面向html5的移动应用安全监测系统的设计与实现

发布时间：2018-06-16 21:37

本文选题：静态分析 + 动态检测　；参考：《北京邮电大学》2016年硕士论文

【摘要】：随着移动应用开发需求的急剧增长,为了适应应用快速迭代及跨平台等要求,基于html5的移动应用开发变得越来越流行。但是使用使用网页的语言开发移动应用,诸如代码注入等安全问题就会代入移动应用中,由于代码会获取更多的系统权限,其带来的安全问题与网页相比会更加严峻。尽管已经有很多学者研究了在网页平台上阻止代码注入的防护手段,但是大部分的解决方案都是为网页应用的架构而设计的,基于html5的移动应用和传统的网页相比更为复杂,因此这些解决方法并不奏效。而仅仅针对于原生应用的检测方法,也无法准确检测出基于html5的移动应用的安全问题。于是本文给出了一个针对于html5的移动应用的安全检测系统。本文的创新点在于在对传统移动应用检测方法和网页平台的防护手段研究后进行改进,根据html5移动应用的新特点,改进他们的方法并搭建了新型的安全检测系统,检测系统同时包括静态检测和动态检测。本篇论文先是研究了基于html5的移动应用开发的特点,找出它的安全风险及隐患,然后针对这种新型的移动开发方式提供了全方面的缺陷检测方案。一方面,改进了传统的网页检测方法,另外一方面,结合了针对原生应用的静态检测和动态检测方法,给出了针对基于html5移动应用开发的的新型检测方案。从而弥补了单一方面检测的不足以及网页的检测方案无法适配移动应用的不足。静态检测主要通过对javascript语言进行分析得到检测结果,动态检测主要通过行为序列进行检测,通过行为在代码中的调用来检测异常行为,并最终给出可用性的检测系统。
[Abstract]:With the rapid growth of mobile application development demand, mobile application development based on html5 has become more and more popular in order to meet the requirements of rapid iteration and cross-platform application. However, when mobile applications are developed in web language, such security problems as code injection will be substituted into mobile applications. Because the code will obtain more system permissions, the security problems will be more severe than web pages. Although many scholars have studied protection against code injection on web platforms, most of the solutions are designed for web application architectures, and mobile applications based on html5 are more complex than traditional web pages. So these solutions don't work. However, the security of mobile applications based on html5 can not be accurately detected by the detection methods for native applications. So this paper presents a security detection system for html5 mobile applications. The innovation of this paper lies in the improvement of the traditional mobile application detection method and the protection method of the web platform. According to the new characteristics of the html5 mobile application, the paper improves their methods and builds a new security detection system. The detection system includes both static and dynamic detection. This paper first studies the characteristics of mobile application development based on html5, finds out its security risks and hidden dangers, and then provides a comprehensive defect detection scheme for this new mobile development mode. On the one hand, we improve the traditional method of web page detection. On the other hand, we combine the static and dynamic detection methods for native applications, and give a new detection scheme based on html5 mobile applications. This makes up for the shortcomings of single aspect detection and the inability of web page detection scheme to adapt to mobile applications. Static detection is mainly through the analysis of javascript language to get the detection results, dynamic detection mainly through behavior sequence detection, behavior in the code calls to detect abnormal behavior, and finally give a usability detection system.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP311.56;TP393.092

【相似文献】