Android恶意广告威胁分析与检测技术  

Android malicious AD threat analysis and detection techniques

作　　者：韩心慧[1] 丁怡婧 王东祺 黎桐辛 叶志远[1] 

机构地区：[1]北京大学计算机科学与技术研究所,北京100080

出　　处：《清华大学学报（自然科学版）》2016年第5期468-477,共10页Journal of Tsinghua University(Science and Technology)

基　　金：国家自然科学基金资助项目(61402125)

摘　　要：Android第三方广告框架应用广泛,但Android系统漏洞和Android第三方广告框架的逻辑缺陷严重威胁着Android市场安全。攻击者可以通过恶意广告获取敏感数据、触发敏感操作,甚至是以应用程序的权限执行任意代码。该文总结了4种Android恶意广告攻击方式,并针对这4种方式设计了一种基于后向切片算法和静态污点分析的Android第三方广告框架静态测量方法,以及一种基于API Hook和靶向API Trace的Android恶意广告敏感行为动态检测方法。基于以上研究,该文设计并实现了Android恶意广告威胁分析与检测系统,通过实例证明该系统能够有效地分析Android第三方广告框架可能存在的安全隐患,并能够动态检测Android恶意广告的敏感行为。Android third-party advertising frameworks are deployed in almost every Android app. The vulnerabilities of the Android OS and these advertising frameworks greatly impact the security of the Android market. The attacker can get the users＇ private data, trigger sensitive operations and execute arbitrary code on the device. This paper summarizes four classes of attacks in Android third-party advertising frameworks and gives two detection algorithms to discover these four classes of vulnerabilities. The first detection algorithm statically analyzes the advertising frameworks using a backward slicing algorithm and a static forward tainting analysis. The second algorithm dynamically detects malicious behavior in advertising frameworks using API hooking and targeted API tracing. An Android malicious ad security threat analysis and detection system is designed and implemented based on these two algorithms. Tests show that this system effectively discovers potential vulnerabilities in advertising frameworks and dynamically detects malicious behavior in advertisements.

关 键 词：ANDROID 恶意广告 威胁 静态分析 动态分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]