Accelerometer data-based eavesdropping behavior detection method and device and storage medium

Abstract

The application relates to an eavesdropping behavior detection method, device and storage medium based on accelerometer data, wherein the eavesdropping behavior detection method based on accelerometer data comprises the following steps: obtaining a target mobile application which applies for high-sampling-rate sensor access permission; capturing calling information of an accelerometer of the target mobile application through an application layer or calling information of the accelerometer through a native layer; performing static taint analysis on the target mobile application according to the target calling information, and generating a static data transmission path graph; performing dynamic analysis on the calling information of the target mobile application after dynamic instrumentation of the target mobile application according to the static data transmission path graph, and generating a dynamic data transmission path graph; obtaining a data leakage graph of the accelerometer according to the static data transmission path graph and the dynamic data transmission path graph; and obtaining an eavesdropping behavior detection result of the target mobile application according to the data leakage graph. Through the application, the coverage and accuracy of accelerometer data leakage detection are improved.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to methods, devices and storage media for detecting eavesdropping behavior based on accelerometer data. Background Technology

[0002] With the widespread adoption of smartphones and the rapid development of the mobile application ecosystem, users are increasingly reliant on various mobile applications. The pace of mobile device upgrades is accelerating, and the number of applications with specific functions is increasing dramatically. In this mobile ecosystem, almost everything a user needs has a corresponding application. A large number of applications generate and store users' private information, but attackers are equally interested in this information, potentially compromising user privacy. In recent years, Android malware has exploited vulnerabilities in the Android system or applications running on phones to launch malicious attacks. Because Android's permission-based access controls for sensitive data are insufficient to protect against the misuse of private information, correctly identifying which applications pose a threat is a major issue.

[0003] Some app developers are abusing sensors in Android devices to engage in eavesdropping. Currently, Android's malicious behavior detection primarily targets sensors that significantly impact user privacy, such as microphones, cameras, and location information. Because the accelerometer sensor is classified as a low-risk device, the system allows apps to access it without explicit user authorization. Some app developers are using this accelerometer sensor to eavesdrop, reconstructing voice information from accelerometer data. This includes identifying pre-trained vocabulary, reconstructing untrained vocabulary, obtaining sensitive information from voice assistants, and even using ultra-low frequency readings to recover words, severely infringing on users' privacy rights.

[0004] However, current methods for detecting malicious application behavior primarily analyze application behavior at the application layer, using static analysis and dynamic monitoring. Analyzing only application-layer behavior results in limited detection coverage. Static analysis scans bytecode or source code to check for sensitive privacy breaches. However, static analysis does not monitor the application's dynamic runtime characteristics. Furthermore, malicious applications are often heavily obfuscated to block static analysis. In this regard, dynamic analysis is more effective at detecting malicious behavior because it monitors the program's runtime behavior. Common methods include sandbox environment monitoring and behavioral analysis; however, existing dynamic analysis techniques require well-constructed simulation environments. Current simulation environments cannot generate realistic accelerometer data, causing applications to detect the simulation environment and alter their behavior, making it impossible to reliably reproduce malicious application behavior and prone to program interruption. Modern malware can now effectively detect virtual machine runtime environments.

[0005] There is currently no effective solution to the problems of limited coverage and low accuracy in accelerometer data leakage detection in related technologies. Summary of the Invention

[0006] This embodiment provides a method, device, and storage medium for detecting eavesdropping behavior based on accelerometer data, in order to solve the problems of small coverage and low accuracy in accelerometer data leakage detection in related technologies.

[0007] Firstly, this embodiment provides a method for detecting eavesdropping behavior based on accelerometer data, applied to an Android system, including:

[0008] Obtain the target mobile application to be detected; the target mobile application is the mobile application to be detected that has requested access to the high sampling rate sensor.

[0009] Capture target call information of the target mobile application to the accelerometer, wherein the target call information includes call information of the target mobile application to the accelerometer through the application layer or call information of the target mobile application to the accelerometer through the native layer;

[0010] Based on the target call information, determine the static taint analysis entry point, perform static taint analysis on the target mobile application, and generate a static data transmission path diagram.

[0011] Based on the static data transmission path diagram, the target mobile application is dynamically instrumented, and then the target mobile application is dynamically analyzed to generate a dynamic data transmission path diagram.

[0012] Based on the static data transmission path diagram and the dynamic data transmission path diagram, the data leakage diagram of the accelerometer is obtained;

[0013] The eavesdropping behavior detection results of the target mobile application are obtained based on the data breach graph.

[0014] In some embodiments, capturing target mobile application's target call information to the accelerometer includes:

[0015] Instrumentation is performed on the accelerometer-related source code functions in the Android open-source project source code, and the target mobile application's call information on the accelerometer is captured based on the instrumentation results in the Android open-source project source code.

[0016] In some embodiments, capturing target mobile application's target call information to the accelerometer includes:

[0017] Based on the instrumentation results in the source code of the Android open source project, a customized Android system is compiled and generated.

[0018] Deploy a customized Android system onto physical Android devices;

[0019] On a physical Android device, run the target mobile application through a customized Android system;

[0020] Capture target call information of the target mobile application to the accelerometer from the system layer of the physical Android device.

[0021] In some embodiments, the invocation information of the target mobile application includes the target mobile application's invocation entry point, user identifier, process identifier, package name, and sampling rate.

[0022] In some embodiments, an accelerometer data leakage diagram is obtained based on a static data transmission path diagram and a dynamic data transmission path diagram, including:

[0023] By comparing the dynamic data transmission path diagram and removing the unexecuted paths from the static data transmission path diagram, the target initial data transmission path diagram is obtained.

[0024] By comparing the dynamic data transmission path diagram with the initial data transmission path diagram, a data leakage diagram of the accelerometer is obtained.

[0025] In some of these embodiments, a detection report is generated based on the eavesdropping detection results of the target mobile application, wherein the detection report includes the complete leakage path of the accelerometer data;

[0026] A prompt message is generated based on the test report.

[0027] Secondly, this embodiment provides a device for detecting eavesdropping behavior based on accelerometer data, including: a permission detection module, an Android open-source project source code instrumentation module, a hardware device module, a static analysis module, a dynamic instrumentation analysis module, an integration module, and a generation module, wherein...

[0028] The permission detection module is used to detect whether the mobile application to be detected has requested access to the high sampling rate sensor, and to mark the mobile application that has requested access to the high sampling rate sensor as the target mobile application.

[0029] The Android open-source project source code instrumentation module is used to instrument the source code functions related to the accelerometer in the Android open-source project source code, and capture the target mobile application's target call information to the accelerometer;

[0030] Hardware device module, used to deploy customized Android system to run target mobile applications;

[0031] The static analysis module is used to determine the static taint analysis entry point based on the target call information, perform static taint analysis on the target mobile application, and generate a static data transmission path diagram.

[0032] The dynamic instrumentation analysis module is used to dynamically instrument the target mobile application based on the static data transmission path diagram, and then perform dynamic analysis on the target mobile application to generate a dynamic data transmission path diagram.

[0033] The integration module is used to integrate the static data transmission path diagram and the dynamic data transmission path diagram to obtain the accelerometer's data leakage diagram.

[0034] The generation module is used to obtain the eavesdropping behavior detection results of the target mobile application based on the data breach graph.

[0035] Thirdly, this embodiment provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the accelerometer-based data eavesdropping behavior detection method described in the first aspect above.

[0036] Fourthly, this embodiment provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the accelerometer-based data eavesdropping behavior detection method described in the first aspect above.

[0037] Fifthly, this embodiment provides a storage medium storing a computer program that, when executed by a processor, implements the accelerometer-based data eavesdropping detection method described in the first aspect above.

[0038] Compared with related technologies, the accelerometer data eavesdropping detection method provided in this embodiment solves the problems of small coverage and low accuracy in accelerometer data leakage detection by acquiring the target mobile application to be detected (the target mobile application is the mobile application that has requested access to the high sampling rate sensor); capturing the target mobile application's target call information to the accelerometer, wherein the target call information includes the target mobile application's call information to the accelerometer through the application layer or the target mobile application's call information to the accelerometer through the native layer; determining the static taint analysis entry point based on the target call information, performing static taint analysis on the target mobile application, and generating a static data transmission path diagram; performing dynamic instrumentation on the target mobile application based on the static data transmission path diagram, and then performing dynamic analysis on the target mobile application to generate a dynamic data transmission path diagram; obtaining the accelerometer data leakage diagram based on the static data transmission path diagram and the dynamic data transmission path diagram; and obtaining the eavesdropping behavior detection result of the target mobile application based on the data leakage diagram. This method improves the coverage and accuracy of accelerometer data leakage detection by addressing the issues of small coverage and low accuracy in accelerometer data leakage detection.

[0039] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0040] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0041] Figure 1 This is a hardware structure block diagram of the terminal based on the accelerometer data eavesdropping behavior detection method in this embodiment.

[0042] Figure 2 This is a flowchart of the accelerometer data eavesdropping behavior detection method in this embodiment.

[0043] Figure 3 This is a flowchart of another method for detecting eavesdropping behavior based on accelerometer data in this embodiment.

[0044] Figure 4 This is a structural block diagram of the accelerometer-based eavesdropping detection device in this embodiment. Detailed Implementation

[0045] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0046] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning as understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these,” used in this application, do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to such processes, methods, products, or devices. The terms “connected,” “linked,” and “coupled,” used in this application, are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. The term “multiple” used in this application refers to two or more. The "and / or" operator describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: A alone, A and B simultaneously, and B alone. Typically, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," and "third," etc., used in this application are merely for distinguishing similar objects and do not represent a specific ordering of the objects.

[0047] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1 This is a hardware structure block diagram of the terminal based on the accelerometer data eavesdropping behavior detection method in this embodiment. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0048] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the accelerometer data eavesdropping behavior detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0049] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0050] This embodiment provides a method for detecting eavesdropping behavior based on accelerometer data. Figure 2 This is a flowchart of the accelerometer data eavesdropping behavior detection method in this embodiment, as shown below. Figure 2 As shown, the process includes the following steps:

[0051] Step S201: Obtain the target mobile application to be detected; the target mobile application is the mobile application to be detected that has applied for high sampling rate sensor access permissions.

[0052] Specifically, in this application, a mobile application (APP) is an application designed and developed for mobile devices (such as smartphones, tablets, smartwatches, etc.). A mobile application can be designed for a specific function or service, such as social media, games, health tracking, office software, map navigation, music and video playback, etc. Currently, because accelerometer sensors are classified as low-risk devices, the Android system allows mobile applications to access them without explicit user authorization. This causes the Android system to ignore mobile applications accessing accelerometer data to obtain users' private information when detecting eavesdropping behavior. Therefore, this application specifically targets the monitoring of accelerometer data eavesdropping.

[0053] First, the sampling rate refers to the frequency at which accelerometer data is acquired, usually measured in Hertz (Hz). A high sampling rate means acquiring sensor data more frequently, which may be used for real-time monitoring or data theft. A high sampling rate sensor access permission (HIGH_SAMPLING_RATE_SENSOR) is set. When a mobile application needs to access a sampling rate higher than the system default limit, it must first request this access permission. By requesting this access permission, it is initially determined whether the mobile application is suspected of data theft, thus restricting mobile applications suspected of data theft, but allowing legitimate applications that genuinely need high sampling rate data (such as professional health monitoring or sports analysis applications) to access this data with user authorization. The system detects whether the mobile application to be tested has requested the HIGH_SAMPLING_RATE_SENSOR permission. If so, the mobile application to be tested that has requested the HIGH_SAMPLING_RATE_SENSOR permission is identified as potentially engaging in data theft and is therefore the target mobile application to be tested in this application.

[0054] Step S202: Capture the target call information of the target mobile application to the accelerometer, wherein the target call information includes the call information of the target mobile application to the accelerometer through the application layer or the call information of the target mobile application to the accelerometer through the native layer.

[0055] Specifically, since the accelerometer can be invoked by mobile applications through the native layer, in this application, a native layer call refers to a mobile application directly calling the operating system or hardware interface through native code (such as C / C++), rather than through system APIs provided by high-level languages ​​(such as Java). Currently, when detecting malicious behavior in mobile applications, analysis is often limited to the application layer, neglecting the behavior of mobile applications directly calling from the native layer. This results in the failure to detect mobile applications stealing data through the accelerometer, leading to incomplete detection. To solve this problem, this application detects the target mobile application's call behavior at both the application layer and the native layer. Application layer detection determines whether the target mobile application has performed a call at the application layer, and native layer detection determines whether the target mobile application has performed a call at the native layer. The obtained call behavior is used as target call information for further detection. This solves the current problem of incomplete detection of mobile application data theft.

[0056] Step S203: Determine the static taint analysis entry point based on the target call information, perform static taint analysis on the target mobile application, and generate a static data transmission path diagram;

[0057] Specifically, static analysis first detects potential security vulnerabilities in the target call information without the mobile application running. It's a technique that, without executing the program, analyzes source code or bytecode to trace and identify potential sensitive information leakage paths in the data flow. It can discover all possible data propagation paths in a program, but may suffer from path explosion and false positives. Static analysis identifies potential malicious behavior by examining the source code or bytecode of a mobile application. Static analysis tools can detect permission declarations, API calls, data flow, etc., in mobile applications, helping to discover potential privacy leakage risks or malicious code. Through static analysis, security vulnerabilities can be discovered and fixed before application release, thereby improving the application's security and trustworthiness.

[0058] For example, using the highly accurate static taint analysis tool FlowDroid to perform static taint tracking on the Android Package (APK) file of a mobile application involves: FlowDroid first parses the target mobile application's APK file (which contains all the target mobile application's code, resources, assets, and metadata; users can install and run the mobile application on an Android device through the APK file), extracting the target mobile application's bytecode and related resource files. By analyzing the bytecode, FlowDroid constructs a data flow graph, which shows the flow path of data within the target mobile application. Based on the data flow graph, FlowDroid simulates the propagation of tainted data (such as accelerometer data), starting from the data source and tracking how the data propagates in the program until it reaches a potential sink. If tainted data can propagate from the source to a potentially insecure sink, FlowDroid will report this path, indicating a potential security vulnerability. The path of data propagation and the entry point that is called constitute a static data transmission path graph. During the process of accelerometer data being accessed, FlowDroid records the entry function (source) of the accelerometer data call, i.e., the target call information, when data is obtained through SensorManager. This entry function is set as the source node (static taint) in FlowDroid. Data leakage-related functions such as network communication and logging in the static analysis module are set as sink nodes. Then, FlowDroid tracks how these static taints propagate in the application, including whether they are stored, modified, or sent over the network, thereby obtaining the data flow information of accelerometer data access and generating a static data transmission path graph.

[0059] Step S204: After dynamically instrumenting the target mobile application according to the static data transmission path diagram, dynamically analyze the target mobile application to generate a dynamic data transmission path diagram.

[0060] Specifically, instrumentation refers to inserting additional monitoring code into software source code, bytecode, or binary code to collect execution information such as logs, performance data, or security events at runtime. Dynamic instrumentation analysis is a technique that tracks and records the actual execution behavior and data flow of a program by inserting monitoring code during runtime. It can provide accurate runtime information but may not cover all execution paths. Therefore, dynamic instrumentation is performed on all relevant functions in the static data transmission path graph, and on related subsequent call functions. The relevant functions in the static data transmission path serve as nodes for dynamic instrumentation. Using a dynamic analysis module as the entry point, and through Java reflection, Java methods are dynamically loaded and manipulated. Frida's API is used to trace the actual function calls, recording the transmission path of accelerometer data, thereby obtaining the actual data call path of the target mobile application calling accelerometer data and generating a dynamic data transmission path graph. By dynamically instrumenting the target mobile application, efficient identification and accurate tracking of data leakage paths can be achieved.

[0061] Step S205: Based on the static data transmission path diagram and the dynamic data transmission path diagram, obtain the accelerometer data leakage diagram.

[0062] Specifically, the data transmission paths in the static data transmission path diagram are integrated with the actually executed data transmission paths in the dynamic data transmission path diagram. Data transmission paths that were not actually executed in the static data transmission path are removed, and data transmission paths not mentioned in the static data transmission path are completed, resulting in the final accelerometer data leakage diagram. This data leakage diagram contains the complete path from data acquisition to data leakage. The integrity of the data leakage path is ensured by combining static and dynamic analysis of the target mobile application.

[0063] Step S206: Obtain the eavesdropping behavior detection results of the target mobile application based on the data breach graph.

[0064] Based on the obtained data breach graph, it was determined that the target mobile application posed a privacy breach risk, and its behavior was deemed a privacy breach. Users are advised to uninstall it or use it with caution.

[0065] Through steps S201 to S206 above, the target mobile application to be detected is obtained; the target mobile application is the mobile application to be detected that has requested access to the high sampling rate sensor; the target call information of the target mobile application to the accelerometer is captured, wherein the target call information includes the target mobile application's call information to the accelerometer through the application layer or the target mobile application's call information to the accelerometer through the native layer; the static taint analysis entry point is determined according to the target call information, static taint analysis is performed on the target mobile application, and a static data transmission path diagram is generated; according to the static data transmission path diagram, after dynamic instrumentation of the target mobile application, dynamic analysis is performed on the target mobile application, and a dynamic data transmission path diagram is generated; according to the static data transmission path diagram and the dynamic data transmission path diagram, the data leakage diagram of the accelerometer is obtained; the eavesdropping behavior detection result of the target mobile application is obtained according to the data leakage diagram. Compared to current methods that only detect mobile application behavior at the application layer and rely solely on static analysis and dynamic execution monitoring, this embodiment pre-screens potential malicious applications by judging HIGH_SAMPLING_RATE_SENSOR permission requests. Furthermore, by simultaneously detecting calls at both the application and native layers, it addresses the issue of privacy data leakage caused by ignoring mobile applications directly calling accelerometer data at the native layer, thus further improving the comprehensiveness of detection. Finally, based on the obtained call information, it determines the static taint analysis entry point and combines static taint analysis and dynamic instrumentation analysis on the target mobile application, improving the coverage and accuracy of the leaked data graph.

[0066] In one embodiment, capturing target call information from the target mobile application to the accelerometer includes:

[0067] Instrumentation is performed on the accelerometer-related source code functions in the Android open-source project source code, and the target mobile application's call information on the accelerometer is captured based on the instrumentation results in the Android open-source project source code.

[0068] Specifically, current mobile application malicious behavior detection primarily analyzes application-layer behavior, neglecting the fact that accelerometer calls can be made by mobile applications through native layer calls, thus limiting the detection scope of current technologies. Therefore, this embodiment identifies accelerometer-related source code files in the Android Open Source Project (AOSP) and inserts log printing or other monitoring code at relevant function call points to capture accelerometer call information. For example, methods for registering and deregistering sensor listeners are found in the SensorService.cpp class, and code is inserted into these methods. This instrumented code captures information such as the target mobile application's User ID (UID), Process ID (PID), package name, and sampling rate. Instrumenting the AOSP source code enhances the capture of target mobile applications' calls to accelerometer data through the native layer. Combined with existing methods for detecting target mobile applications' calls to accelerometer data through the application layer, this comprehensively covers all potential accelerometer data acquisition paths, ensuring comprehensive monitoring of all accelerometer call entry points and improving the comprehensiveness and accuracy of detection.

[0069] In another embodiment, capturing target call information from the target mobile application to the accelerometer includes:

[0070] Based on the instrumentation results in the source code of the Android open source project, a customized Android system is compiled and generated; the customized Android system is deployed to a physical Android device; on the physical Android device, the target mobile application is run through the customized Android system; and the target call information of the target mobile application to the accelerometer is captured from the system layer of the physical Android device.

[0071] Specifically, current dynamic analysis primarily involves monitoring the behavior of mobile applications during runtime to identify abnormal data access and transmission. This mainly relies on the Android virtual machine environment for detection, with common methods including sandbox environment monitoring and behavioral analysis. However, existing Android virtual machine simulation environments cannot access real accelerometer sensors or generate realistic accelerometer data. This makes them vulnerable to detection by target mobile applications, allowing them to alter their behavior and evade monitoring, thus failing to reliably capture malicious behavior. Therefore, in this embodiment, after instrumenting the accelerometer-related system source code functions in the AOSP source code, the entire system is compiled using the compilation tools and environment provided by AOSP. During compilation, it is ensured that the instrumented code is correctly integrated into the system without affecting other system functions. The compiled system is then deployed to a physical Android device, where a customized Android system is started, and the target mobile application is installed and run. This ensures that the target mobile application can access the accelerometer normally. Accelerometer call information is captured through system-level log services such as logcat, and log files are analyzed to extract detailed information from the instrumented code output, such as UID, PID, package name, and sampling rate. By utilizing the captured data, the behavioral patterns of the target mobile application are analyzed to identify abnormal data access and transmission. Compared to current detection methods that rely on Android virtual machine environments, this embodiment deploys a customized AOSP system on a physical Android device. Accelerometer-based eavesdropping behavior can be accurately captured and analyzed on the real device, ensuring the authenticity and reliability of the accelerometer data. This overcomes the detection limitations imposed by virtual machine environments and improves the effectiveness and reliability of the detection.

[0072] In some embodiments, the invocation information of the target mobile application includes the invocation entry point of the target mobile application, user identifier, process identifier, package name, and sampling rate.

[0073] Specifically, the target mobile application's access information to accelerometer data includes the entry point, i.e., the specific location within the application where accelerometer-related functions begin execution. The entry point initially determines the location where accelerometer data is accessed. By obtaining the target mobile application's identifier, the specific target mobile application using the accelerometer can be tracked. The User Identifier (UID) is a unique identifier assigned to each application by the operating system. In the Android system, each application is assigned a UID upon installation to identify and manage its permissions and resource access. The Process Identifier (PID) is a unique identifier assigned to a running process by the operating system. When monitoring accelerometer usage, the PID can be used to determine which process is accessing the accelerometer sensor data. The package name is the name of the Java class specifically responsible for capturing accelerometer data. The sampling rate refers to the frequency at which accelerometer data is collected. By obtaining the sampling rate, the target mobile application's demand for and usage patterns of accelerometer sensor data can be analyzed, allowing for further analysis to determine if data theft is occurring.

[0074] In another embodiment, an accelerometer data leakage diagram is obtained based on the static data transmission path diagram and the dynamic data transmission path diagram, including:

[0075] By comparing the dynamic data transmission path diagram and removing the unexecuted paths from the static data transmission path diagram, we obtain the initial data transmission path diagram. By comparing the dynamic data transmission path diagram and completing the initial data transmission path diagram, we obtain the accelerometer data leakage diagram.

[0076] Specifically, after deploying the customized Android system to a physical Android device, the system-level monitoring module captures the target mobile application calling the accelerometer sensor at a high sampling rate and records the entry function for the accelerometer data call, i.e., the target call information. This entry function is set as the source node of FlowDroid, i.e., a static taint. Functions related to data leakage, such as network communication and log recording, in the static analysis module are set as sink nodes. FlowDroid performs static taint analysis to obtain a static data transmission path graph. Simultaneously, the relevant functions in the static data transmission path serve as nodes for dynamic instrumentation. Through the dynamic analysis module as the entry point, dynamic analysis is performed to obtain the dynamic data transmission path. Key information, such as the time point of data access, access frequency, and data flow direction, is extracted from the dynamic data transmission path to form the dynamic analysis results. The data transmission path graph in the dynamic data transmission path graph is the actual data transmission path obtained by tracing each source node. This includes paths actually executed through the source node and paths not actually executed through the source node. Paths not actually executed refer to paths that only call the source node but do not transmit data through it. Static analysis provides information about the application's data flow at compile time, including all possible data access paths and data processing logic.

[0077] By comparing the data transmission paths in the static data transmission path diagram with those in the dynamic data transmission path diagram, paths that were not executed during actual operation in the static diagram are identified and removed, resulting in an initial data transmission path diagram that does not include unexecuted data transmission paths. Then, the actual data transmission paths in the dynamic data transmission path diagram are examined to complete the data transmission paths corresponding to source nodes not covered in the static diagram, resulting in a more comprehensive accelerometer data leakage diagram. This data leakage diagram not only includes all possible data flows of the target mobile application during compilation but also incorporates data access and transmission behaviors during actual runtime, improving the comprehensiveness and accuracy of accelerometer data leakage detection.

[0078] In some embodiments, a detection report is generated based on the eavesdropping detection results of the target mobile application, wherein the detection report includes the complete leakage path of the accelerometer data; and a prompt message is generated based on the detection report.

[0079] Specifically, after acquiring all data access and transmission events of the target mobile application during accelerometer usage, the acquired data is analyzed. This includes how the target mobile application requests permissions, accesses sensor data, and how the data is transmitted over the network. A detection report is generated based on the analysis results. This report can include the complete leakage path of the accelerometer data, from the moment the data is read from the sensor, through application processing, to its final transmission to an external server or storage. The report may also include a data leakage risk assessment, identifying security vulnerabilities at various stages, such as unencrypted data transmission and excessive permission requests. Based on the report, user alerts are generated, which may include suggestions such as uninstalling or using the app with caution, updating the app to the latest version, changing privacy settings, or contacting the app developer for more information.

[0080] This embodiment also provides a method for detecting eavesdropping behavior based on accelerometer data. Figure 3 This is a flowchart of another method for detecting eavesdropping behavior based on accelerometer data in this embodiment, as shown below. Figure 3 As shown, the process includes the following steps:

[0081] Step S301: Instrument the source code functions related to the accelerometer in the Android open source project source code; based on the instrumentation results in the Android open source project source code, compile and generate a customized Android system; deploy the customized Android system to a physical Android device.

[0082] Step S302: On a physical Android device, run the target mobile application through a customized Android system;

[0083] Step S303: Obtain the target mobile application to be detected; the target mobile application is the mobile application to be detected that has applied for high sampling rate sensor access permissions.

[0084] Step S304: Capture the target call information of the target mobile application to the accelerometer, wherein the target call information includes the call information of the target mobile application to the accelerometer through the application layer or the call information of the target mobile application to the accelerometer through the native layer.

[0085] Step S305: Determine the static taint analysis entry point based on the target call information, perform static taint analysis on the target mobile application, and generate a static data transmission path diagram;

[0086] Step S306: After dynamically instrumenting the target mobile application according to the static data transmission path diagram, dynamically analyze the target mobile application to generate a dynamic data transmission path diagram.

[0087] Step S307: Compare the dynamic data transmission path diagram, remove the unexecuted paths in the static data transmission path diagram to obtain the initial data transmission path diagram; compare the dynamic data transmission path diagram, complete the initial data transmission path diagram to obtain the accelerometer data leakage diagram;

[0088] Step S308: Obtain the eavesdropping behavior detection results of the target mobile application based on the data breach graph;

[0089] Step S309: Based on the detection results of the eavesdropping behavior of the target mobile application, generate a detection report and a prompt message, wherein the detection report includes the complete leakage path of the accelerometer data.

[0090] Specifically, an application requests the HIGH_SAMPLING_RATE_SENSOR permission and frequently acquires accelerometer data in the background. The detection process using the method described in this embodiment is as follows:

[0091] 1. The permission detection module parses the application's APK file and finds that it has requested the HIGH_SAMPLING_RATE_SENSOR permission. Based on this permission request, the system marks the application as suspicious and starts the analysis program.

[0092] 2. The system-level monitoring module detects that the application is calling the accelerometer sensor at a high sampling rate and records the entry points for accelerometer data calls. These entry points are set as source nodes (static taints) in FlowDroid, while data leakage-related functions such as network communication and log recording in the static analysis module are set as sink nodes. FlowDroid then performs static taint analysis.

[0093] 3. The static analysis module parses the application code, constructs a function call graph, and generates a flow graph of accelerometer data to obtain a static data transmission path graph, thus making a preliminary judgment on potential data leakage points.

[0094] 4. The dynamic instrumentation analysis module performs dynamic instrumentation on the application based on the static data transmission path diagram, and uses Frida tools to perform dynamic analysis on the APK, tracking the application's call stack and data flow path in real time.

[0095] 5. Combining the results of the dynamic piling analysis module and the static analysis module, construct a complete accelerometer data leakage path diagram.

[0096] 6. The application's access to accelerometer data is identified as a clear privacy breach, and users are advised to uninstall it or use it with caution.

[0097] Through steps S301 to S309, compared to current methods that only detect the behavior of mobile applications at the application layer and rely solely on static analysis and dynamic execution monitoring, this embodiment preliminarily determines whether a mobile application is high-risk by detecting whether it has requested the HIGH_SAMPLING_RATE_SENSOR permission. By setting a high sampling rate permission, it solves the problem of applications being allowed to access accelerometer sensors without explicit user authorization because these sensors are classified as low-risk devices, thus preemptively screening potential malicious applications. Furthermore, by instrumenting the accelerometer-related API function source code in the AOSP source code, the detection mechanism becomes more sophisticated. By delving into the native layer, this approach addresses the limitation of existing technologies that restrict detection to the application layer, resulting in limited detection coverage. It deploys an instrumented AOSP Android system onto physical Android devices to realistically detect the calling behavior of target mobile applications. This solves the problem in existing technologies where virtual machine simulations cannot generate realistic accelerometer data, allowing mobile applications to evade detection and making it impossible to reliably capture malicious behavior. By combining static taint analysis and dynamic instrumentation analysis, a more comprehensive transmission path for target mobile applications calling accelerometer data is obtained, enabling efficient identification and accurate tracking of complex data leakage paths, thus improving detection coverage and accuracy.

[0098] This embodiment also provides an accelerometer-based eavesdropping detection device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. The terms "module," "unit," and "subunit," etc., used below refer to combinations of software and / or hardware that perform a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0099] Figure 4This is a structural block diagram of the accelerometer-based data eavesdropping detection device in this embodiment, as shown below. Figure 4 As shown, the device 40 includes: a permission detection module 41, an Android open-source project source code instrumentation module 42, a hardware device module 43, a static analysis module 44, a dynamic instrumentation analysis module 45, an integration module 46, and a generation module 47, wherein...

[0100] The permission detection module 41 is used to detect whether the mobile application to be detected has requested access to the high sampling rate sensor, and to mark the mobile application that has requested access to the high sampling rate sensor as the target mobile application.

[0101] Android open-source project source code instrumentation module 42 is used to instrument source code functions related to accelerometers in Android open-source project source code and capture target call information of target mobile applications to accelerometers;

[0102] Hardware device module 43 is used to deploy a customized Android system to run the target mobile application;

[0103] Static analysis module 44 is used to determine the static taint analysis entry point based on the target call information, perform static taint analysis on the target mobile application, and generate a static data transmission path diagram.

[0104] The dynamic instrumentation analysis module 45 is used to perform dynamic instrumentation on the target mobile application based on the static data transmission path diagram, and then perform dynamic analysis on the target mobile application to generate a dynamic data transmission path diagram.

[0105] Integration module 46 is used to integrate the static data transmission path diagram and the dynamic data transmission path diagram to obtain the accelerometer data leakage diagram;

[0106] The generation module 47 is used to obtain the eavesdropping behavior detection results of the target mobile application based on the data leakage graph.

[0107] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.

[0108] This embodiment also provides an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0109] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0110] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0111] S1, Obtain the target mobile application to be detected; the target mobile application is the mobile application to be detected that has requested access to the high sampling rate sensor.

[0112] S2, capture the target call information of the target mobile application to the accelerometer, wherein the target call information includes the call information of the target mobile application to the accelerometer through the application layer or the call information of the target mobile application to the accelerometer through the native layer;

[0113] S3, determine the static taint analysis entry point based on the target call information, perform static taint analysis on the target mobile application, and generate a static data transmission path diagram;

[0114] S4. Based on the static data transmission path diagram, the target mobile application is dynamically instrumented and then dynamically analyzed to generate a dynamic data transmission path diagram.

[0115] S5. Based on the static data transmission path diagram and the dynamic data transmission path diagram, obtain the data leakage diagram of the accelerometer;

[0116] S6, obtain the eavesdropping behavior detection results of the target mobile application based on the data breach graph.

[0117] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0118] This embodiment also provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in any of the above method embodiments.

[0119] Furthermore, in conjunction with the accelerometer-based eavesdropping detection method provided in the above embodiments, this embodiment can also provide a storage medium for implementation. This storage medium stores a computer program; when executed by a processor, the computer program implements any of the accelerometer-based eavesdropping detection methods described in the above embodiments.

[0120] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0121] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0122] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0123] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0124] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0125] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A method for detecting eavesdropping behavior based on accelerometer data, applied in an Android system, characterized in that, include: Obtain the target mobile application to be detected; The target mobile application is the mobile application to be detected that has requested access to a high sampling rate sensor; Capture the target call information of the target mobile application to the accelerometer, wherein the target call information includes the call information of the target mobile application to the accelerometer through the application layer or the call information of the target mobile application to the accelerometer through the native layer; Based on the target call information, determine the static taint analysis entry point, perform static taint analysis on the target mobile application, and generate a static data transmission path diagram. Based on the static data transmission path diagram, the target mobile application is dynamically instrumented, and then the target mobile application is dynamically analyzed to generate a dynamic data transmission path diagram. Based on the static data transmission path diagram and the dynamic data transmission path diagram, the data leakage diagram of the accelerometer is obtained; The eavesdropping behavior detection results of the target mobile application are obtained based on the data leakage diagram.

2. The method for detecting eavesdropping behavior based on accelerometer data according to claim 1, characterized in that, The capture of the target mobile application's target call information to the accelerometer includes: Instrumentation is performed on the source code functions related to the accelerometer in the Android open-source project source code, and the target call information of the target mobile application to the accelerometer is captured based on the instrumentation results in the Android open-source project source code.

3. The method for detecting eavesdropping behavior based on accelerometer data according to claim 2, characterized in that, The capture of the target mobile application's target call information to the accelerometer includes: Based on the instrumentation results in the Android open-source project source code, a customized Android system is compiled and generated. Deploy the customized Android system onto a physical Android device; The target mobile application runs on the physical Android device via the customized Android system; Capture the target mobile application's target call information to the accelerometer from the system layer of the physical Android device.

4. The method for detecting eavesdropping behavior based on accelerometer data according to claim 1, characterized in that, The invocation information of the target mobile application includes the invocation entry point, user identifier, process identifier, package name, and sampling rate of the target mobile application.

5. The method for detecting eavesdropping behavior based on accelerometer data according to claim 1, characterized in that, The step of obtaining the data leakage diagram of the accelerometer based on the static data transmission path diagram and the dynamic data transmission path diagram includes: By comparing the dynamic data transmission path diagram with the static data transmission path diagram and removing the unexecuted paths, an initial data transmission path diagram is obtained. By comparing the dynamic data transmission path diagram with the initial data transmission path diagram, the data leakage diagram of the accelerometer is obtained.

6. The method for detecting eavesdropping behavior based on accelerometer data according to claim 1, characterized in that, The method further includes: Based on the eavesdropping detection results of the target mobile application, a detection report is generated, wherein the detection report includes the complete leakage path of the accelerometer data; A prompt message is generated based on the test report.

7. A device for detecting eavesdropping behavior based on accelerometer data, characterized in that, include: The system includes a permission detection module, an Android open-source project source code instrumentation module, a hardware device module, a static analysis module, a dynamic instrumentation analysis module, an integration module, and a generation module. The permission detection module is used to detect whether the mobile application to be detected has applied for high sampling rate sensor access permission, and to mark the mobile application that has applied for high sampling rate sensor access permission as the target mobile application. The Android open-source project source code instrumentation module is used to instrument source code functions related to the accelerometer in the Android open-source project source code and capture the target call information of the target mobile application to the accelerometer. The hardware device module is used to deploy a customized Android system to run the target mobile application; The static analysis module is used to determine the static taint analysis entry point based on the target call information, perform static taint analysis on the target mobile application, and generate a static data transmission path diagram. The dynamic instrumentation analysis module is used to perform dynamic instrumentation on the target mobile application based on the static data transmission path diagram, and then perform dynamic analysis on the target mobile application to generate a dynamic data transmission path diagram. The integration module is used to integrate the static data transmission path diagram and the dynamic data transmission path diagram to obtain the data leakage diagram of the accelerometer; The generation module is used to obtain the eavesdropping behavior detection result of the target mobile application based on the data leakage graph.

8. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method for detecting eavesdropping behavior based on accelerometer data as described in any one of claims 1 to 6.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for detecting eavesdropping behavior based on accelerometer data as described in any one of claims 1 to 6.

Images