一种检测Android应用程序隐式权限的方法  

A Method to Detect the Implicit Permissions in Android Applications

作　　者：彭凌[1] 曾凡平[1,2,3] 严俊[4] 汤杨[1] 

机构地区：[1]中国科学技术大学计算机科学与技术学院,合肥230026 [2]中国科学院软件研究所计算机科学国家重点实验室,北京100190 [3]安徽省计算与通讯软件重点实验室,合肥230026 [4]中国科学院软件研究所软件工程技术研究开发中心,北京100190

出　　处：《小型微型计算机系统》2016年第3期515-519,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金重点项目(91418206)资助

摘　　要：隐式权限在Android应用开发中有大量的应用.针对隐式权限审核与资源关联的特性,提出一种基于程序静态分析与过程内数据流分析技术的隐式权限检测方法.该方法首先根据函数调用在引发权限审核的过程中是否与系统资源关联分类为显式和隐式;然后借助过程内数据流分析技术对隐式调用提取参数值,构建包含资源信息的完整函数调用;最后与事先收集的权限—函数映射关系比对后得到权限信息.实验结果表明,方法可以有效地检测程序中的隐式权限,漏误报数目少,在性能上相比同类型工具有极大的提升.此外,本文收集的隐式权限—资源映射关系相比其他相关工作更完整,将其与开源的显式权限映射表结合,本文实现了权限自动提取工具UpsetEx.Implicit permissions are often used in Android application development. Concerning the feature of implicit permissions associated with the target resources,this paper proposes a novel implicit permission detecting method based on static analysis and procedural data flowanalysis technique. Firstly,the function calls are classified to explicit or implicit according to whether the permission approval process is related to the system resource. Then,the resource parameter＇s value of implicit function calls is obtained by procedural data flowanalysis,and a complete function calls are built. Finally,the permissions are found by comparing the function calls with a pre-requisite permission specification. The experimental results showthat our method can effectively detect implicit permissions with relatively fewfalse positive and false negative,much better than similar analysis tools. What＇s more,the implicit permission specification that we have collected is more complete than other related works did. Combined with an open source explicit permission specification,we have developed the automated permission extraction tool Upset Ex.

关 键 词：隐式权限检测 静态分析 权限审核分类 权限—资源映射关系 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]