基于静态污点分析的Android应用Intent注入漏洞检测方法  

Approach of Android Applications Intent Injection Vulnerability Detection Based on Static Taint Analysis

作　　者：王允超[1,2] 魏强[1,2] 武泽慧 

机构地区：[1]解放军信息工程大学,郑州450001 [2]数学工程与先进计算国家重点实验室,郑州450001

出　　处：《计算机科学》2016年第9期192-196,共5页Computer Science

摘　　要：针对Android应用程序组件间通信过程中的消息载体Intent有可能被攻击者构造进而引发组件被恶意注入的安全风险问题,提出了一种基于静态污点分析的检测方法。在构建Android应用的函数调用图和控制流图的基础上,通过跟踪应用组件内和组件间不可信Intent消息的污点传播过程,检测应用中潜在的Intent注入漏洞。用该方法对4类标准测试应用和50款第三方应用进行测试,实验结果表明了该方法的可行性和有效性。As a message carrier in the process of component communication of Android application, Intent can be mal- formed by an attacker, leading to security risk of malicious component injection. A detection approach based on static taint analysis was presented. On the basis of building call graph and control flow graph of Android application,by tracking the taint propagation with in and between components, the potential Intent injection vulnerability can be detected. This method is used to test four types of benchmark and fifty third-party applications,and the experimental results show the feasibility and effectiveness of the proposed approach.

关 键 词：Android 静态污点分析 函数调用图 控制流图 Intent注入漏洞 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]