Mobile application privacy leakage detection method and device and storage medium

Abstract

The invention relates to a mobile application privacy leakage detection method and device and a storage medium, and the method comprises the steps: obtaining a privacy sensitive interface list, injecting an instrumentation script into a to-be-detected application program process, and transmitting the list; the sensitive interface, the interaction key function and the network communication interface are monitored in real time by running the instrumentation script, and a sensitive interface calling event containing the sensitive thread identifier, a thread operation event and a network communication event are obtained respectively; searching a target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain a target migration thread identifier; searching a target network sending event corresponding to the target migration thread identifier in the network communication event; on the basis of the sensitive interface calling event, the target thread migration event and the target network sending event, the full link of the privacy data from sensitive interface calling to sending is restored, a privacy leakage detection result is obtained, and through the privacy leakage detection method and device, the problem that it is difficult to accurately trace and detect hidden leakage behaviors is solved.

Description

Technical Field

[0001] This application relates to the field of mobile applications, and in particular to methods, apparatus and storage media for detecting privacy leaks in mobile applications. Background Technology

[0002] With the rapid development of mobile internet technology, Android applications have become deeply integrated into various aspects of users' daily lives. While providing convenient services, they also frequently collect and use a large amount of sensitive and private information, such as device identifiers, geolocation, contacts, and sensor data. The proper use of this private data is the foundation for applications to achieve personalized services and functional expansion. However, some applications or their integrated third-party libraries may engage in illegal activities, illegally transmitting user privacy data to remote servers. This leads to a series of security risks for users, including harassment and fraud, identity theft, and precise behavioral profiling. The problem of privacy leaks is becoming increasingly serious, posing a severe threat to user data security and legitimate rights. Among related technologies, traditional dynamic analysis techniques suffer from the problem of easily broken leakage paths in cross-thread scenarios, making it difficult to accurately trace and detect many hidden leakage behaviors.

[0003] Currently, there is no effective solution to the problem that many hidden leaks in related technologies are difficult to trace and detect accurately. Summary of the Invention

[0004] This application provides a method, apparatus, and storage medium for detecting privacy leaks in mobile applications, which at least solves the problem that a large number of covert leak behaviors are difficult to accurately trace and detect in related technologies.

[0005] In a first aspect, embodiments of this application provide a method for detecting privacy leaks in mobile applications, the method comprising:

[0006] Get the list of privacy-sensitive interfaces;

[0007] A preset instrumentation script is injected into the process of the application under test, and the list of privacy-sensitive interfaces is passed to the instrumentation script;

[0008] By running the instrumentation script, the sensitive interfaces in the privacy-sensitive interface list, the thread interaction key functions of the application under test, and the network communication interfaces of the application under test are monitored in real time, and sensitive interface call events, thread operation events, and network communication events are obtained respectively; the sensitive interface call events include sensitive thread identifiers;

[0009] In the thread operation event, find the target thread migration event corresponding to the sensitive thread identifier to obtain the target migration thread identifier;

[0010] In the network communication events, find the target network sending event corresponding to the target migration thread identifier;

[0011] Based on the sensitive interface call event, the target thread migration event, and the target network transmission event, the entire link of privacy data from the sensitive interface call to the network transmission is reconstructed to obtain the privacy leakage detection result.

[0012] In some embodiments, the thread operation event includes a thread creation event; the thread creation event includes a parent thread identifier, a child thread identifier, and a child thread creation timestamp; the sensitive interface call event further includes a sensitive interface call timestamp; the step of searching for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain the target migration thread identifier includes:

[0013] In the thread operation event, based on the sensitive thread identifier, target thread creation events that match the parent thread identifier and whose child thread creation timestamp is later than the sensitive interface call timestamp are selected;

[0014] The child thread identifier in the target thread creation event is used as the target migration thread identifier.

[0015] In some embodiments, the thread operation event includes a message sending event and a message processing event; the message sending event includes a message sending thread identifier, a message characteristic, and a message sending timestamp; the message processing event includes a message processing thread identifier, a message characteristic, and a message processing timestamp; the sensitive interface call event further includes a sensitive interface call timestamp; the step of searching for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain the target migration thread identifier includes:

[0016] In the message sending event, based on the sensitive thread identifier, target message sending events that match the message sending thread identifier and whose message sending timestamp is later than the sensitive interface call timestamp are selected;

[0017] In the message processing event, find the target message processing event that has the same message characteristics as the target message sending event and whose message processing timestamp is later than the message sending timestamp in the target message sending event;

[0018] The message processing thread identifier corresponding to the target message processing event is used as the target migration thread identifier.

[0019] In some embodiments, the thread operation event includes a task submission event and a task execution event; the task submission event includes a task submission thread identifier, a task description, and a task submission timestamp; the task execution event includes a task execution thread identifier, a task description, and a task execution timestamp; the sensitive interface call event further includes a sensitive interface call timestamp; the step of searching for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain the target migration thread identifier includes:

[0020] In the task submission event, based on the sensitive thread identifier, target task submission events that match the task submission thread identifier and whose task submission timestamp is later than the sensitive interface call timestamp are selected;

[0021] In the task execution event, find the target task execution event that matches the task description in the target task submission event and whose task execution timestamp is later than the task submission timestamp in the target task submission event;

[0022] The task execution thread identifier corresponding to the target task execution event is used as the target migration thread identifier.

[0023] In some embodiments, the network communication event includes a network communication thread identifier and a network communication timestamp; the step of searching for the target network transmission event corresponding to the target migration thread identifier in the network communication event includes:

[0024] In the network communication events, based on the target migration thread identifier, target network sending events that match the network communication thread identifier and whose network communication timestamp is later than the target migration event operation timestamp are selected; the target migration event operation timestamp includes the sub-thread creation timestamp, message processing timestamp, and task execution timestamp.

[0025] In some embodiments, the process of reconstructing the entire chain of privacy data from sensitive interface call to network transmission based on the sensitive interface call event, the target thread migration event, and the target network transmission event to obtain privacy leakage detection results includes:

[0026] Based on the sensitive interface call event, the target thread migration event, and the target network transmission event, the entire chain of privacy data from sensitive interface call to network transmission is reconstructed to obtain the privacy leakage chain;

[0027] Extract the statement call information of each step in the privacy leakage chain and determine the taint propagation direction indicated by the privacy leakage chain;

[0028] Based on the statement call information and the taint propagation direction, a leakage diagram is generated;

[0029] Based on the leak graph, the privacy leak detection result is obtained.

[0030] In some embodiments, after generating the leakage graph based on the various statement call information and the taint propagation direction, the method further includes:

[0031] Graph feature extraction is performed on the leak graph to obtain a feature matrix;

[0032] Based on the feature matrix, multiple leakage maps are classified to obtain clustering results;

[0033] Based on the clustering results, the leakage pattern is obtained.

[0034] In some embodiments, the step of extracting graph features from the leak graph to obtain a feature matrix includes:

[0035] Subgraph pattern recognition is performed on the leaked graph to generate frequent subgraph vectors;

[0036] The node connection relationships and path characteristics in the leak graph are analyzed to obtain the topological structure characteristics;

[0037] The feature matrix is ​​obtained based on the frequent subgraph vectors and the topological features.

[0038] Secondly, embodiments of this application provide a mobile application privacy leakage detection device, the device comprising:

[0039] The interface acquisition module is used to obtain a list of privacy-sensitive interfaces;

[0040] The script injection module is used to inject a preset instrumentation script into the process of the application under test, and to pass the privacy-sensitive interface list to the instrumentation script.

[0041] The event monitoring module is used to monitor sensitive interfaces in the privacy-sensitive interface list, key thread interaction functions of the application under test, and network communication interfaces of the application under test in real time by running the instrumentation script, and to obtain sensitive interface call events, thread operation events, and network communication events respectively; the sensitive interface call events include sensitive thread identifiers;

[0042] The thread migration event matching module is used to find the target thread migration event corresponding to the sensitive thread identifier in the thread operation event, and obtain the target migration thread identifier;

[0043] The network transmission event location module is used to locate the target network transmission event corresponding to the target migration thread identifier in the network communication event;

[0044] The privacy leak detection result output module is used to reconstruct the entire link of privacy data from sensitive interface call to network transmission based on the sensitive interface call event, the target thread migration event, and the target network transmission event, and obtain the privacy leak detection result.

[0045] Thirdly, embodiments of this application provide a storage medium storing a computer program thereon, which, when executed by a processor, implements the mobile application privacy leakage detection method as described in the first aspect above.

[0046] Compared to related technologies, the mobile application privacy leakage detection method, apparatus, and storage medium provided in this application embodiment obtain a list of privacy-sensitive interfaces; inject a preset instrumentation script into the process of the application under test, and pass the list of privacy-sensitive interfaces to the instrumentation script; by running the instrumentation script, monitor the sensitive interfaces in the list of privacy-sensitive interfaces, the thread interaction key functions of the application under test, and the network communication interfaces of the application under test in real time, and obtain sensitive interface call events, thread operation events, and network communication events respectively; the sensitive interface call events include sensitive thread identifiers; in the thread operation events, find the target thread migration event corresponding to the sensitive thread identifier to obtain the target migration thread identifier; in the network communication events, find the target network transmission event corresponding to the target migration thread identifier; based on the sensitive interface call events, the target thread migration events, and the target network transmission events, reconstruct the entire link of privacy data from sensitive interface calls to network transmission, and obtain privacy leakage detection results, thus solving the problem in related technologies where a large number of hidden leakage behaviors are difficult to accurately trace and detect.

[0047] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0048] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0049] Figure 1 This is a hardware structure block diagram of a terminal for a mobile application privacy leakage detection method according to an embodiment of this application;

[0050] Figure 2 This is a flowchart of a mobile application privacy leakage detection method according to an embodiment of this application;

[0051] Figure 3 This is a schematic diagram of a mobile application privacy leakage detection framework according to an embodiment of this application;

[0052] Figure 4 This is a structural block diagram of a mobile application privacy leakage detection device according to an embodiment of this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the application. All other embodiments obtained by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application. Furthermore, it is understood that although the efforts made in such a development process may be complex and lengthy, for those skilled in the art related to the content disclosed in this application, modifications to design, manufacturing, or production based on the technical content disclosed in this application are merely conventional technical means and should not be construed as insufficient disclosure of the content of this application.

[0054] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0055] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application means two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The terms “first,” “second,” “third,” etc., used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0056] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. Taking running on a terminal as an example, Figure 1 This is a hardware structure block diagram of a terminal for a mobile application privacy leakage detection method according to an embodiment of this application. Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. Optionally, the terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0057] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the mobile application privacy leakage detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thus implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0058] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0059] This embodiment provides a method for detecting privacy leaks in mobile applications. Figure 2 This is a flowchart of a mobile application privacy leakage detection method according to an embodiment of this application, such as... Figure 2 As shown, the process includes the following steps:

[0060] Step S201: Obtain the list of privacy-sensitive interfaces.

[0061] In this step, by systematically reviewing the official Android development documentation, relevant academic research findings in the field of privacy and security, and industry practice cases, we comprehensively screen the core system interfaces through which mobile applications access sensitive user privacy data. This results in a privacy-sensitive interface list covering device identifiers, location information, communication information, sensor information, network information, system information, advertising identifiers, storage information, and other privacy-related information. This list contains 234 key interfaces, which can fully cover various privacy leakage risks that mobile applications may encounter during the data collection process, providing a clear and comprehensive target basis for subsequent precise monitoring of sensitive data collection behavior.

[0062] Step S202: Inject a preset instrumentation script into the process of the application under test, and pass the list of privacy-sensitive interfaces to the instrumentation script.

[0063] Specifically, based on the completed list of privacy-sensitive interfaces, to achieve accurate capture and full-link tracking of key events in the flow of privacy data, a pre-defined JavaScript instrumentation script is injected into the process of the application under test using Frida dynamic instrumentation technology. Simultaneously, the constructed list of privacy-sensitive interfaces is passed to this instrumentation script, enabling the script to clearly define its monitoring targets and scope. This instrumentation script will intercept target methods in the Java and Native layers at runtime. It can not only accurately monitor various sensitive interface calls based on the privacy-sensitive interface list, but also comprehensively monitor key thread interaction functions (such as the Native layer clone function, Handler-related methods, and thread pool execute and afterExecute methods) and network communication interfaces (such as java.net.Socket.connect). This lays the foundation for subsequent capture of sensitive interface call events, thread operation events, and network communication events, ensuring that monitoring accurately focuses on core operations related to privacy leaks, while also providing crucial data support for cross-thread path association.

[0064] Step S203: By running the instrumentation script, the sensitive interfaces in the privacy-sensitive interface list, the thread interaction key functions of the application under test, and the network communication interfaces of the application under test are monitored in real time, and sensitive interface call events, thread operation events, and network communication events are obtained respectively; the sensitive interface call events include sensitive thread identifiers.

[0065] In this step, the instrumentation script is run to monitor key aspects of the privacy data flow in real time. Specifically, this includes various sensitive interfaces in the privacy-sensitive interface list, key thread interaction functions involved in the application under test during operation, and network communication interfaces used for external data transmission. During application runtime, monitoring of these three types of interfaces yields sensitive interface call events, thread operation events, and network communication events.

[0066] Among them, the sensitive interface call event must contain at least a sensitive thread identifier. This identifier is used to uniquely identify the thread in which the initial collection of privacy data occurs, providing a core location basis for subsequent cross-thread path association. During monitoring, differentiated hooking strategies (interception strategies) need to be implemented for key thread interaction functions in different leakage modes. This involves accurately selecting core functions driving thread interaction and privacy leaks in each mode based on the unique execution logic of four typical scenarios: direct single-threaded leakage, thread creation-based leakage, message passing-based leakage, and thread pool scheduling-based leakage. For example, sensitive interface calls and network communication operations are directly intercepted for the direct single-threaded leakage mode; the Native layer clone function is intercepted for the thread creation-based leakage mode; the Handler.sendMessage, Handler.enqueueMessage, and Handler.dispatchMessage methods are precisely monitored for the message passing-based leakage mode; and the execute and afterExecute methods are focused on for the thread pool scheduling-based leakage mode. Simultaneously, all Socket-related network communication interfaces are comprehensively intercepted to ensure no potential network data transmission behavior is missed. Furthermore, each time an event is triggered, in addition to core identification information, the current timestamp and related context method call chain (Stacktrace) are recorded synchronously, completely preserving the event execution context information and providing comprehensive and reliable data support for subsequent full-link reconstruction and accurate tracing of the leakage path.

[0067] It's important to note that when performing dynamic analysis on mobile applications, to improve code coverage and trigger more potential privacy data collection and leakage behaviors, it's necessary to traverse the application's UI by simulating user interactions, without needing prior knowledge of the application's UI interactions. By integrating the Fastbot tool, automatic UI traversal is achieved. This tool, based on model-driven testing and incorporating machine learning and reinforcement learning algorithms, abstracts the UI interface into states and user operations into actions, constructing a dynamic directed graph model. Through a priority scheduling algorithm, it makes real-time decisions on high-yield actions, effectively avoiding getting stuck in local loops and ensuring that monitoring covers key events related to privacy data flow across multiple application scenarios.

[0068] Step S204: In the thread operation event, find the target thread migration event corresponding to the sensitive thread identifier to obtain the target migration thread identifier.

[0069] This step uses the sensitive thread identifier in sensitive interface call events as the core retrieval basis to accurately search and match captured thread operation events, aiming to locate cross-thread migration behaviors causally related to privacy data collection activities. It should be noted that thread migration events only apply to three types of multi-threaded leakage modes: thread creation-based, message passing-based, and thread pool scheduling-based. Single-threaded direct leakage modes, due to the lack of cross-thread interaction, do not require this migration event search operation.

[0070] For example, one search logic for the three patterns can be as follows: For thread operation events related to thread creation, filter out events where the parent thread identifier matches the sensitive thread identifier and the child thread creation timestamp is later than the sensitive interface call timestamp; the corresponding child thread identifier is the target migration thread identifier for this pattern. For thread operation events related to message passing, first filter out target message sending events where the message sending thread identifier matches the sensitive thread identifier and the message sending timestamp is later than the sensitive interface call timestamp; then match target message processing events with consistent message characteristics and message processing timestamps later than message sending timestamps; use the message processing thread identifier as the target migration thread identifier. For thread operation events related to thread pool scheduling, first filter out target task submission events where the task submission thread identifier matches the sensitive thread identifier and the task submission timestamp is later than the sensitive interface call timestamp; then match target task execution events with consistent task descriptions and task execution timestamps later than task submission timestamps; determine the task execution thread identifier as the target migration thread identifier. Through the aforementioned targeted matching logic, the target thread that undertakes the flow of private data under different multi-threaded leakage modes can be accurately identified, providing key thread location support for subsequent related network event sending and restoration of the complete leakage chain.

[0071] Step S205: In the network communication events, find the target network sending event corresponding to the target migration thread identifier.

[0072] This step uses the target migration thread identifier determined in step S204 as the core matching basis. It combines this with the operation timestamps corresponding to the target migration events (such as the child thread creation timestamp in thread creation mode, the message processing timestamp in message passing mode, and the task execution timestamp in thread pool scheduling mode) to accurately filter captured network communication events. The aim is to locate network data sending behaviors directly related to cross-thread privacy data transfer. Network communication events include network communication thread identifiers and network communication timestamps. The filtering process must simultaneously meet two key conditions: first, the network communication thread identifier must be completely identical to the target migration thread identifier, ensuring that the network sending behavior is initiated by the target thread receiving the privacy data transfer; second, the network communication timestamp must be later than the corresponding target migration event operation timestamp, and the time interval between the two must be within a reasonable range. This eliminates interference from unrelated network operations and ensures the causal relationship between events. It should be understood that, for different multi-threaded leakage modes, the correspondence between the target migration thread and the network sending thread is as follows: in the thread creation mode, it is the child thread; in the message passing mode, it is the message processing thread; and in the thread pool scheduling mode, it is the task execution thread. The filtering logic in this step is based on this correspondence to further identify the network sending event that truly carries the leakage of private data, providing key terminal node data support for the subsequent reconstruction of the entire privacy leakage chain.

[0073] Step S206: Based on sensitive interface call events, target thread migration events, and target network transmission events, reconstruct the entire chain of privacy data from sensitive interface call to network transmission to obtain privacy leakage detection results.

[0074] This step integrates key information such as sensitive thread identifiers and context method call chains from sensitive interface call events, thread relationships, context method call chains, and corresponding operation timestamps from target thread migration events, and network communication thread identifiers, communication addresses, context method call chains, and timestamps from target network sending events. Following the logical sequence and causal relationship of "privacy collection → thread migration → network sending," a complete method-level leakage evidence chain is constructed. Specifically, for the single-threaded direct leakage mode, the linear full-link of "sensitive interface call → method processing → network sending" is reconstructed directly through the consistency between the sensitive thread identifier and the network communication thread identifier, and the chronological relationship between the sensitive call timestamp and the network sending timestamp. For the three types of multi-threaded modes based on thread creation, message passing, and thread pool scheduling, the dual association mechanism of thread identifiers and data handles (message features and task identifiers) is relied upon. Cross-thread break paths are connected through thread affinity, message feature matching, and task description matching, clearly presenting the complete flow trajectory of data from the collection thread to the target migration thread and then to the network sending thread. Simultaneously, the method call stack information (context method call chain) of each stage is integrated to clarify the specific function call sequence of each data processing step. Ultimately, based on the full-chain information, privacy breach detection results are generated, including key leakage nodes, complete method call sequences, and risk levels, providing comprehensive and interpretable technical support for accurate tracing of privacy breaches, determination of responsibility, and subsequent rectification.

[0075] Through steps S201 to S206, a systematic approach was implemented to achieve fine-grained dynamic monitoring and end-to-end tracing of privacy leaks in Android applications. This effectively addresses the technical pain points of traditional dynamic analysis, such as imprecise path reconstruction and the susceptibility to broken cross-thread paths. By dynamically instrumenting method-level call stacks and multi-dimensional event data, and relying on a thread identifier association mechanism to precisely connect broken paths in multi-threaded scenarios, a complete method-level leakage evidence chain is constructed, from privacy data collection to network transmission. This significantly improves the accuracy, interpretability, and tracing capabilities of privacy leak detection, providing comprehensive technical support for application security auditing, third-party library risk management, and privacy protection supervision.

[0076] In some embodiments, the thread operation event includes a thread creation event; the thread creation event includes a parent thread identifier, a child thread identifier, and a child thread creation timestamp; the sensitive interface call event further includes a sensitive interface call timestamp; the step of searching for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain the target migration thread identifier includes:

[0077] In the thread operation event, based on the sensitive thread identifier, target thread creation events that match the parent thread identifier and whose child thread creation timestamp is later than the sensitive interface call timestamp are selected;

[0078] The child thread identifier in the target thread creation event is used as the target migration thread identifier.

[0079] Among them, thread operation events include thread creation events, which specifically include parent thread identifier, child thread identifier, and child thread creation timestamp, corresponding to the core data of thread kinship in the thread creation leakage mode; at the same time, sensitive interface call events also include sensitive interface call timestamps, which are used to verify the temporal correlation between privacy data collection and thread creation behavior.

[0080] Specifically, among all captured thread operation events, the sensitive thread identifier in the sensitive interface call event is used as the core matching criterion to accurately filter out thread creation events that meet two key conditions as target thread creation events. First, the parent thread identifier in the thread creation event is completely consistent with the sensitive thread identifier (ensuring that the thread creation behavior is initiated by the privacy data collection thread). Second, the child thread creation timestamp of the event is later than the sensitive interface call timestamp and the time interval between the two is within a reasonable range (consistent with the logical sequence of "collecting privacy data first, then creating threads to transfer data," excluding interference from unrelated thread creation). After determining the target thread creation event, the child thread identifier recorded in the event is directly used as the target migration thread identifier, thereby locking the key thread that undertakes the privacy data flow.

[0081] Through the above steps, the core positioning of cross-thread association based on the thread creation leakage mode was accurately achieved. By locking the parent thread of privacy data collection with the sensitive thread identifier, and combining it with timestamp timing verification (child thread creation is later than the sensitive interface call and the interval is reasonable), the interference of unrelated thread creation events was effectively eliminated, and the target thread creation event directly related to the privacy data flow was accurately screened. Then, the child thread identifier was determined as the target migration thread identifier, and an explicit kinship relationship of "parent thread (collection thread) - child thread (data receiving thread)" was successfully established. This solved the technical pain point of easy breakage of the leakage path in the thread creation scenario in traditional dynamic analysis, and provided key thread positioning support for subsequent association of network sending events initiated by child threads and reconstruction of the complete method-level leakage chain of "sensitive data collection → thread creation → network leakage", ensuring that cross-thread leakage behavior can be accurately traced.

[0082] In some embodiments, the thread operation event includes a message sending event and a message processing event; the message sending event includes a message sending thread identifier, a message characteristic, and a message sending timestamp; the message processing event includes a message processing thread identifier, a message characteristic, and a message processing timestamp; the sensitive interface call event further includes a sensitive interface call timestamp; the step of searching for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain the target migration thread identifier includes:

[0083] In the message sending event, based on the sensitive thread identifier, target message sending events that match the message sending thread identifier and whose message sending timestamp is later than the sensitive interface call timestamp are selected;

[0084] In the message processing event, find the target message processing event that has the same message characteristics as the target message sending event and whose message processing timestamp is later than the message sending timestamp in the target message sending event;

[0085] The message processing thread identifier corresponding to the target message processing event is used as the target migration thread identifier.

[0086] The aforementioned thread operation events specifically include message sending events and message processing events. Together, they support cross-thread behavior association based on the message passing leakage pattern. The message sending event records the message sending thread identifier, message characteristics used to uniquely match the task entity, and message sending timestamp. The message processing event includes the message processing thread identifier, message characteristics corresponding to the sending end, and message processing timestamp. In addition, the sensitive interface call event also carries a sensitive interface call timestamp to verify the timing rationality of privacy data collection and message passing behavior.

[0087] Specifically, firstly, among all captured message sending events, the sensitive thread identifier in the sensitive interface call event is used as the core matching criterion to accurately filter out events whose message sending thread identifier is completely consistent with the sensitive thread identifier and whose message sending timestamp is later than the sensitive interface call timestamp (ensuring that the message sending behavior occurs after the collection of privacy data and conforms to the logical sequence). These events are identified as target message sending events. Subsequently, among all message processing events, events that are completely consistent with the message characteristics in the target message sending event (ensuring that they are the same message entity), whose message processing timestamp is later than the message sending timestamp in the target message sending event (satisfying the asynchronous message mechanism of "send first, process later") and whose time interval is within a reasonable range (excluding interference from irrelevant messages) are further searched for and identified as target message processing events. Finally, the message processing thread identifier corresponding to the target message processing event is directly used as the target migration thread identifier, thereby accurately locating the key thread that undertakes the cross-thread transfer of privacy data.

[0088] Through the above steps, the effective association and target thread location of cross-thread behavior based on the message passing leakage model were accurately achieved. By locking the message sending thread corresponding to privacy data collection with the sensitive thread identifier, and filtering out valid target message sending events by combining timestamp timing verification (message sending is later than sensitive interface calls and the interval is reasonable), and then accurately associating the target message processing event corresponding to the same message through the unique matching of message features and the "send first, process later" timestamp logic, the message processing thread identifier was finally determined as the target migration thread identifier. The cross-thread association link of "sensitive data collection thread - message sending thread - message processing thread" was successfully established, which solved the technical pain points of easy breakage of leakage path and difficulty in tracing inter-thread behavior under the asynchronous message mechanism in traditional dynamic analysis. It provides key thread location support for further associating network sending events initiated by the message processing thread and reconstructing the complete method-level leakage link of "sensitive data collection → message passing → network leakage", ensuring that cross-thread privacy leakage behavior can be accurately traced.

[0089] In some embodiments, the thread operation event includes a task submission event and a task execution event; the task submission event includes a task submission thread identifier, a task description, and a task submission timestamp; the task execution event includes a task execution thread identifier, a task description, and a task execution timestamp; the sensitive interface call event further includes a sensitive interface call timestamp; the step of searching for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain the target migration thread identifier includes:

[0090] In the task submission event, based on the sensitive thread identifier, target task submission events that match the task submission thread identifier and whose task submission timestamp is later than the sensitive interface call timestamp are selected;

[0091] In the task execution event, find the target task execution event that matches the task description in the target task submission event and whose task execution timestamp is later than the task submission timestamp in the target task submission event;

[0092] The task execution thread identifier corresponding to the target task execution event is used as the target migration thread identifier.

[0093] The aforementioned thread operation events specifically include task submission events and task execution events, which together support the correlation analysis of cross-thread task flow in the leak mode based on thread pool scheduling. The task submission event records the task submission thread identifier, a task description for uniquely associating the task entity, and a task submission timestamp. The task execution event includes the task execution thread identifier, a task description corresponding to the submitting end, and a task execution timestamp. Additionally, the sensitive interface call event carries a sensitive interface call timestamp to verify the temporal rationality of privacy data collection and task scheduling behavior.

[0094] Specifically, firstly, among all captured task submission events, the sensitive thread identifier in the sensitive interface call event is used as the core matching criterion to accurately filter out events whose task submission thread identifier is completely consistent with the sensitive thread identifier and whose task submission timestamp is later than the sensitive interface call timestamp (ensuring that the task submission behavior occurs after the collection of privacy data, which conforms to the logical sequence of "collecting data first and then submitting and sending tasks"). These events are identified as target task submission events. Subsequently, among all task execution events, events are further searched for that are completely consistent with the task description in the target task submission event (ensuring that they are the same asynchronous task entity and avoiding correlation deviations caused by the uncertainty of thread pool scheduling), whose task execution timestamp is later than the task submission timestamp in the target task submission event (satisfying the thread pool scheduling mechanism of "submit first and then execute") and whose time interval is within a reasonable range (excluding irrelevant execution interference caused by excessive task backlog). These events are identified as target task execution events. Finally, the task execution thread identifier corresponding to the target task execution event is directly used as the target migration thread identifier, thereby accurately locking the key working thread that undertakes the cross-thread transfer of privacy data.

[0095] Through the above steps, the effective association and target thread location of cross-thread task flow based on the thread pool scheduling leakage mode were accurately achieved. By locking the task submission thread corresponding to privacy data collection with the sensitive thread identifier, and filtering out valid target task submission events by combining timestamp timing verification (task submission is later than sensitive interface call and the interval is reasonable), and then overcoming the association problem caused by the uncertainty of thread pool scheduling through the unique matching of task description and the "submit first, execute later" timestamp logic, the association was accurately linked to the target task execution event corresponding to the same asynchronous task. Finally, the task execution thread identifier was determined as the target migration thread identifier, successfully establishing the cross-thread association link of "sensitive data collection thread - task submission thread - task execution thread". This solved the technical pain points of easy breakage of leakage path and difficulty in tracing task flow in thread pool scheduling scenarios in traditional dynamic analysis. It provides key thread location support for further association of network sending events initiated by task execution thread and restoration of the complete method-level leakage link of "sensitive data collection → task submission → task execution → network leakage", ensuring that cross-thread privacy leakage behavior can be accurately traced.

[0096] In some embodiments, the network communication event includes a network communication thread identifier and a network communication timestamp; the step of searching for the target network transmission event corresponding to the target migration thread identifier in the network communication event includes:

[0097] In the network communication events, based on the target migration thread identifier, target network sending events that match the network communication thread identifier and whose network communication timestamp is later than the target migration event operation timestamp are selected; the target migration event operation timestamp includes the sub-thread creation timestamp, message processing timestamp, and task execution timestamp.

[0098] The aforementioned network communication events specifically include network communication thread identifiers and network communication timestamps. These two types of information are the core evidence for identifying network leakage behaviors related to cross-thread privacy data transfers. Specifically, the network communication thread identifier is used to associate the target thread receiving the data transfer, and the network communication timestamp is used to verify the reasonableness of the event sequence.

[0099] Specifically, using the target migration thread identifier determined in step S204 as the core matching credential, all captured network communication events are precisely screened. The screening must simultaneously meet two key conditions: First, the network communication thread identifier in the network communication event must be completely consistent with the target migration thread identifier, ensuring that the network sending behavior is directly initiated by the target migration thread that receives the privacy data flow, eliminating interference from network operations of unrelated threads; Second, the network communication timestamp of the network communication event must be later than the corresponding target migration event operation timestamp (the target migration event operation timestamp corresponds to different types depending on the leakage mode, specifically the sub-thread creation timestamp in the thread creation mode, the message processing timestamp in the message passing mode, and the task execution timestamp in the thread pool scheduling mode), and the time interval between the two must be within a reasonable range. The network communication events that ultimately meet the above conditions are the target network sending events directly related to the privacy leakage behavior.

[0100] Through the above steps, a precise correlation between privacy data migration and network leakage behavior under different multi-threaded leakage modes is achieved. By using the target migration thread identifier as the core anchor point, it is ensured that network sending behavior is directly bound to the target thread receiving the privacy data flow. At the same time, timing verification is performed by adapting the target migration event operation timestamps (sub-thread creation timestamp, message processing timestamp, and task execution timestamp) of three modes: thread creation, message passing, and thread pool scheduling. It is required that the network communication timestamp is later than the corresponding migration operation timestamp and the interval is reasonable. This not only strictly follows the logical timing of "data migration → network sending" but also effectively eliminates the interference of unrelated network operations. It successfully establishes the terminal link of "privacy data collection → cross-thread migration → network leakage", which solves the technical pain point of the difficulty in accurately matching network sending events and cross-thread data flow in traditional dynamic analysis. It provides key terminal node verification support for building a complete and traceable method-level privacy leakage evidence chain, ensuring the accuracy of privacy leakage behavior detection and the reliability of traceability.

[0101] In some embodiments, the process of reconstructing the entire chain of privacy data from sensitive interface call to network transmission based on the sensitive interface call event, the target thread migration event, and the target network transmission event to obtain privacy leakage detection results includes:

[0102] Based on the sensitive interface call event, the target thread migration event, and the target network transmission event, the entire chain of privacy data from sensitive interface call to network transmission is reconstructed to obtain the privacy leakage chain;

[0103] Extract the statement call information of each step in the privacy leakage chain and determine the taint propagation direction indicated by the privacy leakage chain;

[0104] Based on the statement call information and the taint propagation direction, a leakage diagram is generated;

[0105] Based on the leak graph, the privacy leak detection result is obtained.

[0106] First, based on the associated data of three types of core events, we integrate the sensitive thread identifiers and context method call chains in sensitive interface call events, the relationships (such as parent / child thread identifiers, message characteristics, and task descriptions), context method call chains, and corresponding operation timestamps in target thread migration events, and key information such as network communication thread identifiers, communication addresses, context method call chains, and timestamps in target network sending events. Following the logical sequence and causal relationship of "privacy collection → thread migration → network sending," we reconstruct a complete privacy leakage chain from sensitive data collection to network leakage, clearly presenting the data flow trajectory in single-threaded or cross-threaded scenarios. Then, we extract the statement call information (including function call sequences, method signatures, and other core semantics) of each link in the privacy leakage chain, and combine the chronological order of events and data transmission logic to clarify the direction of taint propagation indicated by the chain.

[0107] Next, based on the extracted statement call information and the determined taint propagation direction, the independent leakage paths are abstracted into a structured leakage graph, which can comprehensively depict the complete propagation path and correlation of privacy data from the source to the terminal.

[0108] Finally, graph feature extraction and cluster analysis are performed on the generated leakage graph to identify macro-level leakage patterns. At the same time, information such as fine-grained method call sequences, key leakage nodes, and risk levels are integrated to obtain privacy leakage detection results that include micro-level path details and macro-level pattern insights. This provides comprehensive and interpretable technical support for accurate tracing of privacy leakage behavior, determination of responsibility, and subsequent rectification.

[0109] Through the above steps, a full-process analysis of privacy leaks, from fine-grained path reconstruction to macro-level pattern insight, is achieved. Supported by the correlation data of three core events, the complete leakage chain of "sensitive data collection → cross-thread migration → network transmission" is accurately reconstructed, clearly presenting the data flow trajectory in single-threaded or multi-threaded scenarios. Then, by extracting statement call information (including function call sequences, method signatures, and other core semantics) and clarifying the direction of taint propagation, discrete leakage behaviors are abstracted into a structured leakage graph. The system depicts the propagation path and correlation of data from source to terminal. Finally, based on feature extraction and cluster analysis of the leakage graph, it can not only output micro-level detection results containing fine-grained method call sequences and key leakage nodes, but also automatically identify macro-level leakage patterns. This effectively solves the technical pain points of incomplete leakage path reconstruction, easy breakage of cross-thread links, and lack of global pattern insight in traditional dynamic analysis. It provides comprehensive technical support with both interpretability and a macro perspective for accurate tracing of privacy leakage behaviors, responsibility identification, application security auditing, and supervision.

[0110] In some embodiments, after generating the leakage graph based on the various statement call information and the taint propagation direction, the method further includes:

[0111] Graph feature extraction is performed on the leak graph to obtain a feature matrix;

[0112] Based on the feature matrix, multiple leakage maps are classified to obtain clustering results;

[0113] Based on the clustering results, the leakage pattern is obtained.

[0114] Specifically, the original leakage graph is first aggregated into multiple independent connected graphs and normalized. At the method signature level, regular expressions are used to extract the core semantics of class and method names and remove irrelevant prefix information. At the statement level, code statements and generalized variables are consistently replaced to preserve program structure and mitigate bias in specific values. Then, for each processed leakage graph, frequent subgraph features (recording their occurrence in each connected graph in vector form) and topological features (including node degree distribution statistics, path complexity features, longest path calculation, undirected transformation graph core number measurement, and average shortest path calculation, etc.) are extracted and applied. A predefined weighting scheme and normalization process are used to construct a standardized feature matrix. Based on this feature matrix, clustering algorithms such as K-means are employed to perform cluster analysis on multiple leakage maps, aggregating leakage maps with similar structural features to form cluster results. Finally, through deep analysis of the common features and structural patterns of each cluster, typical leakage patterns such as linear patterns, flower cluster patterns, multi-source / multi-target patterns, and hybrid patterns are identified and summarized from the cluster results. This achieves a higher-dimensional analysis from single leakage paths to macroscopic leakage behavior patterns, providing high-level technical support for understanding application data processing strategies and investigating systemic privacy leakage risks.

[0115] Through the above steps, the technical pain points of traditional dynamic analysis, which only focuses on a single path and lacks insight into the global leakage behavior patterns, are effectively solved. It not only realizes the structured presentation and classification of privacy leakage behavior, but also reveals the systematic data processing strategies and collaborative leakage relationships of applications. It provides comprehensive technical support for application security auditing, third-party library risk management and privacy protection supervision, which combines fine-grained tracing and macro-level pattern insight.

[0116] In some embodiments, the step of extracting graph features from the leak graph to obtain a feature matrix includes:

[0117] Subgraph pattern recognition is performed on the leaked graph to generate frequent subgraph vectors;

[0118] The node connection relationships and path characteristics in the leak graph are analyzed to obtain the topological structure characteristics;

[0119] The feature matrix is ​​obtained based on the frequent subgraph vectors and the topological features.

[0120] First, subgraph pattern recognition is performed on the preprocessed leakage graph. By mining recurring and representative subgraph structures, these frequent subgraphs are quantified and represented as vectors, generating frequent subgraph vectors that reflect the core structural features of the leakage path. This accurately records the frequency and distribution of various frequent subgraphs in the corresponding leakage graph. Next, the topology of the leakage graph is deeply analyzed, focusing on node connectivity (including node degree distribution statistics and inter-node association strength) and path features (covering path complexity, longest propagation path length, core number measures in undirected transformation graphs, and average shortest path). Topological structural features that characterize the overall topological form and data propagation logic of the leakage graph are extracted. Finally, the generated frequent subgraph vectors and topological structural features are predefined and weighted to eliminate dimensional differences between different feature dimensions. Then, a normalization operation integrates the two types of features into a standardized feature set with a unified dimension, ultimately constructing a feature matrix that comprehensively and accurately characterizes the structure and propagation characteristics of the leakage graph.

[0121] Through the above steps, subgraph pattern recognition is first performed on the leaked graph to generate frequent subgraph vectors, capturing representative substructure features that appear repeatedly in the graph. Then, the node connection relationships and path features are analyzed to obtain topological structure features, reflecting the overall structural characteristics of the graph. Finally, the two are combined to obtain a feature matrix, which can comprehensively and accurately extract the key features of the leaked graph, transforming the complex graph structure into a matrix form that can be quantified and analyzed. This provides a reliable feature basis for subsequent classification and clustering of multiple leaked graphs based on the feature matrix, thereby achieving effective representation and efficient analysis of the leaked graph and improving the accuracy and scientific nature of leak pattern recognition.

[0122] Figure 3 This is a schematic diagram of a mobile application privacy leakage detection framework according to an embodiment of this application, as shown below. Figure 3 As shown, the framework includes the following steps:

[0123] Step S301: Data Acquisition. This mainly involves acquiring a list of sensitive privacy interfaces and the dataset of the application under test. Through a systematic review of Android official documentation, academic research in the field of privacy and security, and industry practice cases, the core system interfaces through which applications access sensitive user privacy data are identified. These interfaces cover nine functional categories, including device identifiers, location information, communication information, and sensor information. This results in a list of 234 key privacy-sensitive interfaces, comprehensively covering all potential privacy leakage risks that mobile applications may encounter during data collection, laying a solid foundation for subsequent dynamic monitoring and leakage detection.

[0124] Step S302: Dynamic Triggering and Monitoring Technology for Privacy Leakage. This stage achieves comprehensive capture of key events in the flow of privacy data through dynamic instrumentation and automated interactive triggering. Based on the Frida framework, a pre-set JavaScript instrumentation script is injected into the application process under test, passing a list of privacy-sensitive interfaces. The script performs real-time hook monitoring on sensitive interfaces in the Java and Native layers, key thread interaction functions (such as the clone function, Handler-related methods, and thread pool scheduling methods), and network communication interfaces (such as Socket-related operations), recording the thread identifier, timestamp, and context method call chain at the time of each event trigger. Simultaneously, the Fastbot tool is used to achieve automatic UI traversal, simulating user interaction to improve code coverage and trigger more potential privacy data collection and leakage behaviors, ultimately obtaining three core data types: sensitive interface call events, thread operation events, and network communication events.

[0125] Step S303: Privacy Leakage Path Association Mechanism. This step focuses on connecting single-threaded and cross-thread leakage paths to build a complete privacy data flow chain. Using the sensitive thread identifier in sensitive interface call events as the core, it employs differentiated association logic for four typical modes: direct leakage in single-threaded mode, based on thread creation, based on message passing, and based on thread pool scheduling. In the single-threaded mode, direct association is based on thread identifier consistency and timestamp sequence (network connection and data transmission are initiated directly in the current execution context, and the privacy leakage event occurs within the same thread). In the multi-threaded mode, a dual association mechanism of thread identifier and data handle (message characteristics, task description), combined with timestamp order and semantic consistency verification, matches thread affinity, message entities, and task entities respectively, precisely "stitching" together cross-thread broken paths, ultimately establishing a complete causal association from sensitive interface call to network transmission event, forming a fine-grained method-level privacy leakage chain.

[0126] Step S304: Data Leakage Analysis. The data leakage analysis phase achieves a higher-level insight from single paths to macro-level patterns. First, the associated leakage paths are abstracted into a structured leakage graph. Preprocessing is used to standardize signatures and statement expressions, preserving core semantics and program structure. Then, frequent subgraph vectors and topological features (such as node degree distribution and path complexity) of the leakage graph are extracted to construct a standardized feature matrix. The K-means clustering algorithm is used to classify multiple leakage graphs, and the clustering results identify four main leakage patterns: linear pattern, cluster pattern, multi-source / multi-target pattern, and hybrid pattern. Finally, the fine-grained leakage chain details and macro-level pattern analysis results are integrated to output privacy leakage detection results that combine traceability and a global perspective, providing comprehensive technical support for application security auditing and risk management.

[0127] This embodiment also provides a mobile application privacy leakage detection device, which is used to implement the above embodiments and preferred embodiments, and will not be repeated as described thereon. As used below, the terms "module," "unit," "subunit," etc., can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0128] Figure 4 This is a structural block diagram of a mobile application privacy leakage detection device according to an embodiment of this application, such as... Figure 4 As shown, the device includes:

[0129] Interface acquisition module 41 is used to obtain a list of privacy-sensitive interfaces;

[0130] The script injection module 42 is used to inject a preset instrumentation script into the process of the application under test, and to pass the privacy-sensitive interface list to the instrumentation script.

[0131] Event monitoring module 43 is used to monitor sensitive interfaces in the privacy-sensitive interface list, thread interaction key functions of the application under test, and network communication interfaces of the application under test in real time by running the instrumentation script, and obtain sensitive interface call events, thread operation events, and network communication events respectively; the sensitive interface call events include sensitive thread identifiers;

[0132] The thread migration event matching module 44 is used to search for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event, and obtain the target migration thread identifier.

[0133] Network transmission event location module 45 is used to find the target network transmission event corresponding to the target migration thread identifier in the network communication event;

[0134] The privacy leak detection result output module 46 is used to reconstruct the entire link of privacy data from sensitive interface call to network transmission based on the sensitive interface call event, the target thread migration event and the target network transmission event, and obtain the privacy leak detection result.

[0135] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination. Specific examples in this embodiment can be found in the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0136] Furthermore, in conjunction with the mobile application privacy leakage detection method in the above embodiments, this application embodiment can provide a storage medium for implementation. This storage medium stores a computer program; when executed by a processor, the computer program implements any of the mobile application privacy leakage detection methods in the above embodiments.

[0137] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0138] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0139] Those skilled in the art should understand that the technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0140] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for detecting privacy leaks in mobile applications, characterized in that, include: Get the list of privacy-sensitive interfaces; A preset instrumentation script is injected into the process of the application under test, and the list of privacy-sensitive interfaces is passed to the instrumentation script; By running the instrumentation script, the sensitive interfaces in the privacy-sensitive interface list, the thread interaction key functions of the application under test, and the network communication interfaces of the application under test are monitored in real time, and sensitive interface call events, thread operation events, and network communication events are obtained respectively. The sensitive interface call event includes a sensitive thread identifier; In the thread operation event, find the target thread migration event corresponding to the sensitive thread identifier to obtain the target migration thread identifier; In the network communication events, find the target network sending event corresponding to the target migration thread identifier; Based on the sensitive interface call event, the target thread migration event, and the target network transmission event, the entire link of privacy data from the sensitive interface call to the network transmission is reconstructed to obtain the privacy leakage detection result.

2. The mobile application privacy leakage detection method according to claim 1, characterized in that, The thread operation event includes a thread creation event; the thread creation event includes a parent thread identifier, a child thread identifier, and a child thread creation timestamp. The sensitive interface call event also includes a sensitive interface call timestamp; The step of searching for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain the target migration thread identifier includes: In the thread operation event, based on the sensitive thread identifier, the target thread creation event that matches the parent thread identifier and whose child thread creation timestamp is later than the sensitive interface call timestamp is selected; The child thread identifier in the target thread creation event is used as the target migration thread identifier.

3. The mobile application privacy leakage detection method according to claim 1, characterized in that, The thread operation events include message sending events and message processing events; the message sending event includes a message sending thread identifier, message characteristics, and a message sending timestamp; the message processing event includes a message processing thread identifier, message characteristics, and a message processing timestamp. The sensitive interface call event also includes a sensitive interface call timestamp; The step of searching for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain the target migration thread identifier includes: In the message sending event, based on the sensitive thread identifier, target message sending events that match the message sending thread identifier and whose message sending timestamp is later than the sensitive interface call timestamp are selected; In the message processing event, find the target message processing event that has the same message characteristics as the target message sending event and whose message processing timestamp is later than the message sending timestamp in the target message sending event; The message processing thread identifier corresponding to the target message processing event is used as the target migration thread identifier.

4. The mobile application privacy leakage detection method according to claim 1, characterized in that, The thread operation events include task submission events and task execution events; the task submission event includes a task submission thread identifier, a task description, and a task submission timestamp; the task execution event includes a task execution thread identifier, a task description, and a task execution timestamp. The sensitive interface call event also includes a sensitive interface call timestamp; The step of searching for the target thread migration event corresponding to the sensitive thread identifier in the thread operation event to obtain the target migration thread identifier includes: In the task submission event, based on the sensitive thread identifier, target task submission events that match the task submission thread identifier and whose task submission timestamp is later than the sensitive interface call timestamp are selected; In the task execution event, find the target task execution event that matches the task description in the target task submission event and whose task execution timestamp is later than the task submission timestamp in the target task submission event; The task execution thread identifier corresponding to the target task execution event is used as the target migration thread identifier.

5. The mobile application privacy leakage detection method according to any one of claims 1 to 4, characterized in that, The network communication event includes a network communication thread identifier and a network communication timestamp; The step of searching for the target network sending event corresponding to the target migration thread identifier in the network communication event includes: In the network communication events, based on the target migration thread identifier, target network sending events that match the network communication thread identifier and whose network communication timestamp is later than the target migration event operation timestamp are selected; the target migration event operation timestamp includes the sub-thread creation timestamp, message processing timestamp, and task execution timestamp.

6. The mobile application privacy leakage detection method according to claim 1, characterized in that, Based on the sensitive interface call event, the target thread migration event, and the target network transmission event, the entire link of privacy data from the sensitive interface call to the network transmission is reconstructed to obtain the privacy leakage detection result, including: Based on the sensitive interface call event, the target thread migration event, and the target network transmission event, the entire chain of privacy data from sensitive interface call to network transmission is reconstructed to obtain the privacy leakage chain; Extract the statement call information of each step in the privacy leakage chain and determine the taint propagation direction indicated by the privacy leakage chain; Based on the statement call information and the taint propagation direction, a leakage diagram is generated; Based on the leak graph, the privacy leak detection result is obtained.

7. The mobile application privacy leakage detection method according to claim 6, characterized in that, After generating the leakage graph based on the statement call information and the taint propagation direction, the method further includes: Graph feature extraction is performed on the leak graph to obtain a feature matrix; Based on the feature matrix, multiple leakage maps are classified to obtain clustering results; Based on the clustering results, the leakage pattern is obtained.

8. The mobile application privacy leakage detection method according to claim 7, characterized in that, The step of extracting graph features from the leaked graph to obtain a feature matrix includes: Subgraph pattern recognition is performed on the leaked graph to generate frequent subgraph vectors; The node connection relationships and path characteristics in the leak graph are analyzed to obtain the topological structure characteristics; The feature matrix is ​​obtained based on the frequent subgraph vectors and the topological features.

9. A mobile application privacy leakage detection device, characterized in that, The device includes: The interface acquisition module is used to obtain a list of privacy-sensitive interfaces; The script injection module is used to inject a preset instrumentation script into the process of the application under test, and to pass the privacy-sensitive interface list to the instrumentation script. The event monitoring module is used to monitor sensitive interfaces in the privacy-sensitive interface list, key thread interaction functions of the application under test, and network communication interfaces of the application under test in real time by running the instrumentation script, and to obtain sensitive interface call events, thread operation events, and network communication events respectively; the sensitive interface call events include sensitive thread identifiers; The thread migration event matching module is used to find the target thread migration event corresponding to the sensitive thread identifier in the thread operation event, and obtain the target migration thread identifier; The network transmission event location module is used to locate the target network transmission event corresponding to the target migration thread identifier in the network communication event; The privacy leak detection result output module is used to reconstruct the entire link of privacy data from sensitive interface call to network transmission based on the sensitive interface call event, the target thread migration event, and the target network transmission event, and obtain the privacy leak detection result.

10. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the privacy leakage detection method according to any one of claims 1 to 8 when it runs.

Images