摘要:污点分析技术是检测Android智能手机隐私数据泄露的有效方法，目前主流的Android应用污点分析工具主要关注分析的精度，常常忽略运行效率的提升.在分析一些复杂应用时，过大的开销可能造成超时或程序崩溃等问题，影响工具的广泛使用.为了减少分析时间、提高效率，提出一种基于污染变量关系图的污点分析方法.该方法定义了污染变量关系图用于描述程序中污染变量及其关系，摒弃了传统数据流分析框架，将污点分析和别名分析进行结合，从程序中抽象出污染变量关系图和潜在污染流，并在控制流图上对潜在污染流进行验证以提高精度.详细描述了基于该方法所实现的工具FastDroid的架构、模块及算法细节.实验使用了3个不同的测试集，分别为DroidBench-2.0，MalGenome以及Google Play上随机下载的1517个应用.实验结果表明：FastDroid在DroidBench-2.0测试集上的查准率和查全率分别达到93.3%和85.8%，比目前主流工具FlowDroid更高，并且在3个测试集上所用的分析时间更少且更稳定.



Abstract:The taint analysis technology is an effective method to detect the privacy data leakage of Android smart phones. However, the state-of-the-art tools of taint analysis for Android applications mainly focus on the accuracy with few of them addressing the importance of the efficiency and time cost. Actually, the high cost may cause problems such as timeouts or program crashes when the tools analyze some complex applications, which block them from wide usage. This study proposes a novel taint analysis approach based on the tainted value graph, which reduces the time cost and improves the efficiency. The tainted value graph is formalized to describe the tainted values and their relationships and the taint analysis and alias analysis are combined together without using the traditional data flow analysis framework. In addition, the taint flows are verified on the control flow graph to improve accuracy. The architecture, modules, and algorithmic details of the proposed tool FastDroid are also described in this paper. The tool is evaluated on three test suites:DroidBench-2.0, MalGenome, and 1517 apps randomly downloaded from Google Play. The experimental results show that, compared with the tool FlowDroid, FastDroid has a higher precision of 93.3% and a higher recall of 85.8% on DroidBench-2.0, and the time cost for analysis is less and more stable on all the test suites.



PDF全文下载地址:

http://jos.org.cn/jos/article/pdf/6245