CN106295348A - The leak detection method of application program and device - Google Patents

Abstract

The invention discloses leak detection method and the device of a kind of application program.Wherein, the method includes: the installation file of application program to be detected is converted to code file；Obtaining the description information of specified function, wherein, described specified function is the function for reflecting appointment behavior；According to described description information, determine in described code file and specify the first kind function describing information matches, and according to described first kind function, the leak of described application program being detected.By technique scheme, solve Hole Detection scheme and have that efficiency is low and the incomplete technical problem of testing result.

Description

Application program vulnerability detection method and device

technical field

The present invention relates to the field of loophole detection, in particular to a method and device for loophole detection of application programs.

Background technique

With the rapid development of smart mobile terminals, applications based on mobile operating systems emerge in endlessly. However, due to the large number of developers, there are inevitably security holes in the applications. For example, among the vulnerabilities in Android applications, there is a kind of vulnerability that has a wide impact and is the Java Null Pointer (Null Pointer) denial of service (Denial Of Service, abbreviated as DOS) vulnerability (hereinafter referred to as DOS vulnerability). This type of vulnerability is mostly caused by the program crash caused by improper handling of parameters when the program calls some system APIs, resulting in the inability to use normal functions and resulting in DOS.

At present, the main way to detect such vulnerabilities is fuzz testing (Fuzz Testing), that is, by sending random data to all possible entries of the target program and observing whether the program will appear abnormal. As shown in Figure 1, the principles of Fuzz monitoring programs for vulnerabilities are as follows;

The sample used for distortion is read into the Fuzz framework (framework), analyzed and handed over to the transformation module (mutation) for randomized mutation, and then passed to the target program (target) through the bridge part. At this time The target application program runs on its own platform (Platform runtime), and the Fuzz framework monitors the running status of the target application program through the monitoring module (monitor), and records it in the log (logger) when an exception is found.

Because this method depends on the specific execution of the program, it cannot guarantee to traverse all the code branches of the program, and the efficiency of finding vulnerabilities is low, and because hundreds or even thousands of Fuzz use cases may be generated per second, even if the abnormality of the target program is detected It takes a lot of effort to reproduce the anomaly to determine exactly where the vulnerability exists and what impact it can have. And because the target program is executed on the target platform, some relatively deep program branches are difficult to be found.

For the above problems, no effective solution has been proposed yet.

Contents of the invention

Embodiments of the present invention provide a method and device for detecting a vulnerability of an application program, so as to at least solve technical problems such as low efficiency and incomplete detection results in the vulnerability detection scheme.

According to an aspect of the embodiments of the present invention, a method for detecting application vulnerabilities is provided, including: converting the installation file of the application to be detected into a code file; obtaining description information of a specified function, wherein the specified function is A function reflecting the specified behavior; according to the description information, determine a first type of function matching the specified description information in the code file, and detect the loopholes of the application program according to the first type of function.

According to another aspect of the embodiments of the present invention, there is also provided an application program vulnerability detection device, including: a conversion module, which is used to convert the installation file of the application program to be tested into a code file; an acquisition module, which is used to acquire the specified function The description information, wherein, the specified function is a function used to reflect the specified behavior; the detection module is used to determine the first type of function matching the specified description information in the code file according to the description information, and according to the description information The first type of function detects the vulnerability of the application program.

In the embodiment of the present invention, the installation file of the application program is converted into a code file and the function used to reflect the specified behavior is searched from the code file, and the application program is processed according to the first type of function that matches the description information with the specified description information. The method of detecting the loopholes of the system achieves the purpose of loophole detection through static analysis. At the same time, because the detection is based on the code file of the application program, each branch in the code file can be traversed and detected. Therefore, it is possible to The detection result is more comprehensive, and then technical problems such as low efficiency and incomplete detection results of the vulnerability detection scheme are solved.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

Fig. 1 is a schematic diagram of the principle of using Fuzz to monitor an application program according to related technologies;

FIG. 2 is a block diagram of the hardware structure of a computer terminal for implementing a method for detecting vulnerabilities of application programs according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of an optional application program vulnerability detection method according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of an optional first CFG generation process according to an embodiment of the present invention;

Fig. 5 is a schematic diagram of a CFG according to an embodiment of the present invention;

FIG. 6 is another schematic diagram of an optional application vulnerability detection method according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of an optional application program vulnerability detection device according to an embodiment of the present invention;

FIG. 8 is another schematic diagram of an optional application program vulnerability detection device according to an embodiment of the present invention;

Fig. 9 is a structural block diagram of a computer terminal according to an embodiment of the present invention.

detailed description

In order to enable those skilled in the art to better understand the solutions of the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only It is an embodiment of a part of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present invention.

It should be noted that the terms "first" and "second" in the description and claims of the present invention and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a sequence of steps or elements is not necessarily limited to the expressly listed instead, may include other steps or elements not explicitly listed or inherent to the process, method, product or apparatus.

Example 1

According to an embodiment of the present invention, a method embodiment of a vulnerability detection method for an application program is also provided. It should be noted that the steps shown in the flow chart of the accompanying drawings can be implemented in a computer system such as a set of computer-executable instructions and, although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.

The method embodiment provided in Embodiment 1 of the present application may be executed in a mobile terminal, a computer terminal, or a similar computing device. Taking running on a computer terminal as an example, FIG. 2 is a block diagram of a hardware structure of a computer terminal for implementing a method for detecting a vulnerability of an application program according to an embodiment of the present invention. As shown in Figure 2, the computer terminal 20 may include one or more (only one is shown in the figure) processors 202 (the processor 202 may include but not limited to processing devices such as microprocessor MCU or programmable logic device FPGA, etc.) , a memory 204 for storing data, and a transmission device 206 for a communication function. Those of ordinary skill in the art can understand that the structure shown in FIG. 2 is only a schematic diagram, which does not limit the structure of the above-mentioned electronic device. For example, computer terminal 20 may also include more or fewer components than shown in FIG. 2 , or have a different configuration than that shown in FIG. 2 .

The memory 204 can be used to store software programs and modules of application software, such as program instructions/modules corresponding to the application program vulnerability detection method in the embodiment of the present invention, and the processor 202 runs the software programs and modules stored in the memory 204, thereby Executing various functional applications and data processing, that is, realizing the above-mentioned vulnerability detection method of the application program. The memory 204 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 204 may further include a memory that is remotely located relative to the processor 202 , and these remote memories may be connected to the computer terminal 20 through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 206 is used to receive or transmit data via a network. The specific example of the above-mentioned network may include a wireless network provided by the communication provider of the computer terminal 20 . In one example, the transmission device 206 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 206 may be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

Under the above operating environment, the present application provides a vulnerability detection method for an application program as shown in FIG. 3 . FIG. 3 is a flowchart of a method for detecting application vulnerabilities according to Embodiment 1 of the present invention. As shown in Figure 3, the method includes:

Step S302, converting the installation file of the application program to be detected into a code file;

For this processing step, it can be realized by solutions in related technologies. For example, for the installation package file of the Android application program, the installation package (Android Package, referred to as APK) file of the application program can be converted into smali code by APKTool; , APKTool is an APK compilation tool provided by Google (GOOGLE), which can decompile and recompile apk, and at the same time install the framework-res framework required by the decompilation system apk, clean up decompiled files and other functions, smali is the Java virtual machine in the Android system An assembler for .dex format files used by (Dalvik). Through step S302, the installation package file is converted into a code file, which provides a basis for subsequent static analysis.

It should be noted that the above-mentioned code files are not limited to assembly files, and may also appear as low-level code files (ie, executable code files) such as source code files. In practical applications, since source code files are not easy to obtain, they can be converted to assembly code files first.

Step S304, obtaining description information of a designated function, wherein the designated function is a function used to reflect a designated behavior.

Optionally, in the process of executing step S304, a step of searching for the above-mentioned specified function may be included, that is, the function for reflecting the specified behavior may be searched from the above-mentioned code file; of course, it may not be executed in the specific vulnerability detection process The lookup step.

The specified behavior here can be expressed as the type of function performed by the function, that is, the function type. For this processing step, for different types of vulnerability detection, functions for reflecting different behaviors can be used. For example, when detecting dos vulnerabilities, API functions in the assembly file converted from the application installation package can be used for detection.

Optionally, there are many ways to obtain the description information of the above specified function. For example, the description information of the above function can be obtained from the open source document on the network side. Specifically, the above description can be crawled from the above open source document by means of a web crawler. information. For ease of understanding, the following uses the API function in the Android application to detect DOS vulnerabilities as an example:

Find APIs that may return NULL in the Google Android API documentation. Since GoogleAndroid's API documents are public, with a uniform format and standardized descriptions, APIs that may return NULL can be found by crawling these documents and analyzing their contents.

For example: Use the return value description information in the following program to determine the required API:

public Bundle getBundleExtra(String name)

Retrieve extended data from the intent.

Parameters

name The name of the des ired item.

returns

the value of an item that previously ly added with putExtra() or null if no Bundle value was found .

See Also

putextra(String, Bundle)

The above is a program in the Google API documentation, which describes the parameters, functions, and return values of the getBundleExtra function. The return value part (underlined part) clearly indicates that this function may return null. Since Google's API document format is relatively standard and standardized, all APIs that may return null will be described in the return value description (see the above program code. The underlined part), therefore, the API that may return null can be found out through a simple text search, for subsequent verification whether there is a DOS vulnerability.

After determining the open source documents used, optionally, the API functions that may return null can be determined through the following steps: 1. Grab the Android API documents through crawlers; 2. Analyze the return value of each API to find the ones that may return NULL APIs.

Step S306, according to the description information, determine the first type of function matching the specified description information in the code file, and detect the loopholes of the above application program according to the above first type of function.

Still taking the identification of dos vulnerabilities in step S304 as an example for illustration, the specified description information in step S306 can be expressed as a return value of null, and the above-mentioned first type of function can be expressed as an API function that may return a value of null, but is not limited to this.

Optionally, in step S306, the detection of the vulnerability of the above-mentioned application program according to the above-mentioned first-type function can be realized in the following manner, but not limited thereto: constructing the first control flow graph CFG( Abbreviation: the first CFG), and count all the second-type functions with specified eigenvalues in the above-mentioned first-type functions; find the branch where the above-mentioned second-type functions are located in the above-mentioned first CFG, and judge whether the above-mentioned branch is abnormal Processing, if the determination result is yes, it is determined that there is no loophole in the application program; when the determination result is no, it is determined that the application program has a loophole. Optionally, the above exception handling may be in the following form, but not limited thereto: setting a jump instruction or call instruction used to indicate that the current instruction is abnormal and jump to other instructions.

It should be noted that the above-mentioned specified characteristic value can be expressed as the same characteristic value of the same type of function, such as the return value of the function. For example, the above-mentioned second type of function can be determined by looking for the characteristic value whose return value may be empty, but not limited to this form of expression.

In an optional embodiment, the generating process of the first CFG is: converting the Android application installation package (APK) into Smali code, and generating the CFG of the application through static code analysis. Among them, CFG is a directed graph with the application code as the node, and the direction of the edge represents the calling direction, that is, the execution direction of the program. As shown in Figure 4, the following steps are included:

Step S402. Solve the smali code in the APK by apktool;

Step S404. Generate a CFG based on the function call relationship in Smali and the branching logic of the code. Specifically, this step can be achieved through the following process:

1. Break the smali code into many chunks. A chunk is the largest unit in which code is executed sequentially. That is, when the code encounters a branch jump (loop is also a kind of conditional branch jump), function call and other instructions that can change the program execution flow, the current chunk will end and the next chunk will start. Each chunk has a unique id, which is also their entry point, which is an offset relative to the starting address of the function. For jump instructions or function call instructions, possible follow-up chunk ids of the current chunk during execution can be calculated by analyzing the operands of the instructions.

2. Connect these chunks through their own id and the value of the subsequent chunk id to construct a CFG.

Among them, based on the above process, a schematic diagram of a CFG can be constructed. It should be noted that, for the sake of easy understanding, the following branches of the CFG are described in natural language instead of expressed in code. In actual application, each Steps can be represented as code that implements the following functions. As shown in Figure 5:

1. Obtain the incoming intent, check whether the intent contains parameters, if yes, go to step 2, otherwise go to step 4;

2. Obtain parameters from intent, cast or customize classes;

3. Call the method of the class;

4. End the program.

In an optional embodiment, when searching for the branch of the above-mentioned second type of function in the above-mentioned first CFG, it can be realized through the following process, but not limited thereto: filter the branches in the above-mentioned first CFG according to preset rules , to obtain the second CFG; find the branch where the above-mentioned second type of function is located in the above-mentioned second CFG. Wherein, the aforementioned preset rules can be flexibly set according to the actual situation. For example, the branches in the aforementioned first CFG can be filtered in the following way: delete the specified node in the aforementioned first CFG and the nodes that can only be connected by the specified node, wherein , the function corresponding to the specified node is a function with only out-degree and no in-degree. An application program based on the Android system is used as an example for illustration.

Filtering branches is also called CFG pruning. Applications on the Android system have specific function entries, and it is necessary to find out the nodes in the CFG that have only out-degree but no in-degree. If the function of this node is not a known program entry, all the points that can only be connected by this node are removed. In this way, it can be guaranteed that the remaining nodes in the CFG can be called by external programs (such as the attacker's program). Specifically, it can be achieved through the following steps:

1. Summarize the application entry function of the Android system

2. Find the points in the CFG that have only out-degree but no in-degree

3. Determine whether this point is an entry function

4. Traverse all child nodes of the current node and delete all points that can only be connected by this node

In an optional embodiment, judging whether exception handling is performed on a branch of the CFG may be implemented in the following manner: traversing all branches in the CFG; finding a branch that may return NULL; and judging whether the branch has exception handling.

It can be seen from the above embodiments that the application vulnerability detection method provided by the embodiments of the present invention can be used to detect DOS vulnerabilities. At this time, the function used to reflect the specified behavior in the embodiments of the present invention can be an API function.

It should be noted that the technical solutions provided by the embodiments of the present invention can run on different mobile terminal operating systems, that is, they can be used to detect loopholes in application programs based on different operating systems, the operating systems include but are not limited to: Android (Android) operating system, iOS operating system, Symbian, Windows Phone operating system and BlackBerry OS operating system, etc.

In this embodiment, the installation file of the application program is converted into a code file and the function used to reflect the specified behavior is searched from the code file, and the function of the application program is adjusted according to the first type of function whose description information matches the specified description information. The method of vulnerability detection achieves the purpose of vulnerability detection through static analysis. At the same time, since each branch in the above code file can be traversed and detected, the detection results can be made more comprehensive, and then the vulnerability detection solution is solved. There are technical problems such as low efficiency and incomplete test results.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence. Because of the present invention, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is better implementation. Based on such an understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products are stored in a storage medium (such as ROM/RAM, disk, CD) contains several instructions to enable a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in various embodiments of the present invention.

Example 2

This embodiment is described by taking the detection of DOS vulnerabilities of applications based on the Android operating system as an example. However, it should be noted that the solution in this embodiment is not limited to application detection of the Android operating system, nor is it limited to DOS vulnerabilities. The main design idea of this embodiment is to filter out specific APIs through official documents (that is, open source documents), and use this as the basis for detecting DOS vulnerabilities, that is, for open source operating systems, according to the behavior of the system API described in open source documents To find specific APIs of interest, based on these APIs combined with some other methods to achieve specific functions (such as DOS vulnerability detection in this embodiment). It mainly includes the following processes: 1. Generate CFG (Controll Flow Graph) based on static code; 2. Prune through static analysis to filter out API branches that may be called by the outside world; 3. Combine Google Android API documents to identify potential DOS vulnerabilities API; 4. Judging whether the branch has performed exception handling. Specifically, as shown in FIG. 6, the application vulnerability detection method provided by the embodiment of the present invention includes the following processing steps:

Step S602, using apktool to convert apk into smali code;

Step S604, constructing a CFG by analyzing the smali code. This step mainly converts the Android application program (APK) into Smali code, and generates the CFG of the application program through static code analysis. CFG is a directed graph with the application code as the node, and the direction of the edge represents the calling direction, that is, the execution direction of the program. The specific implementation process is as follows: 1. Break the smali code into many chunks. A chunk is the largest unit in which code is executed sequentially. That is, when the code encounters a branch jump (loop is also a kind of conditional branch jump), function call and other instructions that can change the program execution flow, the current chunk will end and the next chunk will start. Each chunk has a unique id, which is also the entry point, which is an offset relative to the starting address of the function. For jump instructions or function call instructions, possible follow-up chunk ids of the current chunk during execution can be calculated by analyzing the operands of the instructions. 2. Connect these chunks through their own id and the value of the subsequent chunk id to construct a CFG.

Step S606, extracting branches where all entry functions are located to form a new CFG. Applications on the Android system have specific function entries to find out the nodes in the CFG that have only out-degree but no in-degree. If the function of this node is not a known program entry, all the points that can only be connected by this node are removed. In this way, it can be guaranteed that the remaining nodes in the CFG can be called by external programs (such as the attacker's program).

Step S608, crawling Google's Android API documents through an HTTP request. This part mainly finds APIs that may return NULL from the GoogleAndroid API documentation. Since Google Android's API documents are public, with a uniform format and standardized descriptions, APIs that may return NULL can be found by crawling these documents and analyzing their contents, for example, through the return value description information in the documents. API functions that return NULL.

In step S610, the document is stored in the local database (it can simply be stored in the form of a file). This step can also be implemented in the form of caching, that is, storing the document in the cache and setting the survival time of the document.

Step S612, searching for APIs that may return NULL through a character string search.

Step S614, find out a target API list (target API list), that is, use these APIs to construct an API list that may cause DOS vulnerabilities.

Step S616, perform branch filter (branch filter), that is, find out the branch containing the dangerous API in the CFG.

In step S618, try/catch parser processing is performed, that is, it is judged whether exception processing has been performed on this branch.

The embodiment of the present invention discovers the entry points with vulnerabilities in a static manner combined with Google API documents. Because it is a static analysis, it is guaranteed to traverse all application branches. Compared with the Fuzz method, static analysis has higher efficiency, and the detected vulnerabilities can be precisely located. The operation of each step in the embodiment of the present invention is definite, and the present invention can guarantee to find all points that may generate DOS loopholes with respect to the specific operating conditions of Fuzz dependent programs.

Example 3

According to an embodiment of the present invention, there is also provided a vulnerability detection device for an application program implementing the above method, which can run in the mobile terminal, computer terminal or similar computing device described in Embodiment 1, but does not It is limited to the function or structure of the above-mentioned computing device in Embodiment 1. As shown in Figure 7, the device includes:

The conversion module 70 is configured to convert the installation file of the application program to be detected into a code file. The functions realized by this module can be realized through solutions in related technologies. For example, for the installation package file of an Android application, the installation package (Android Package, APK for short) file of the application can be converted into smali code by APKTool , but not limited to this implementation.

The obtaining module 72 is connected to the conversion module 70 and is used for obtaining the description information of the specified function. The specified behavior here can be expressed as the type of function performed by the function, that is, the function type. For this processing step, for different types of vulnerability detection, functions for reflecting different behaviors can be used. For example, when detecting dos vulnerabilities, API functions in the assembly file converted from the application installation package can be used for detection. Optionally, the acquiring module 72 can acquire the description information of the above-mentioned specified function in many ways, for example, the description information of the above-mentioned function can be obtained from the open source document on the network side, specifically, the above-mentioned information can be crawled from the above-mentioned open source document by means of a web crawler. Description information. At this time, in order to facilitate the capture of the above description information, you can use the description information to compare standard and normative documents.

The detection module 74 is connected to the acquisition module 72, and is used to determine the first type of function matching the specified description information in the above code file according to the above description information, and detect the loopholes of the above application program according to the above first type of function.

Optionally, as shown in FIG. 8, the detection module 74 may also include the following processing units, but is not limited thereto:

The construction unit 740, constructs the first control flow graph CFG of the branch where the above-mentioned first type of function is located;

Taking the application program based on the Android operating system as an example, in an optional embodiment, the construction process of the first CFG is: converting the Android application installation package (APK) into Smali code, and generating the application program through static code analysis CFG of the program. Among them, CFG is a directed graph with the application code as the node, and the direction of the edge represents the calling direction, that is, the execution direction of the program. Specifically, the processing steps may be as follows, but not limited thereto: use apktool to solve the smali code in the APK; generate a CFG based on the function call relationship in the Smali and the branching logic of the code. Specifically, this step can be achieved through the following process:

1. Break the smali code into many chunks. A chunk is the largest unit in which code is executed sequentially. That is, when the code encounters a branch jump (loop is also a kind of conditional branch jump), function call and other instructions that can change the program execution flow, the current chunk will end and the next chunk will start. Each chunk has a unique id, which is also their entry point, which is an offset relative to the starting address of the function. For jump instructions or function call instructions, possible follow-up chunk ids of the current chunk during execution can be calculated by analyzing the operands of the instructions. 2. Connect these chunks through their own id and the value of the subsequent chunk id to construct a CFG.

Statistical unit 742, configured to count all the functions of the second type with specified characteristic values in the functions of the first type; optionally, the specified characteristic values may be expressed as the same characteristic values of functions of the same type, such as the return value of the function , for example, the above-mentioned second type of function can be determined by looking for the characteristic value whose return value may be empty, but it is not limited to this form of expression.

The detection unit 744 is connected to the construction unit 740 and the statistical unit 742, and is used to search for the branch where the second type of function is located in the above-mentioned first CFG, and judge whether the branch where the above-mentioned second type of function is located has been abnormally handled. When the result is yes, it is determined that the above application program does not have a loophole; when the above determination result is no, it is determined that the above application program has a loophole. Optionally, the above exception handling may be expressed in the following form, but not limited thereto: setting a jump instruction or a call instruction used to indicate to jump to other instructions when the current instruction is abnormal.

For the detection unit 744 to search for the branch of the second type of function in the first CFG, in order to improve the efficiency and detection accuracy, the detection unit 744 is also used to filter the branches in the above-mentioned first CFG according to the preset rules to obtain the first CFG Two CFGs; and searching the branch where the above-mentioned second type of function is located in the above-mentioned second CFG. The following uses an application program based on the Android system as an example for description.

Filtering branches is also called CFG pruning. Applications on the Android system have specific function entries, and it is necessary to find out the nodes in the CFG that have only out-degree but no in-degree. If the function of this node is not a known program entry, all the points that can only be connected by this node are removed. In this way, it can be guaranteed that the remaining nodes in the CFG can be called by external programs (such as the attacker's program). Specifically, it can be achieved through the following steps:

1. Summarize the application entry functions of the Android system;

2. Find the points in the CFG that have only out-degree but no in-degree;

3. Determine whether this point is an entry function;

4. Traverse all child nodes of the current node and delete all nodes that can only be connected by this node.

In an optional embodiment, judging whether exception handling is performed on a branch of the CFG may be implemented in the following manner: traversing all branches in the CFG; finding a branch that may return NULL; and judging whether the branch has exception handling.

For example, the detection unit 744 is further configured to delete the specified node in the first CFG and the nodes that can only be connected by the specified node, wherein the function corresponding to the specified node is a function with only out-degree and no in-degree. In this way, the first CFG is pruned to improve retrieval efficiency and accuracy.

In an optional embodiment, the acquiring module 72 is further configured to acquire the description information of the specified function from an open source document on the network side.

The various modules involved in this embodiment can be realized by corresponding software or hardware. For the latter, for example, the following methods can be used to realize, but not limited to this: the conversion module 70, the acquisition module 72 and the detection module 74 are all located at In the same processor; or, the conversion module 70, the acquisition module 72 and the detection module 74 are respectively located in the first processor, the second processor and the third processor; or, the conversion module 70 and the acquisition module 72 are located in the same processor , the detection module 74 is located in another processor; or, the acquisition module 72 and the detection module 74 are located in the same processor, and the conversion module 70 is located in another processor, but not limited to the above combination.

The application loophole detection device provided by the embodiment of the present invention can also achieve the purpose of loophole detection through static analysis, and at the same time, because each step is determined, the detection result can be made more comprehensive, and then solve the problem of The vulnerability detection scheme has technical problems such as low efficiency and incomplete detection results.

Example 4

Embodiments of the present invention may provide a computer terminal, and the computer terminal may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the foregoing computer terminal may also be replaced with a terminal device such as a mobile terminal.

Optionally, in this embodiment, the foregoing computer terminal may be located in at least one network device among multiple network devices of the computer network.

In this embodiment, the above-mentioned computer terminal can execute the program code of the following steps in the application program vulnerability detection method: convert the installation file of the application program to be detected into a code file; obtain the description information of the specified function, wherein the above-mentioned specified function is A function used to reflect the specified behavior; according to the above-mentioned description information, determine the first type of function matching the specified description information in the above-mentioned code file, and detect the vulnerability of the above-mentioned application program according to the above-mentioned first type of function.

Optionally, FIG. 9 is a structural block diagram of a computer terminal according to an embodiment of the present invention. As shown in FIG. 9 , the computer terminal A may include: one or more (only one is shown in the figure) processors 91 , a memory 93 , and a transmission device 95 .

Wherein, the memory 93 can be used to store software programs and modules, such as the program instructions/modules corresponding to the security hole detection method and device in the embodiment of the present invention, and the processor 91 runs the software programs and modules stored in the memory 93 to execute Various functional applications and data processing, that is, to realize the detection method of the above-mentioned system vulnerability attack. The memory 93 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 93 may further include a memory that is remotely located relative to the processor 91, and these remote memories may be connected to the terminal A through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The aforementioned transmission device 95 is used to receive or transmit data via a network. The specific examples of the above-mentioned network may include a wired network and a wireless network. In one example, the transmission device 95 includes a network adapter (Network Interface Controller, NIC), which can be connected with other network devices and a router through a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 95 is a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

Wherein, specifically, the memory 93 is used for storing preset action conditions and preset authority user information, as well as application programs.

The processor 91 can call the information and the application program stored in the memory 93 through the transmission device to perform the following steps: convert the installation file of the application program to be detected into a code file; obtain the description information of the specified function, wherein the specified function is used A function that reflects the specified behavior; according to the above description information, determine the first type of function that matches the specified description information in the above code file, and detect the loopholes of the above application program according to the above first type of function.

Optionally, the above-mentioned processor 91 can also execute the program code of the following steps: constructing the first control flow graph CFG of the branch where the above-mentioned first-type functions are located, and counting all the above-mentioned first-type functions with the specified eigenvalues of the second-type function; search the branch where the above-mentioned second-type function is located in the above-mentioned first CFG, and judge whether the branch where the above-mentioned second-type function is located has performed abnormal processing, and when the judgment result is yes, then determine that there is no loophole in the above-mentioned application program; When the above judgment result is no, it is determined that the above application program has a vulnerability. Optionally, the "exception handling" here may be expressed as: setting a jump instruction or a call instruction for indicating to jump to other instructions when the current instruction is abnormal.

Optionally, the above-mentioned processor 91 can also execute the program code of the following steps: filter the branches in the above-mentioned first CFG according to the preset rules to obtain the second CFG; find the location of the above-mentioned second type of function in the above-mentioned second CFG branch.

Optionally, the above-mentioned processor 91 may also execute the program code of the following steps: delete the specified node in the above-mentioned first CFG and the nodes that can only be connected by the specified node, wherein the function corresponding to the specified node is degree and no in-degree function.

Optionally, the above-mentioned processor 91 may also execute the program code of the following steps: Obtain the description information of the above-mentioned specified function from the open-source document on the network side, for example, crawl the above-mentioned description information from the open-source document by means of a web crawler.

By adopting the embodiment of the present invention, a solution is provided for detecting the loophole of the application program by using the static code combined with the description information of the functions involved therein. The technical problems of low efficiency and incomplete detection results in the vulnerability detection scheme are solved.

Those of ordinary skill in the art can understand that the structure shown in Figure 9 is only schematic, and the computer terminal can also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, an applause computer, and a mobile Internet device (Mobile Internet Devices, MID ), PAD and other terminal equipment. FIG. 9 does not limit the structure of the above-mentioned electronic device. For example, the computer terminal A may also include more or less components than those shown in FIG. 9 (such as a network interface, a display device, etc.), or have a configuration different from that shown in FIG. 9 .

Those of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can be Including: a flash disk, a read-only memory (Read-Only Memory, ROM), a random access device (Random Access Memory, RAM), a magnetic disk or an optical disk, and the like.

Example 4

The embodiment of the invention also provides a storage medium. Optionally, in this embodiment, the above-mentioned storage medium may be used to store the program code executed by the application program vulnerability detection method provided in the first embodiment above.

Optionally, in this embodiment, the above-mentioned storage medium may be located in any computer terminal in the group of computer terminals in the computer network, or in any mobile terminal in the group of mobile terminals.

Optionally, in this embodiment, the storage medium is configured to store program codes for performing the following steps: converting the installation file of the application to be detected into a code file; obtaining description information of a specified function, wherein the specified function It is a function used to reflect the specified behavior; according to the above-mentioned description information, determine the first type of function matching the specified description information in the above-mentioned code file, and detect the vulnerability of the above-mentioned application program according to the above-mentioned first type of function.

Optionally, the above-mentioned storage medium can also execute the program code of the following steps: constructing the first control flow graph CFG of the branch where the above-mentioned first-type functions are located, and counting all the above-mentioned first-type functions with specified eigenvalues of the second-type functions ; Find the branch where the above-mentioned second type of function is located in the above-mentioned first CFG, and judge whether the branch where the above-mentioned second type of function is located has carried out abnormal processing, and when the judgment result is yes, then determine that there is no loophole in the above-mentioned application program; When the above judgment result is no, it is determined that the above application program has a vulnerability. Optionally, the "exception handling" here may be expressed as: setting a jump instruction or a call instruction for indicating to jump to other instructions when the current instruction is abnormal.

Optionally, the above-mentioned storage medium can also execute the program code of the following steps: filter the branches in the above-mentioned first CFG according to preset rules to obtain the second CFG; search the above-mentioned second CFG for the location where the above-mentioned second type of function is located. branch.

Optionally, the above-mentioned storage medium can also execute the program code of the following steps: delete the specified node in the above-mentioned first CFG and the nodes that can only be connected by the specified node, wherein the function corresponding to the specified node is only out-degree And there is no in-degree function.

Optionally, the above-mentioned storage medium may also execute the program code of the following steps: Obtain the description information of the above-mentioned specified function from the open-source document on the network side, for example, crawl the above-mentioned description information from the open-source document by means of a web crawler.

It should be noted here that any one of the above computer terminal groups can establish a communication relationship with the website server and the scanner, and the scanner can scan the value commands of the web application program executed by php on the computer terminal.

The serial numbers of the above embodiments of the present invention are for description only, and do not represent the advantages and disadvantages of the embodiments.

In the above-mentioned embodiments of the present invention, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed entity device may be implemented in other ways. Wherein, the device embodiments described above are only illustrative, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or can be Integrate into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of units or modules may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, server or network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention. And aforementioned storage medium comprises: U disk, read-only memory (ROM, Read-OnlyMemory), random access memory (RAM, Random Access s Memory), mobile hard disk, magnetic disk or CD etc. various mediums that can store program codes .

The above is only a preferred embodiment of the present invention, it should be pointed out that, for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications can also be made. It should be regarded as the protection scope of the present invention.

Claims (15)

1. the leak detection method of an application program, it is characterised in that including:

The installation file of application program to be detected is converted to code file；

Obtaining the description information of specified function, wherein, described specified function is the function for reflecting appointment behavior；

According to described description information, determine in described code file and specify the first kind letter describing information matches Number, and according to described first kind function, the leak of described application program is detected.

Method the most according to claim 1, it is characterised in that according to described first kind function to described application program Leak detect, including:

Build the first controlling stream graph CFG of described first kind function place branch, and add up all described first kind Function has the Equations of The Second Kind function of specific characteristic value；

In a described CFG, search the branch at described Equations of The Second Kind function place, and judge described Equations of The Second Kind function Whether the branch at place has carried out abnormality processing, when judged result is for being, it is determined that described application program is not deposited At leak；When described judged result is no, it is determined that described application program exists leak.

Method the most according to claim 2, it is characterised in that described abnormality processing includes:

It is provided for indicating when present instruction exception, jumps to jump instruction or the call instruction of other instructions.

Method the most according to claim 2, it is characterised in that search described Equations of The Second Kind letter in a described CFG The branch at number place, including:

According to preset rules, the branch in a described CFG is filtered, obtain the 2nd CFG；

The branch at described Equations of The Second Kind function place is searched in described 2nd CFG.

Method the most according to claim 4, it is characterised in that according to preset rules to dividing in a described CFG Zhi Jinhang filters, including:

Delete the appointment node in a described CFG and be only capable of by the node of this appointment node connection, wherein, This function corresponding to appointment node is only out-degree and do not have the function of in-degree.

Method the most according to claim 2, it is characterised in that described specific characteristic value includes: described first kind letter The return value of number.

Method the most according to claim 1, it is characterised in that obtain the description information of specified function, including:

The description information of described specified function is obtained from the document of increasing income of network side.

Method the most according to claim 7, it is characterised in that obtain described appointment from the document of increasing income of network side The description information of function, including:

From described document of increasing income, described description information is obtained by the way of web crawlers.

Method the most according to any one of claim 1 to 8, it is characterised in that described for reflecting appointment behavior Function be api function, and/or described leak for refusal service DOS leak.

10. the Hole Detection device of an application program, it is characterised in that including:

Modular converter, for being converted to code file by the installation file of application program to be detected；

Acquisition module, for obtaining the description information of specified function, wherein, described specified function is for being used for reflecting The function of appointment behavior；

Detection module, for according to described description information, determines in described code file and specifies description information The first kind function of coupling, and according to described first kind function, the leak of described application program is detected.

11. devices according to claim 10, it is characterised in that described detection module, including:

Construction unit, builds the first controlling stream graph CFG of described first kind function place branch；

Statistic unit, for adding up the Equations of The Second Kind function in all described first kind functions with specific characteristic value；

Detector unit, for searching the branch at described Equations of The Second Kind function place in a described CFG, and judges Whether the branch at described Equations of The Second Kind function place has carried out abnormality processing, when judged result is for being, it is determined that institute State application program and there is not leak；When described judged result is no, it is determined that described application program exists leak.

12. devices according to claim 11, it is characterised in that described abnormality processing includes: be provided for indicating During present instruction exception, jump to jump instruction or the call instruction of other instructions.

13. devices according to claim 11, it is characterised in that described detector unit, are additionally operable to according to preset rules Branch in a described CFG is filtered, obtains the 2nd CFG；And search in described 2nd CFG The branch at described Equations of The Second Kind function place.

14. devices according to claim 13, it is characterised in that described detector unit, are used for deleting described first Specifying node and being only capable of by the node of this appointment node connection, wherein, corresponding to this appointment node in CFG Function be only out-degree and do not have the function of in-degree.

15. devices according to claim 10, it is characterised in that described acquisition module, are additionally operable to opening from network side Source document obtains the description information of specified function.