An Android privacy disclosure behavior detection method and technology based on information flow

Abstract

The invention discloses an Android privacy disclosure behavior detection method and a system based on information flow. The method comprises the following steps: 1) extracting components, permissionsand intention filter information from resource files and Dex files to generate a control flow diagram between processes; 2) analyzing the callback sequence of the application program, constructing theCCFG (Callback Function Control Flow Graph), and checking the potential privacy leakage path by using the static stain tracking analysis ICFG and CCFG; 3) extracting context and attribute values of cross-component communication through HOOK key API in customized sandbox, and optimizing privacy information flow constructed by static analysis; 4) the run program tracking and analyzing the dynamic stain, obtaining the path of the flow direction of the privacy information, and simultaneously extracting the context of the path; 5) according to the privacy leakage paths generated by monitoring logsand stain tracking analysis, the redundancy being removed or new privacy leakage paths being added in combination with context information; 6) the general information entropy method and visual clustering method being used to quantitatively analyze the privacy information leakage.

Description

technical field [0001] The invention relates to an Android privacy information leakage behavior detection method and technology based on information flow analysis, belonging to a mobile security privacy leakage behavior detection technology and system. Background technique [0002] Due to the rise of wireless networks and mobile applications, the replacement rate of mobile devices has accelerated, and the number of applications with specific functions has increased dramatically. In the mobile ecosystem, there are corresponding applications for almost everything that users need. Due to the low market threshold, it attracts a large number of developers and even hackers with ulterior motives. The Android system completes data sharing between processes through Binder, and at the same time uses the permission pop-up box to display the permissions requested by the application to the user. Due to the open source characteristics of the Android system and the emergence of more and mo...

AI Technical Summary

Problems solved by technology

However, the existing dynamic analysis technology needs to build a good simulation event, which is prone to program interruption. The latest malware has been able to detect that the runtime environment is a virtual machine, which brings limitations to dynamic analysis.

Images