基于通信顺序进程的Android程序复杂信息流分析方法  

Android complex information flow analysis method based on communicating sequential process

作　　者：袁占慧 杨智[1] 张红旗[1] 金舒原 杜学绘[1] YUAN Zhanhui;YANG Zhi;ZHANG Hongqi;JIN Shuyuan;DU Xuehui(Information Engineering University,Zhengzhou 450001,China;Sun Yat-sen University,Guangzhou 510006,China)

机构地区：[1]信息工程大学,河南郑州450001 [2]中山大学,广东广州510006

出　　处：《网络与信息安全学报》2021年第5期156-168,共13页Chinese Journal of Network and Information Security

基　　金：国家自然科学基金(62176265,61972040)。

摘　　要：Android隐私泄露问题日益严重,信息流分析是发现隐私泄露的一种主要方法。传统信息流分析方法以单一可达性分析为主,难以分析复杂信息流。提出一种基于通信顺序进程的信息流分析方法,建立应用程序行为的形式化模型,从而全面刻画程序信息流行为。基于进程迹等价分析方法能够自动化验证信息流关联、信息流约束等复杂信息流问题,进而判断是否存在敏感信息泄露。实验表明,所提方法能够达到90.99%的准确率。Android privacy leak problem is becoming more and more serious.Information flow analysis is a main method to find privacy leak.Traditional information flow analysis methods mainly focus on single accessibility analysis,which is difficult to analyze complex information flow.An information flow analysis method based on communication sequence process was proposed.The formal model of application behavior was established,which can fully describe the information flow of program.The process trace equivalence analysis method could automatically verify complex information flow problems such as information flow association and information flow constraints.This method could detect whether the application program leaks sensitive information.Experimental results show that the accuracy of the proposed method can reach 90.99%.

关 键 词：安卓 信息流分析 隐私防护 形式化分析 通信顺序进程 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]