Android应用软件功能泄露漏洞挖掘工具的设计与实现  

Design and implementation of capability leak detection for Android applications

作　　者：方喆君[1] 刘奇旭[1] 张玉清[1] 

机构地区：[1]中国科学院大学国家计算机网络入侵防范中心,北京101408

出　　处：《中国科学院大学学报（中英文）》2015年第1期127-135,共9页Journal of University of Chinese Academy of Sciences

基　　金：国家自然科学基金(61272481;61303239);北京市自然科学基金(4122089);国家发改委信息安全专项(高技[2012]1424);中国科学院大学校长基金资助

摘　　要：Android平台的功能泄露漏洞会导致权限提升和隐私泄露等严重危害,常被恶意软件用于绕过安全机制.针对这一问题,提出一个基于静态分析的功能泄露漏洞挖掘工具CLDroid.CLDroid使用逆向控制流的程序切片算法从源代码中提取程序逻辑,并利用可定制的安全规则库来检测违规行为.实验结果表明,CLDroid能有效挖掘Android源代码中的功能泄露漏洞,且具有较好的可扩展性.Capability leak vulnerability on Android platform may lead to permission elevation and privacy disclosure, and it is often exploited by malicious applications to bypass Android security mechanism. However, so far there is no approach aiming at Android capability leak detection on the source code level comprehensively. In this paper, we propose a novel approach named CLDroid, which uses backward program slicing to abstract application logic from the Java source code, detects pattern violations based on predefined security rules, and reports the violations as capability leak vulnerability. Results show that our approach is effective in detecting capability leak vulnerability and has better sealability.

关 键 词：功能泄露漏洞 静态分析 程序切片 Android安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]