Android应用内嵌移动广告风险行为研究

发布时间：2018-11-20 07:22

【摘要】：随着Android终端用户数量的不断增加与移动互联网流量的快速增长,移动广告越来越受到开发者与品牌商的青睐。然而,提供移动广告服务的移动广告平台可能会为了追求广告的精准投放与更多的收益而收集用户数据,给用户的隐私与财产安全带来风险。以此为背景,本文旨在研究与分析Android应用内嵌移动广告存在的风险行为与潜在危害,从而为用户与开发人员提供安全警示信息以便其做出相关的决策。为此,本文收集了国内具有代表性的Android应用市场AppChina上一段时间内的全部21,830个应用程序,检测并提取出了内嵌在这些应用中的所有广告库,对AppChina应用市场上移动广告库的总体分布情况进行了统计与分析,随后,本文重点对广告库存在的风险行为进行了静态检测与分析,并深入研究了3种利用移动广告库安全漏洞进行攻击的案例。最终,本文从AppChina应用市场检测出了173种不同的广告库。大量的实验结果显示,92%的广告库存在用户信息收集行为,其中90%的广告库所访问的用户信息与设备资源限于网络状态、地理位置、设备标识、近期任务、振动与系统唤醒锁5类。与此同时,8%的广告库表现出了访问或修改用户联系人列表、访问浏览器历史记录、甚至发送短信等一系列高风险行为,而利用广告库特定安全漏洞也确实能够绕过现有系统安全机制对用户隐私与敏感设备资源进行访问。本文的研究结果表明,Android应用内嵌移动广告普遍会收集用户信息,部分甚至会给用户隐私与安全带来严重威胁,而利用移动广告库安全漏洞来实现攻击也为攻击者提供了新的途径。全文共有图31幅,表4个,参考文献52篇。
[Abstract]:With the increasing number of Android end users and the rapid growth of mobile Internet traffic, mobile advertising is more and more favored by developers and brands. However, mobile advertising platforms that provide mobile advertising services may collect user data in pursuit of accurate advertising delivery and more revenue, which will bring risks to users' privacy and property security. Against this background, this paper aims to study and analyze the risk behavior and potential harm of embedded mobile advertising in Android applications, so as to provide users and developers with security warning information so that they can make relevant decisions. For this reason, this paper collects all 21830 application programs of AppChina, a representative domestic Android application market, and detects and extracts all advertising libraries embedded in these applications. The overall distribution of mobile advertising library in AppChina application market is analyzed, and then, the static detection and analysis of the risk behavior of advertising inventory are carried out in this paper. Three cases of exploiting the security vulnerabilities of mobile advertising library are studied in depth. Finally, this paper detects 173 different advertising libraries from AppChina application market. A large number of experimental results show that 92% of the advertising inventory is in user information collection behavior, 90% of which access user information and equipment resources are limited to network status, geographical location, device identification, recent tasks, Vibration and system wake-up lock class 5. At the same time, 8 percent of ad libraries show a range of high-risk behaviors such as accessing or modifying user contact lists, accessing browser history, and even sending text messages. However, the use of specific security vulnerabilities in advertising libraries can bypass the existing system security mechanisms to access user privacy and sensitive device resources. The results of this paper show that mobile ads embedded in Android applications generally collect user information, and some even pose a serious threat to user privacy and security. The exploitation of security vulnerabilities in mobile advertising libraries also provides a new approach for attackers. There are 31 figures, 4 tables and 52 references.
【学位授予单位】：北京交通大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP309

【相似文献】