基于静态污点分析法的Android信息泄露研究

Research on Android Information Leakage Based on Static Analysis Method

该文提出了一种基于Leak Miner和Privacy Miner的检测方法,检测系统将针对数据交互过程中的敏感信息进行静态污点分析。与动态污点分析方法相比,静态污点分析机制可以在线对应用市场中的APP进行在线分析。因此,它的检测成本将极为低廉,检测进程的RAM占有将不会被转嫁给用户。此外,此检测系统可以将检测所得的信息泄漏报告在线发送给用户,这便可以阻止恶意应用在被市场删除前进入用户的手机。根据系统运行报告得出,该系统可以从1852个程序集中检测到145个信息泄露点(经授权的和恶意的)。

In this paper,a detection method based on Leak Miner and Privacy Miner is proposed,which is based onthedetectionsystem.Thesystem willanalyzethesensitiveinformationintheprocessofdataexchange.Compared with the dynamic stain analysis method,the static stain mechanism can be used to analyze the APPin the application market.Therefore,its detection cost will be very low,the detection process of the RAM will not be passed ontotheuser.Inaddition,thisdetectionsystem can detect the resulting information leakage report online to the user,which can prevent malicious applications to enter the user＇s mobile phone before the market is removed.According to the system operation report,this system can detect 145 information leakage point（authorized and malicious）from1852programs.