Method and system for privacy disclosure detection

Abstract

The embodiment of the invention provides a method and system for privacy disclosure detection. The method comprises the steps of searching a sensitive data source, a disclosure point and an application program interface of a callback function in an installation package according to a constructed sensitive data source, an application program interface table of disclosure points and an application program interface table of callback functions, and obtaining the sensitive data source, the disclosure point and the callback function in the installation package, and establishing an assembly life cycle model through the sensitive data source, the disclosure point and the callback function in the installation package; generating a virtual main function through the callback function in the installation package and the assembly life cycle model; causing the virtual main function to generate an inter-function control flow diagram through conversion, taking the sensitive data source in the installation package as an analysis starting point, analyzing the inter-function control flow diagram according to a data flow taint analysis algorithm, and obtaining a suspicious path of privacy disclosure; and outputting the suspicious path of privacy disclosure. Privacy disclosure behaviors in an application program assembly can be effectively found.

Description

technical field [0001] The present invention relates to the technical field of mobile terminal security, in particular, to a privacy leakage detection method and system. Background technique [0002] As the popularity of mobile devices becomes wider and wider, their functions become more and more powerful. In real life, the data stored in mobile devices is more complex and sensitive, including not only the users personal privacy data (address book, SMS, email, geographic location, photo album, browsing history, etc.), but also the data recorded by the mobile phone system. Logs, these valuable data are the targets of attackers. These valuable data may be leaked in the form of malicious software theft, or may be caused by the unreasonable setting of access rights to third-party application data, which will cause great trouble to users and losses. [0003] Detecting the privacy leakage behavior of applications has become one of the most popular security technologies. Curren...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the purpose of the embodiments of the present invention is to provide a method and system that can effectively discover privacy leakage behaviors in program components, so as to change the defects in the prior art that cannot effectively discover privacy leakage behaviors in application program components

Images