国内第三方Android应用市场安全性的检测.pdfVIP

第 42 卷第12 期 Vo l. 42 No. 12 计算机科学 2015 年 12 月 Computer Science Dec 2015 国内第三方 Android 应用市场安全性的检测 闰晋佩何晖安文欢张小辉任建宝齐勇 (西安交通大学计算机科学与技术系 西安 710049) 摘 要根据目前第三方 Android 应用市场应用存在的重新打包行为，随机选取国内官方的 150 个应用以及作为对 比的第三方应用市场的 572 个同款应用，设计了 Android 重新打包应用安全检测系统。该系统先进行相似性计算，细 粒度识别出重新打包应用，再通过逆向工程获得其资源文件，根据系统 API 与权限之间的映射匹配分析其越权行为， 并根据构建的方法控制流图分析其权限滥用行为。系统通过并行化处理检测出第三方应用市场存在 33.17% 的重新 打包应用，其中 19.58%修改了权限。在修改过权限的应用中，45.95%存在越权行为，27.03%存在滥用权限行为。 关键词 Android，重新打包，隐私与安全 中固法分类号 TP311 文献标tR码 A 四)1 10. 11896/j. iss n. 1002-137瓦 2015.12.031 Det配ting Security of Applications in Chin四e Thir叶party Android Market YAN Jin-pei HE Hui AN Wen-huan ZHANG Xiao-hui REN Jian-bao QI Yong (Department of Computer Science and Technology.Xian Jiaotong University. 沱江n 710049.China) Abstract At present ,repackaged apps exist in third-party Android application markets. In this paper , 150 official apps are selected randomly and 572 third-party markets apps are used as contrast. Android repackaged apps security detec- tion system was designed. First ,we fine-grained identified repackaged apps by calculating their similarity , then gained resource files through reverse engineering ,analyzed overprivileged behaviors ac∞rding to the mappings matcher between system API and permission ,and analyzed permission abused behaviors according to constructed methods CFG. By paral- lel processing ,the system detects that there are 33.17% repackaged apps in third-party markets , 19.58% permissions are modified , and modified permission apps include 45. 95% overprivileged behaviors and 27. 03% permission abused behaviors.