Android Privacy Leakage Detection via Static and Dynamic SDK Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The detection accuracy of determining whether an Android application legally acquires user privacy information is poor, as existing methods only analyze the application without considering associated software development kits (SDKs).
Innovation Solution
A detection method and apparatus that performs reverse parsing and static analysis on Android applications to obtain dynamic loading paths and privacy protocols, including both the application's and the associated SDK's protocols. This method generates detection results indicating legal or illegal use of user privacy information both when the application is running and not running.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If only the Android application is analyzed without considering associated SDKs, then the detection process is simpler and faster, but the detection accuracy of determining whether the application legally acquires user privacy information deteriorates
Solution Approach 1:
The patent segments the detection process into two distinct phases: static analysis (examining the application without running it) and dynamic analysis (examining the application during runtime). This segmentation allows comprehensive detection of privacy information acquisition by both the application and its associated SDKs while maintaining manageable process complexity through structured analysis steps
Solution Approach 2:
The patent merges the analysis of the Android application with the analysis of its associated SDKs into a unified detection framework. By combining static and dynamic analysis results from both the application and SDK components, the system achieves comprehensive detection accuracy without requiring separate independent detection processes
2Measurement precision
If static analysis and dynamic analysis are both performed comprehensively, then the detection accuracy improves, but the detection time and computational resources increase
Solution Approach 1:
The patent performs static analysis as a preliminary action before dynamic analysis. By examining the application and SDK code structures, privacy protocols, and data flow paths in advance, the system prepares detection rules and identifies potential privacy risks beforehand, making the subsequent dynamic analysis more efficient and targeted
Solution Approach 2:
The patent maintains continuity by seamlessly transitioning from static analysis results to dynamic analysis. The static analysis phase continuously informs the dynamic analysis phase by providing pre-identified privacy protocols and data flow patterns, ensuring that the detection process flows without interruption and maximizes the utility of each analysis stage
Data Source
AI summary
Provided are a detection method and apparatus for privacy information leakage and an electronic device. The detection method for privacy information leakage includes: acquiring an application to be detected, and performing reverse parsing on the application to obtain a parsed target file; performing static analysis on the target file to obtain a dynamic loading path and a target privacy protocol of the application; generating a first detection result according to the target privacy protocol and a preset protocol; detecting, according to the dynamic loading path, user privacy information used by the application in a dynamic loading process to generate a second detection result; and determining, according to the first detection result and the second detection result, whether the application is an abnormal application causing leakage of the user privacy information.