Android应用缺陷分析方法研究

发布时间：2018-07-31 07:45

【摘要】：随着移动互联网技术的快速发展、智能终端在世界范围内的普及,智能终端在人们生活和工作中扮演着越来越重要的角色。用户使用手中的智能终端可以方便地进行网络购物、手机付款、视频聊天等各种活动。然而,由于Android系统的开放性,Android智能终端给用户带来便利的同时也出现各种各样的安全问题,比如,隐私泄露、资费消耗、系统破坏等,这些问题不但损害了用户的经济利益,也威胁到用户的人身与隐私安全。针对Android平台上应用软件的安全问题,现有研究成果主要针对单个应用做分析,利用静态或动态技术检测出应用软件的安全缺陷。众所周知,缺陷是普遍存在的,只检测出安全缺陷而没有给出其触发条件以及防护方法对移动智能终端的保护作用十分有限。本论文首先提出了一种针对Android应用软件的安全缺陷分析方法,采用静态检测技术与缺陷规则结合的新思路满足了 Android应用缺陷检测的需求,对每个应用类别进行建立缺陷触发模型,突破了传统方法对缺陷本身进行建模的局限性;其次,基于这种方法设计了相应的检测系统;之后,将所设计的系统进行了实际开发及部署,并用大量数据对系统进行了测试与验证。本文主要工作如下:(1)研究现阶段Android平台的安全现状。介绍了 Android平台应用缺陷检测技术的研究现状,对Android系统架构、安全机制进行了深入研究。(2)提出了一种Android应用缺陷分析方法,阐述了其方法流程。从缺陷检测、缺陷触发两个角度来分析,分别介绍了应用缺陷检测方法、应用缺陷触发模型建立方法及它们相应的原理。(3)研究了 Android应用缺陷分析的关键技术,从而给出了一套基于Android应用软件缺陷分析系统的总体设计方案,并对各个子系统进行了详细的模块设计与实现。(4)给出了系统测试流程和验证流程。通过系统运行流程来检测系统各个模块的功能,验证了系统的可用性;利用已经公开的漏洞和攻击方法进行验证,通过分析结果验证了系统的有效性。
[Abstract]:With the rapid development of mobile Internet technology and the popularity of intelligent terminals in the world, intelligent terminals play an increasingly important role in people's life and work. Users can use their smart terminals to easily do online shopping, mobile phone payments, video chat and other activities. However, as the opening of Android system brings convenience to users, there are also a variety of security problems, such as privacy disclosure, tariff consumption, system damage and so on. These problems not only harm the economic interests of users. Also threatens the user's personal and privacy security. In order to solve the security problem of application software on Android platform, the existing research results mainly focus on the analysis of single application, and use static or dynamic technology to detect the security defects of application software. As we all know, the defects are common, only the security defects are detected, but the trigger conditions are not given, and the protective methods are very limited to the protection of mobile intelligent terminals. In this paper, a new method of security defect analysis for Android application software is proposed. The new idea of combining static detection technology with defect rules meets the needs of Android application defect detection. A defect trigger model is established for each application category, which breaks through the limitation of the traditional method to model the defect itself. Secondly, the corresponding detection system is designed based on this method. The system is developed and deployed, and the system is tested and verified with a lot of data. The main work of this paper is as follows: (1) the present security status of Android platform is studied. This paper introduces the research status of Android application defect detection technology, and makes a deep research on the Android system architecture and security mechanism. (2) A Android application defect analysis method is proposed and its method flow is expounded. Based on the analysis of defect detection and defect trigger, the application of defect detection method, the establishment of defect trigger model and their corresponding principles are introduced respectively. (3) the key technologies of Android application defect analysis are studied. Thus, a general design scheme of defect analysis system based on Android application software is presented, and each subsystem is designed and implemented in detail. (4) the system test flow and verification flow are given. The availability of the system is verified by detecting the function of each module of the system through the running process of the system, and the effectiveness of the system is verified by using the vulnerabilities and attack methods that have been disclosed.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP316;TP309

【相似文献】