AppAudit：融合静态与动态分析的实时Android应用审核

5 浏览量更新于2024-07-15 收藏 750KB PDF 举报

"有效的实时Android应用审核" 这篇研究论文"Effective Real-time Android Application Auditing"探讨了如何提升Android应用的安全审计效率，特别是在实时性方面。移动应用程序可以访问敏感的个人信息和网络，这使得数据泄露成为一大威胁。应用审计是发现此类泄露的基础程序分析任务。目前，静态分析是主流的技术，它通过全面检查所有数据流来找出问题。然而，静态分析存在误报（即假阳性）的问题，因为它过于保守，并且分析大型应用可能需要几分钟甚至更长时间。这些缺点限制了自动应用审计的实际应用。为了克服这些局限，作者们设计了一个名为AppAudit的系统，该系统融合了静态分析和动态分析的优势，以实现有效的实时应用审计。AppAudit引入了一种创新的动态分析方法，能够模拟程序的部分执行，并在每个程序状态进行定制的检查。这种动态分析有助于剔除静态分析产生的误报，提高了审计的准确性。具体来说，AppAudit在程序运行时监控关键操作，如数据访问和网络通信，通过动态跟踪数据流，能够在实际运行环境中识别潜在的安全问题。同时，它结合静态分析的全面性，对无法通过动态分析覆盖的所有路径进行补充检查，确保审计的全面性。此外，AppAudit还利用静态分析的预处理步骤，提前识别可能的敏感数据源和目标，这样可以在动态分析阶段更加聚焦于可能存在问题的部分，从而减少了分析时间。这种混合方法显著提高了审计效率，使得在应用运行过程中就能及时发现并防止数据泄露。 AppAudit的提出是针对当前应用审计挑战的一个重要进展，它结合两种分析技术的优点，旨在提供更精确、更快捷的实时安全审计，对于保障Android用户的数据安全具有重要意义。

Category Trigger API Extended function calls

Android RPC

Context.startService() u.onCreate(), ∀u extends Service

Context.startActivity() u.onCreate(), ∀u extends Activity

Context.sendBroadcast() u.onReceive(), ∀u extends BroadcastReceiver

AlarmManager.setRepeating() all the three above

... and 4 more

GUI Callbacks

setOnClickListener() u.onClick(), ∀u extends OnClickListener

... and 180 more [10]

Multi-threading

Thread.start() u.run(), ∀u extends Thread

AsyncTask.execute() u.doInBackground(), ∀u extends AsyncTask

... and 14 more

Table I: Trigger APIs and extended function calls.

Service class.

B. API Usage Analysis

Checking whether a given function is suspicious is equiv-

alent to ﬁnding a path from the function to a source API and

a path to a sink API. We ﬁrst build a standard call graph

from program bytecode and then extend it with dummy

functions and extra calling relationships according to above-

mentioned cases. To accelerate the construction algorithm,

we omit Android library functions except for source, sink

and trigger APIs. We want to focus on application functions

and avoid analyzing the Android runtime library. After the

extended call graph is constructed, we perform a breadth-

ﬁrst search to mark all suspicious functions. For example,

with the extended call graph in Figure 3, the static API

analysis can reveal four suspicious functions (BR1, f1 and

f7, f3) while a conventional call graph can only reveal f3.

Overall, the extended call graph is an over-approximated

call graph with calling relationships that will not happen

in real execution. Consequently, our static API analysis

could mark “good” functions as suspicious in trade for

the analysis performance. While previous work [9] employs

more complicated analyses to achieve better heuristic at the

cost of performance, AppAudit takes an opposite direction

and relies on dynamic analysis to prune false positives.

IV. APPROXIMATED EXECUTION

The static API analysis is over-approximating, which

could result in false positives. We use a dynamic analysis to

conﬁrm actual data leaks and prune false positives.

The approximated executor is a dynamic analysis that

executes the bytecode instructions of a suspicious function

and reports if sensitive data could be leaked during the

execution. The executor has a typical register set, a program

counter (pc), a call stack as its execution context. It relies

on a novel object model to represent application memory

objects. The executor has three working modes, as shown

in Figure 4. It starts with “execution (exec)” mode, where it

interprets bytecodes and performs operations. Source APIs

can generate sensitive data objects, where we mark them as

“tainted”. Tainted objects propagate with the execution and

leap

exec

checkapprox

calling sink

functions

unknown

branching

tainted data

leaked

no taint

insuﬃcient

context

resume

known

end

Figure 4: AppAudit approximated executor state machine.

taint any object that is derived from them. Whenever the

executor encounters a sink API, it changes to “check” mode

to check the parameters for the sink API. If tainted objects

are found, the executor reports the leak and terminates

(“end” ﬁnal state). Otherwise, it reverts back to the normal

execution mode. When certain bytecode instruction cannot

be executed due to unknown operands (e.g. a conditional

jump instruction with unknown condition), the executor

switches to “approximation (approx)” mode for approxi-

mations to continue the execution. If the approximations

fail, commonly due to too many unknowns or insufﬁcient

execution contexts, the executor will terminate the execution

of current function and start executing one of its caller

function (“leap” ﬁnal state). The caller function is expected

to provide a more concrete execution context to analyze the

incomplete execution.

A. Object and Taint Representation

The executor starts from the function entry with the

absence of its calling context (the values of parameters and

global variables). We design an object model to represent

902

剩余15页未读，继续阅读

weixin_38669881

粉丝: 5
资源: 918

AppAudit：融合静态与动态分析的实时Android应用审核

Android应用安全审核认证系统的设计研究.pdf

Android市场审核，用于检查是否提前调用mac地址及imei等信息

android应用市场2

Android SDK和Android应用程序开发的基本知识

Android 应用程序开发

Android应用程序设计

Android 实现应用分发

android应用程序开发

android应用开发揭秘 pdf

android应用程序开发教程

最新资源