一种Android应用程序隐私数据泄露检测方法  

A Privacy Data Leak Detection Technique for Android Applications

作　　者：孙昌爱[1] 朱维忠 李伟芳 何啸[1] SUN Chang′ai;ZHU Weizhong;LI Weifang;HE Xiao(School of Computer and Communication Engineering, University of Science and Technology Beijing, Beijing 100083,China)

机构地区：[1]北京科技大学计算机与通信工程学院,北京100083

出　　处：《郑州大学学报（理学版）》2020年第3期68-74,共7页Journal of Zhengzhou University:Natural Science Edition

基　　金：国家自然科学基金项目(61872039);中央高校基本科研业务费专项资金项目(FRF-GF-19-19B)。

摘　　要：提出一种基于扩展权限组合的Android应用程序隐私数据泄露检测方法。首先扩展Kirin安全规则集,然后从源代码层和字节码层分别提取Android应用程序申请的危险权限组合,最后动态检测是否存在隐私数据泄露的情形,并开发了支持工具DroidProtector。采用一组Android应用程序进行实验评估,结果表明,该方法能检测出更多类型的隐私数据泄露问题,DroidProtector在大幅度提高隐私数据泄露检测有效性的前提下仅引入了较小的性能开销。A privacy data leak detection approach for Android applications was proposed based on extended permission combinations.The approach firstly extended the Kirin rules,then extracted permission combinations requested by Android applications through analyzing either source codes or byte codes,and finally detected whether the privacy data leak happened at run-time.A supporting tool called DroidProtector was developed.A set of Android applications was used for evaluation.Experimental results showed that the proposed approach could detect more types of privacy data leaks and DroidProtector introduced only a marginal performance overhead on the premise of greatly improving the effectiveness of privacy data leak detection.

关 键 词：Android应用程序 权限组合 程序分析 字节码分析 程序安全 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]