Automatic application bug mining system and method under Android platform

Abstract

The invention discloses an automatic application bug mining system and method under an Android platform, and belongs to the technical field of software analysis. The system is mainly divided into an application static analysis module and an application dynamic analysis module; the static analysis module mainly aims at carrying out analysis of control flow and dataflow on android package files (apk), extracting module permission and other property information, and carrying out reachable path analysis on communication problems among the modules in an application; during the dynamic analysis, a Fuzzing test case data is constructed on the basis of a static analysis result at first, Smali code instrumentation is conducted on decompiled Smali files, the application is enabled to run to obtain output information, and under the combination of the static analysis result, bugs existing in the application can be obtained finally. By adopting the automatic application bug mining system and methodunder the Android platform, the bugs possibly existing in the application can be automatically mined, the system and method have certain flexibility and solve the problem that a manual mining mode consumes a lot of time, and meanwhile, by combining the static analysis with the dynamic analysis, the accuracy can be greatly improved.

Description

Technical field [0001] The invention belongs to the technical field of software analysis, and in particular relates to a system and method for automatically digging application vulnerabilities under the Android platform, which mainly includes static analysis and dynamic analysis. Background technique [0002] Since Google officially released the Android system in 2007, it has been favored by many mobile phone manufacturers due to its open source features. At the same time, with the rapid growth of the mobile Internet market, various applications based on the Android platform are in the public eye However, these applications that bring convenience to the general public often have great security risks. Malicious third parties often use these security risks to attack and bring great threats to users. As we all know, the traditional PC-side security technology is relatively mature, but the security technology in the mobile Internet field is relatively backward. The traditional host s...

AI Technical Summary

Problems solved by technology

Sensitive data in Android is mainly obtained by calling the API functions of sensitive data in the system, such as getCallState, getLineNumber, etc. Traditional tainted data tracking and analysis technologies are only applicable to the acquisition of sensitive information. This causes the problem that the source point cannot be obtained, and the analysis of the vulnerability will produce certain false positives

In addition, the traditional taint data tracking technology needs to check one sink point when marking one source data during data tracking. If there are multiple source data, it needs to analyze multiple sink points, which causes a drop in efficiency

Images