删除或更新信息，请邮件至freekaoyan#163.com(#换成@)

Android应用Intent通信风险分析及检测

本站小编 Free考研考试/2021-12-21
本文二维码信息
二维码（扫一下试试看！）
Android应用Intent通信风险分析及检测
Risk Analysis and Detection on Communication with Intents in Android Applications
投稿时间：2016-11-23
DOI：10.15918/j.tbit1001-0645.2017.06.014
中文关键词:组件劫持Intent数据泄露拒绝服务
English Keywords:component hijackingintentdata leakagedenial of service
基金项目:国家自然科学基金资助项目（U1536121，61370195）
作者单位E-mail
杨天长北京邮电大学计算机学院, 北京 100876
崔浩亮北京邮电大学计算机学院, 北京 100876
牛少彰北京邮电大学计算机学院, 北京 100876szniu@bupt.edu.cn
黄振鹏北京邮电大学计算机学院, 北京 100876
摘要点击次数:959
全文下载次数:1581
中文摘要:
针对Android应用Intent通信可能导致的安全风险，设计了基于动静结合的安全威胁检测方法.静态分析阶段检测应用中请求的内部和外部组件并判断组件是否存在被劫持的风险，然后对存在利用Extra属性进行数据传输的Intent对象利用污点跟踪确定是否存在数据和权限泄露；动态测试阶段根据静态分析检测到的Intent对象构造Fuzzing测试数据，发送测试指令给测试对象并收集应用的执行日志，确定是否存在拒绝服务风险.实验结果表明检测方法可以有效和全面地检测由Intent通信导致的安全缺陷.
English Summary:
In order to detect the security defects caused by the intent communication in Android applications, a detection method was proposed based on the combination of dynamic test and static analysis. In static analysis phase, the internal and external intentioned components in application were detected to estimate the risk of being hijacked according to the designed method. For components requested by the Intent with Extras attribute, sensitive data and privilege leakage were checked by stain tracking analysis at last. In dynamic testing phase, according to the Intents detected in the static analysis phase, the formatted test data were constructed for the Fuzzing test and the test instructions were sent to the application installed on the test platform. And the execution logs were collected and used to determine whether a risk of service denial exists. Experimental results show that, the detection method can detect effectively and comprehensively the Intent-based security defects.
查看全文查看/发表评论下载PDF阅读器
相关话题/北京 通信 测试 中文 数据

Free考研考试FreeKaoYan.Com
欢迎来到Free考研考试，"为实现人生的Free而奋斗"

© 2020 FreeKaoYan! . All rights reserved.