一种跨APP组件间隐私泄露自动检测方法

An Automatic Detection Method for Privacy Leakage Across Application Components

近年来,Android操作系统发展迅猛,大量的移动用户使用Android智能设备作为私人通信和工作的工具.Android移动用户的隐私信息随之成为黑色产业从业者的主要攻击目标之一.现有的隐私检测研究主要集中于解决Android应用程序内部的隐私泄露风险,包括程序组件内隐私泄露、组件间隐私泄露以及组件间通信(inter-component communication,ICC)漏洞的检测.然而在实际环境中,不同应用程序间通过协作获取用户隐私的行为广泛存在,这造成大量用户隐私信息被泄露的风险.如何有效检测和防止跨APP组件间隐私泄露是亟待解决的问题.然而Android应用程序中组件数量庞大并且存在大量与跨APP间隐私泄露无关的组件.因此在应用程序之间如何检测可能存在的隐私泄露路径面临严峻的挑战.针对该问题,提出一种构建潜在泄露隐私的组件序列的方法,并利用数据流分析技术实现一个跨APP组件间隐私泄露的检测系统PLDetect.PLDetect解决了现有技术存在的检测结果滞后的问题以及代码覆盖率不全的问题.最后,PLDetect在隐私泄露路径的基础上,使用一种基于加密的隐私泄露防护方法对隐私信息进行加密,保证在不影响应用程序运行时性能的情况下有效阻止隐私数据被恶意传送.最终实验表明,PLDetect在81个应用程序中监测出5组应用程序存在跨APP组件间隐私泄露问题并有效阻断了隐私数据的泄露.

In recent years,Android operating system has developed rapidly.A large number of mobile users use Android smart devices as tools for personal communication and work.The privacy information of Android mobile users has become one of the main targets of black industry practitioners.Existing privacy detection research mainly focuses on addressing privacy leakage risk within Android applications,including the detection of privacy leakage within program components,the detection of privacy leakage between components,and the detection of ICC vulnerability.Actually,the behavior of sharing users privacy through collaboration among application components is widespread,which causes a large number of users privacy information to be leaked.How to effectively detect and prevent privacy leakage between application components is an urgent problem.However,the number of components in Android applications is huge and there are plenty of components unrelated to privacy leaks between applications.Therefore,how to detect possible privacy leaks between applications meets a serious challenge.Aiming at this problem,this paper presents a method to construct a component sequence with potential privacy leaks,and the method uses data flow analysis technology to realize a detection system for privacy leakage between application components,named PLDetect.PLDetect solves the problem of incomplete coverage of code and lagging detection results in the existing technology.Finally,based on the privacy leak path,PLDetect utilizes an encryption-based privacy leak protection method to encrypt privacy information,ensuring that information is effectively prevented from being maliciously transmitted without affecting application runtime performance.The final experiment shows that PLDetect detects 5 groups of applications with privacy leaks across application components in 81 applications and effectively blocks privacy data leaks.