Android Privacy Leak Detection by Fusing Static, Dynamic, and Flow Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting privacy leaks in Android applications lack accuracy and comprehensiveness, particularly in identifying the use scenes of permissions and privacy leakage in running environments, and dynamic behavior analysis often interrupts application execution.
Innovation Solution
A detection method that combines static taint analysis, dynamic behavior analysis, and communication flow analysis to identify static taint propagation paths, determine sensitive information, and fuse results to enhance detection accuracy and comprehensiveness, using tools like FlowDroid and Xposed framework for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic behavior analysis is performed by executing the android application, then the detection can identify privacy leakage in running environment, but the application execution is interrupted
Solution Approach 1:
The patent introduces an instrumentation framework as an intermediary layer between the application code and the analysis system. This framework intercepts method calls and executes monitoring code without interrupting the original application flow, allowing dynamic behavior analysis to proceed while maintaining application execution continuity.
Solution Approach 2:
The patent replaces traditional mechanical execution interruption with a software-based monitoring mechanism. Instead of stopping the application to analyze behavior, the system uses bytecode instrumentation to inject monitoring code that automatically tracks privacy-related operations during normal execution, substituting physical interruption with seamless software observation.
2Device complexity
If static analysis and dynamic behavior analysis are performed separately, then the analysis process is simple, but the detection accuracy and comprehensiveness are insufficient
Solution Approach 1:
The patent merges static analysis and dynamic behavior analysis into a unified detection system. The instrumentation framework collects runtime data that complements static analysis results, and both analysis modes share common data structures and processing pipelines, achieving comprehensive detection while managing complexity through integrated architecture.
Solution Approach 2:
The patent creates a multi-functional analysis platform that performs both static and dynamic analysis through a common infrastructure. The same instrumentation framework supports multiple analysis modes, and the system can adaptively switch between or combine analysis types based on detection needs, providing universal functionality across different analysis scenarios.
3Loss of information
If permission information of privacy-related interface is used for detection, then the detection can identify permission usage, but it cannot accurately identify the use scenes of permissions
Solution Approach 1:
The patent segments permission analysis into multiple dimensions: permission declaration, permission request, permission grant, and actual usage. By dividing the permission lifecycle into distinct phases and analyzing each separately, the system achieves both comprehensive permission information coverage and precise use scene identification through hierarchical detail.
Solution Approach 2:
The patent adds temporal and contextual dimensions to permission analysis. Instead of only analyzing permission declarations statically, the system tracks permission usage across time and execution contexts, creating a multi-dimensional view that captures both the breadth of permission information and the precision of specific use scenes through contextual metadata.
Data Source
AI summary
A detection method and apparatus. The detection method includes: performing static stain analysis on an application to be tested to obtain at least one static stain propagation path, each static stain propagation path including a source interface identifier and a destination interface identifier; performing static analysis on the application to obtain the static analysis result; performing dynamic behavior analysis on the application to obtain the dynamic behavior analysis result; obtaining communication flow data throughout the life cycle of the application; taking sensitive information and the category of sensitive information corresponding to the communication URL as the flow analysis result; and fusing the static analysis result, the dynamic behavior analysis result, and the flow analysis result to obtain the detection result.