshold is dynamically calculated based on the historical frequency distribution of cross-device interaction events in the current test environment. Simultaneously, a time window constraint is set to the typical latency range of inter-device communication, and the minimum support threshold is set to 5% of the total number of edges in the graph. After initializing the frequent subgraph mining task, all single edges whose occurrence frequency exceeds the minimum support threshold are extracted from the spatiotemporal threat graph, such as "device A sends an authentication request to device B," as initial frequent patterns. Starting from these initial frequent patterns, continuous temporal edges are added to each initial frequent pattern according to a depth-first pattern growth strategy, for example, in... After "Device A sends an authentication request to Device B", add "Device B forwards the authentication token to Device C" to generate candidate time-series subgraphs. Statistical analysis is performed on the frequency of all candidate time-series subgraphs, removing those with frequencies below the dynamic frequency threshold, such as abnormal paths appearing only 1-2 times. Candidate time-series subgraphs with frequencies above the dynamic frequency threshold are identified as frequently updated patterns, such as the authentication path "Device A → Device B → Device C". Starting with these frequently updated patterns, iterative execution of pattern growth, frequency statistics, and pattern updates continues until no new frequently updated patterns satisfying the dynamic frequency threshold can be generated. Finally, the frequently occurring cross-device authentication chain "Device A → Device B → Device C → Device D" is identified as a potential attack path. This path appears frequently in the test environment and meets the time window constraint, thus being judged as a high-risk path.

[0068] Through the above solution, this application can dynamically adapt to the frequency fluctuations and time window changes of cross-device interaction events in the HarmonyOS distributed architecture, effectively reduce noise interference in the identified attack paths, avoid omissions of critical paths, thereby improving the accuracy of threat models and the efficiency of penetration testing, and ensuring accurate identification of potential security threats in complex multi-device environments.

[0069] In some of the embodiments described above in this application, a set of penetration test cases is generated by a threat model and executed in a distributed environment. However, in its implementation, there may be problems such as insufficient coverage of key cross-device attack paths due to insufficient consideration of risk priority in test case generation, and the lack of a real-time coordination mechanism between dynamic taint tracking and fuzz testing engine, which makes it impossible to dynamically optimize the test strategy according to changes in data flow, thus making it difficult to effectively detect security vulnerabilities in a distributed architecture.

[0070] In this regard, this application further proposes that, in one embodiment, step S30 includes: S31: Analyze the threat model and extract potential cross-device attack paths and their risk priorities; In this embodiment, potential cross-device attack paths refer to the interaction paths that may be maliciously exploited when data or permissions are transmitted across devices in the HarmonyOS distributed architecture. These paths can be implemented using inter-device communication protocol analysis or permission dependency graph construction techniques, with the aim of accurately locating high-risk areas to improve the targeting of tests. Risk priority refers to the test order indicators based on the severity of vulnerabilities, the scope of impact, and historical attack data. Specifically, these can be dynamically generated through an expert scoring system or machine learning model, with the aim of guiding test resources to prioritize covering critical paths.

[0071] S32: Generate penetration test cases based on potential cross-device attack paths and their risk priorities. The penetration test cases include the initial device state, operation sequence, and test load required to trigger the potential cross-device attack path. In this embodiment, a penetration test case refers to a carrier that transforms an abstract threat path into specific, automatically executable instructions. It is no longer descriptive text, but rather a structured, machine-readable script or data object. A penetration test case includes the initial device state, operation sequence, and test payload required to trigger the potential cross-device attack path. The initial device state refers to the preset network, service, and data environment states required for each simulated device (such as a mobile phone or watch) in the sandbox cluster at the start of the test; this is a prerequisite for accurately reproducing the attack path. The operation sequence refers to a complete set of steps simulating an attacker or a normal user, defining in detail which device, what operation, and in what order, for example: "Start the application on device A → Click button X → Call service Y on device B via the distributed bus." The test payload refers to the test data injected into the target, specifically abnormal parameters and maliciously constructed serialized data, used to probe the target's behavior when processing abnormal input.

[0072] S33: Deploy penetration test cases to a distributed testing environment and configure a dynamic taint tracking engine and a fuzz testing engine; In this embodiment, configuring the dynamic taint tracking engine and the fuzzing engine means setting a collaborative working strategy and initial parameters for the dynamic taint tracking engine and the fuzzing engine based on specific penetration test cases.

[0073] S34: Concurrent execution of penetration test cases. During execution, the dynamic taint tracking engine constructs a propagation map of sensitive data flow in real time based on the operation sequence of the penetration test cases. In this embodiment, the operation sequence of a penetration test case refers to an automated instruction flow with clear timing and logical relationships designed to trigger a specific potential cross-device attack path; the propagation graph of sensitive data flow refers to a graphical representation of data dependencies, such as using a graph database to store nodes and edges to map data flow trajectories, with the aim of providing the test engine with fine-grained visualization of data flow direction.

[0074] S35: The fuzz testing engine dynamically adjusts its testing priority based on the propagation graph of sensitive data streams.

[0075] In this embodiment, dynamically adjusting test priority means that the fuzzing engine no longer tests in a fixed or random order, but intelligently determines which target should be tested next based on real-time information from the propagation graph of the sensitive data flow. Further, the adjustment methods may include: prioritizing attacks on data processing nodes: if the graph shows that the sensitive data flow has passed through a certain component or interface, the fuzzing engine will immediately raise its test priority to the highest level and concentrate the attack; ignoring irrelevant paths: for interfaces not touched by the sensitive data, their priority is reduced to save test resources.

[0076] Specifically, firstly, high-risk cross-device attack paths are extracted by analyzing the threat model to ensure that test case generation focuses on key vulnerability scenarios; then, a dynamic taint tracking engine and a fuzz testing engine are deployed and configured in a distributed testing environment to form an information feedback loop; when test cases are executed concurrently, the dynamic taint tracking engine constructs a propagation graph of sensitive data streams in real time based on the operation sequence. This propagation graph serves as a dynamic input to drive the fuzz testing engine to adjust test priorities in real time, thereby continuously concentrating test resources on high-risk data stream paths and achieving adaptive optimization of the test strategy. For example, as a specific implementation method, the solution of this application is implemented as follows: When testing a HarmonyOS video sharing application, the threat analysis model identifies a high risk in the video stream transmission path between the mobile phone and the smart screen, and generates test cases including simulating abnormal video data input and cross-device permission call sequences; after deployment, it is executed concurrently, and the dynamic taint tracking engine records the flow trajectory of video data from the mobile phone to the smart screen in real time and constructs a propagation map. Based on this, the fuzzy testing engine dynamically increases the testing intensity of the video encoding and decoding module, while reducing the testing frequency of the low-risk audio module. Through the above solution, this application effectively improves the test coverage of key cross-device attack paths, avoids the ineffective consumption of test resources in low-risk areas, and realizes the dynamic optimization of test strategies as data flow changes through the real-time collaborative mechanism of dynamic taint tracking and fuzz testing engine, thereby significantly enhancing the detection capability of security vulnerabilities under the HarmonyOS distributed architecture.

[0077] Specifically, in some of the embodiments described above in this application, a method is proposed to input heterogeneous security telemetry data output by a dynamic taint tracking engine and a fuzz test engine into a pre-trained risk identification model and execute a preset corresponding processing strategy based on the risk judgment information output by the risk identification model. However, in its implementation, heterogeneous security telemetry data (including data flow paths and abnormal behavior sequences) may be unable to be effectively integrated when directly input into the model due to differences in source, format, and timing, resulting in inaccurate risk judgment information and thus affecting the accurate matching and execution of the processing strategy.

[0078] In this regard, this application further proposes that, in one embodiment, the heterogeneous security telemetry data includes a data flow path and an abnormal behavior sequence, and step S40 includes: S41: Perform spatiotemporal alignment and feature extraction on the data flow path output by the dynamic taint tracking engine and the abnormal behavior sequence output by the fuzz test engine to generate a standardized feature vector; In this embodiment, heterogeneous security telemetry data refers to security monitoring data from different sources with varying formats and semantics. Specifically, it refers to data flow paths and abnormal behavior sequences. Data flow paths are structured path information, while abnormal behavior sequences include unstructured logs and crash reports. Spatiotemporal alignment and feature extraction refer to the process of synchronizing time and extracting key attributes from cross-device security event sequences. This can be achieved using timestamp-based sliding window alignment algorithms or dynamic time warping techniques. The aim is to eliminate device clock deviations in a distributed environment and extract core security-related features. Standardized feature vectors can be understood as transforming heterogeneous data into a unified-dimensional numerical representation. This can be achieved using normalization processing or vector embedding techniques. The aim is to ensure the structural consistency of the risk identification model input.

[0079] S42: Input the standardized feature vector into the pre-trained risk identification model, so that the risk identification model can classify the feature vector and output risk judgment information including vulnerability type, risk level and confidence level; In this embodiment, the risk identification model is specifically a pre-trained classification model, which can be implemented using convolutional neural networks or ensemble learning algorithms. Its purpose is to accurately classify security features in multiple dimensions. The risk assessment information refers to the output of the risk identification model, which includes vulnerability type, risk level, and confidence level. The vulnerability type refers to the vulnerability category determined by the model, such as "buffer overflow," "privilege escalation," or "data breach." The risk level refers to the quantitative assessment of the vulnerability severity, such as "high," "medium," or "low." The confidence level refers to the model's degree of certainty about the assessment result, which is usually a probability value (such as 95%), providing an important uncertainty reference for subsequent decisions.

[0080] S43: Based on the risk level and vulnerability type, match and trigger the corresponding handling policy from the preset policy library.

[0081] In this embodiment, the preset strategy library refers to a set of rules that stores preset processing strategies. It can be implemented using a decision tree or a rule engine, with the aim of quickly matching the corresponding security response measures based on risk assessment information.

[0082] Specifically, firstly, the data flow path output by the dynamic taint tracking engine and the abnormal behavior sequence output by the fuzzing engine are spatiotemporally aligned. Time stamp calibration is used to eliminate clock deviations between devices. At the same time, security features such as key nodes of data flow and abnormal behavior patterns are extracted to generate standardized feature vectors with a unified structure. Subsequently, the standardized feature vectors are input into a pre-trained risk identification model. The risk identification model classifies based on the multi-dimensional attributes of the feature vectors and outputs complete risk judgment information including vulnerability type, risk level, and confidence level. Finally, based on the combination of risk level and vulnerability type, the corresponding processing strategy is precisely matched from the policy library and triggered to achieve automation and precision in security response.

[0083] For example, as a specific implementation method, the solution of this application is implemented as follows: When the dynamic taint tracking engine detects the data flow path of sensitive data from the smartwatch to the smartphone, and at the same time the fuzz testing engine captures the abnormal behavior sequence of permission overreach on the smartphone, the two event sequences are first aligned according to the timestamp to eliminate the clock difference between devices. Then, the key nodes and abnormal behavior pattern features in the data flow path are extracted to generate a standardized feature vector. This feature vector is input into the risk identification model based on deep learning. The model identifies that the scenario belongs to a cross-device permission escalation vulnerability with a high risk level and a confidence level of 0.95. Then, the processing policy of "immediately isolate the device connection and notify the user" is matched from the policy library and executed automatically.

[0084] Through the above solution, this application effectively solves the integration problem caused by the differences in the sources of heterogeneous security telemetry data, ensures the accuracy of risk assessment information, and thus achieves accurate matching and efficient execution of processing strategies, significantly improving the security response capability of penetration testing in the distributed environment of HarmonyOS.

[0085] In some of the embodiments described above in this application, a standardized feature vector is input into a risk identification model to output risk judgment information for identifying security vulnerabilities. However, in its implementation, there may be a problem that the risk identification model relies solely on the direct classification of feature vectors, making it difficult to effectively uncover high-level security threats caused by cross-device interaction under the HarmonyOS distributed architecture. Due to the complexity of device collaboration in a distributed environment, traditional models are unable to correlate known attack patterns with potential system weaknesses, resulting in risk judgment information being limited to surface vulnerability types and unable to infer hypothetical vulnerabilities caused by permission boundary crossings or abnormal data flows, thus missing deep risks in distributed attack paths.

[0086] In this regard, this application further proposes that, in one embodiment, step S42 includes: S421: Map standardized feature vectors to a pre-built network security meta-knowledge graph to query matching known attack patterns, vulnerability features, and system vulnerability entities; In this embodiment, the network security meta-knowledge graph refers to a semantic network that stores structured knowledge in the field of network security. It can be implemented using a graph database or a triplet knowledge base. Its purpose is to establish logical connections between attack patterns, vulnerability features, and system weaknesses through explicit expression of entities and relations, providing traceable contextual basis for risk identification. Known attack patterns refer to abstract attack methodologies, such as "phishing," "man-in-the-middle attack," and "buffer overflow attack," which describe "how to attack" rather than specific attack instances. Vulnerability features refer to the general characteristic signatures of a certain type of vulnerability, such as "unverified user input exists" or "insecure encryption algorithm is used." System weakness entities refer to inherent defects in the design or implementation of the system, which are the root causes of vulnerabilities.

[0087] S422: Based on the relationships in the network security meta-knowledge graph, infer possible high-level security threats and generate hypothetical vulnerability types; In this embodiment, the association relationship refers to the relationship represented by the edges connecting different entities in the network security meta-knowledge graph, such as: "Attack mode A can exploit system weakness B", "Vulnerability feature C is a typical manifestation of attack mode D", "System weakness E can lead to security consequences F", etc.; reasoning means that the risk identification model is no longer satisfied with finding direct matches, but performs logical deduction based on the association relationships between entities in the knowledge graph, thereby discovering potential complex threats that have not been directly observed, simulating the analytical thinking of security experts; high-order security threat reasoning refers to the deduction process based on the implicit logical chains between entities in the knowledge graph, which can be implemented using rule-based reasoning engines or graph neural networks. Its purpose is to break through the limitations of static feature classification and actively identify complex vulnerabilities caused by permission dependency anomalies or data flow conflicts in cross-device interactions; hypothetical vulnerability type refers to the preliminary judgment about what kind of vulnerability may exist, derived through reasoning. For example, the reasoning result may be "hypothetically, there is a deserialization vulnerability that may lead to remote code execution".

[0088] S423: Calculate the matching degree of known attack patterns and the logical rationality of high-level security threats, and generate risk assessment information based on the calculation results.

[0089] In this embodiment, the matching degree and logical rationality calculation refer to the quantitative evaluation of the degree of adaptation to known attack patterns and the credibility of inferred threats. It can be implemented by weighted similarity algorithm or probabilistic inference model. Its purpose is to balance the judgment weight of historical experience and innovative threats through a dual verification mechanism, so as to avoid misjudgment or omission caused by single-dimensional analysis.

[0090] Specifically, the process begins by mapping standardized feature vectors to a pre-built cybersecurity meta-knowledge graph. This involves querying and matching known attack patterns, vulnerability characteristics, and system vulnerability entities. This step uses semantic parsing to transform discrete feature data into nodes and edges in the knowledge graph, establishing connections with historical security events. Subsequently, based on these connections in the cybersecurity meta-knowledge graph, potential high-order security threats are inferred, and hypothetical vulnerability types are generated. This step utilizes the topological paths and logical constraints between entities in the graph to simulate an attacker's perspective, deduce abnormal combinations of cross-device service call chains and data flows, and proactively predict deep-seated risks. Finally, the matching degree of known attack patterns and the logical rationality of high-order security threats are calculated, and risk assessment information is generated based on the results. This step quantitatively analyzes the adaptability of known patterns and the credibility of inferred threats to achieve a comprehensive judgment of vulnerability type, risk level, and confidence level. This process, through a knowledge-driven reasoning mechanism, upgrades the static classification of feature vectors to dynamic threat inference, effectively bridging the cognitive gaps in complex interaction logic encountered by traditional models in distributed architectures.

[0091] For example, as a specific implementation method, the solution of this application is implemented as follows: When penetrating a cross-device file-sharing application, the risk identification model receives the data flow path feature vector output by the dynamic taint tracking engine, maps it to a pre-built network security meta-knowledge graph, queries known attack pattern nodes related to "permission boundary crossing" and system weakness entities of "device authentication service"; based on the correlation between "file service call" and "permission verification missing" in the graph, infers the hypothetical vulnerability type of "device A accesses device B's storage space by forging a service token without authorization"; calculates the matching degree between the attack pattern and the feature vector as 0.85, and evaluates the logical rationality of the hypothetical vulnerability as 0.78, and finally generates risk judgment information containing the "privilege escalation vulnerability" type, "high" risk level and "0.82" confidence level.

[0092] Through the above technical solutions, this application can transform isolated feature data into a traceable entity relationship network based on the structured semantic association of network security meta-knowledge graphs, accurately locate permission dependency vulnerabilities unique to distributed architectures; by mining the implicit logical chains between entities, it can proactively deduce potential attack paths not covered by existing test cases, significantly improving the ability to discover hidden vulnerabilities; by quantitatively analyzing the adaptability of known patterns and the credibility of inferred threats, it ensures that the output risk assessment information not only conforms to security specifications but also reflects the logical vulnerabilities unique to distributed architectures, effectively solving the problem of insufficient identification of high-level security threats in cross-device interaction of HarmonyOS.

[0093] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0094] In one embodiment, a penetration testing system for HarmonyOS mobile applications is provided, which corresponds one-to-one with a penetration testing method for HarmonyOS mobile applications described in the above embodiments. The penetration testing system for HarmonyOS mobile applications includes: The data extraction module is used to obtain the current version installation package of the target mobile application, extract static asset data, and run the target mobile application in a preset sandbox environment to capture dynamic behavior data. The model building module is used to build threat models against the HarmonyOS distributed architecture based on static asset data and dynamic behavioral data. The test execution module is used to generate a set of penetration test cases based on the threat model, and to deploy and execute the set of penetration test cases in a distributed test environment that integrates a dynamic taint tracking engine and a fuzz testing engine. The heterogeneous security telemetry data output by the dynamic taint tracking engine and the fuzz test engine are input into the pre-trained risk identification model, and the preset corresponding processing strategy is executed based on the risk judgment information output by the risk identification model. A penetration test report is generated based on the risk assessment information and the results of the execution of the handling strategies.

[0095] For specific limitations regarding a penetration testing system for HarmonyOS mobile applications, please refer to the limitations of a penetration testing method for HarmonyOS mobile applications described above, which will not be repeated here. The modules in the aforementioned penetration testing system for HarmonyOS mobile applications can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device, or stored in the memory of the computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0096] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A penetration testing method for mobile applications using the HarmonyOS system, characterized in that, Including the following steps: Obtain the current version installation package of the target mobile application, extract static asset data, and run the target mobile application in a preset sandbox environment to capture dynamic behavior data; A threat model targeting the HarmonyOS distributed architecture is built based on static asset data and dynamic behavioral data. A set of penetration test cases is generated using a threat model, and then deployed and executed in a distributed testing environment that integrates a dynamic taint tracking engine and a fuzz testing engine. The heterogeneous security telemetry data output by the dynamic taint tracking engine and the fuzz test engine are input into the pre-trained risk identification model, and the preset corresponding processing strategy is executed based on the risk judgment information output by the risk identification model. A penetration test report is generated based on the risk assessment information and the results of the execution of the handling strategies.

2. The penetration testing method for HarmonyOS mobile applications according to claim 1, characterized in that: The steps of obtaining the current version installation package of the target mobile application, extracting static asset data, and running the target mobile application in a preset sandbox environment to capture dynamic behavior data include the following steps: Deploy a preset sandbox environment, which includes a sandbox cluster simulating several HarmonyOS terminal devices; Deploy the target mobile application in the sandbox cluster and simulate user operations, system events and cross-device service call requests based on static asset data to traverse multiple key execution paths of the target mobile application in the sandbox cluster; By embedding probes into the sandbox cluster, the system monitors and collects multi-link interaction data generated by the target mobile application during operation under multiple key execution paths. The multi-link interaction data includes cross-device communication traffic, system service interaction information, and peripheral operation information. Dynamic behavioral data is constructed based on multi-link interaction data.

3. The penetration testing method for HarmonyOS mobile applications according to claim 2, characterized in that: The steps of deploying the target mobile application in a sandbox cluster and simulating user operations, system events, and cross-device service call requests based on static asset data to traverse multiple key execution paths of the target mobile application in the sandbox cluster include the following steps: Identify component declaration information and permission request information in static asset data, perform semantic analysis, and determine whether there are any potentially risky interaction interfaces. When there are potentially risky interaction interfaces, a corresponding risk test sequence is generated based on the semantic analysis results. The risk test sequence includes a combination of test parameters and a cross-device call chain. Execute risk test sequences in the sandbox cluster and construct corresponding pre-defined concurrent stress scenarios; Monitor and record abnormal behavior paths of the target mobile application under concurrent pressure scenarios, and use these as traversal results of key execution paths.

4. The penetration testing method for HarmonyOS mobile applications according to claim 1, characterized in that: The steps for constructing a threat model for the HarmonyOS distributed architecture based on static asset data and dynamic behavioral data include the following steps: Construct an application threat graph, wherein the nodes of the application threat graph include application components, system services, device types, permissions and capabilities, and the edges of the application threat graph include component call relationships, service binding relationships, data flow relationships and permission dependency relationships; Static asset data and dynamic behavior data are mapped to nodes and edges of an application threat graph, and a pre-set graph mining algorithm is used to identify subgraph structures with high connectivity, which represent potential cross-device attack paths. Identify the complexity of potential cross-device attack paths and their associated sensitive resources, determine threat priorities based on complexity and sensitive resources, and build threat models.

5. The penetration testing method for HarmonyOS mobile applications according to claim 4, characterized in that: The step of mapping static asset data and dynamic behavior data to nodes and edges of an application threat graph, and identifying subgraph structures with high connectivity using a preset graph mining algorithm, wherein the subgraph structures represent potential cross-device attack paths, includes the following steps: Extract cross-device interaction events from dynamic behavior data, identify the temporal relationships of cross-device interaction events, and construct an interaction event sequence based on these temporal relationships; Static asset data is mapped to the static structure of the application threat graph, and the sequence of interactive events is transformed into time-stamped temporal edges in the application threat graph to construct a spatiotemporal threat graph. The frequent subgraph mining algorithm is executed on the spatiotemporal threat map. The execution process of the frequent subgraph mining algorithm includes: obtaining a dynamic frequency threshold, setting time window constraints and minimum support threshold, generating candidate time series subgraphs through a preset pattern growth strategy, and iteratively filtering out frequent time series paths that meet the dynamic frequency threshold. The candidate time-series subgraphs corresponding to the selected frequent time-series paths are identified as potential cross-device attack paths.

6. The penetration testing method for HarmonyOS mobile applications according to claim 5, characterized in that: The process of executing the frequent subgraph mining algorithm on the spatiotemporal threat map includes: obtaining a dynamic frequency threshold, setting time window constraints and a minimum support threshold, generating candidate time-series subgraphs through a preset pattern growth strategy, and iteratively filtering out frequent time-series paths that meet the dynamic frequency threshold. The steps include: (a) Initialize the frequent subgraph mining task based on dynamic frequency threshold, time window constraint and minimum support threshold; (b) Extract all single-sided patterns that satisfy the minimum support threshold from the spatiotemporal threat map as initial frequent patterns; (c) Starting from the initial frequent pattern, add continuous temporal edges to the initial frequent pattern according to the preset pattern growth strategy to generate candidate temporal subgraphs. (d) Statistically analyze the occurrence frequency of candidate time series subgraphs in the spatiotemporal threat map and remove candidate time series subgraphs whose occurrence frequency is lower than the dynamic frequency threshold; (e) Candidate time series subgraphs that appear more frequently than the dynamic frequency threshold are considered as frequently updated patterns; (f) Starting with the frequent update pattern, iterate through steps (c) to (e) until no frequent update pattern that meets the dynamic frequency threshold can be generated.

7. The penetration testing method for HarmonyOS mobile applications according to claim 1, characterized in that: The steps of generating a penetration test case set through a threat model, deploying and executing the penetration test case set in a distributed testing environment integrating a dynamic taint tracking engine and a fuzz testing engine include the following steps: Analyze the threat model to extract potential cross-device attack paths and their risk priorities; Penetration test cases are generated based on potential cross-device attack paths and their risk priorities. The penetration test cases include the initial device state, operation sequence, and test load required to trigger the potential cross-device attack path. Deploy penetration test cases to a distributed testing environment and configure a dynamic taint tracking engine and a fuzz testing engine; During concurrent execution of penetration test cases, the dynamic taint tracking engine constructs a propagation map of sensitive data streams in real time based on the operation sequence of the penetration test cases. The fuzz testing engine dynamically adjusts its testing priority based on the propagation graph of sensitive data streams.

8. The penetration testing method for HarmonyOS mobile applications according to claim 1, characterized in that: The heterogeneous security telemetry data includes data flow paths and abnormal behavior sequences. The step of inputting the heterogeneous security telemetry data output by the dynamic taint tracking engine and the fuzz testing engine into a pre-trained risk identification model, and executing a preset corresponding processing strategy based on the risk judgment information output by the risk identification model, includes the following steps: Spatiotemporal alignment and feature extraction are performed on the data flow path output by the dynamic taint tracking engine and the abnormal behavior sequence output by the fuzz test engine to generate standardized feature vectors; The standardized feature vectors are input into the pre-trained risk identification model, which then classifies the feature vectors and outputs risk assessment information including vulnerability type, risk level, and confidence level. Based on the risk level and vulnerability type, the corresponding handling strategy is matched and triggered from the preset strategy library.

9. A penetration testing method for HarmonyOS mobile applications according to claim 8, characterized in that: The step of inputting standardized feature vectors into a pre-trained risk identification model, enabling the model to classify the feature vectors and output risk assessment information including vulnerability type, risk level, and confidence level, includes the following steps: Standardized feature vectors are mapped to a pre-built cybersecurity meta-knowledge graph to query and match known attack patterns, vulnerability features, and system vulnerability entities. Based on the relationships in the network security meta-knowledge graph, potential high-level security threats are inferred, and hypothetical vulnerability types are generated. Calculate the matching degree of known attack patterns and the logical rationality of high-level security threats, and generate risk assessment information based on the calculation results.

10. A penetration testing system for HarmonyOS mobile applications, characterized in that, include: The data extraction module is used to obtain the current version installation package of the target mobile application, extract static asset data, and run the target mobile application in a preset sandbox environment to capture dynamic behavior data. The model building module is used to build threat models against the HarmonyOS distributed architecture based on static asset data and dynamic behavioral data. The test execution module is used to generate a set of penetration test cases based on the threat model, and to deploy and execute the set of penetration test cases in a distributed test environment that integrates a dynamic taint tracking engine and a fuzz testing engine. The heterogeneous security telemetry data output by the dynamic taint tracking engine and the fuzz test engine are input into the pre-trained risk identification model, and the preset corresponding processing strategy is executed based on the risk judgment information output by the risk identification model. A penetration test report is generated based on the risk assessment information and the results of the execution of the handling strategies.

Images