基于多因素聚类选择的Android应用程序分类风险评估方法

doi:10.11959/j.issn.2096-109x.2021023

摘要/Abstract

摘要：

大多数现有的Android应用程序风险评估根据经验直接指定因素的权重，通过统计少量因素的使用频率来计算安全风险。提出一种新的Android应用风险评估方法，能够同时提供定量和定性评估。该方法融合系统权限、API调用、Intent Filter的action属性以及数据流等多种风险因素，基于因素的风险分类与加成进行风险赋值，基于层次聚类对因素子集进行权重分配。实验表明，评估结果能够有效地反映Android应用程序的真实安全风险。

关键词: 安卓, 风险评估, 安全威胁, 静态分析, 层次聚类

Abstract:

Most existing risk assessments of Android applications directly assign weights to factors according to experience, and calculate security risks by counting the frequency statistics of few factors.A new method for risk assessment of Android applications is proposed, which can provide both quantitative and qualitative assessment.This method integrates multiple risk factors such as system permissions, API calls, the action properties of Intent Filter, and data flow.The risks of factors are assigned based on their risk classification and addition, and the weights of factor subsets are distributed based on hierarchical clustering.Experiments show that the assessment results can effectively reflect the real security risks of Android applications.

Key words: Android, risk assessment, security threat, static analysis, hierarchical clustering

中图分类号:

TP309.2

超凡, 杨智, 杜学绘, 韩冰. 基于多因素聚类选择的Android应用程序分类风险评估方法[J]. 网络与信息安全学报, 2021, 7(2): 161-173.

Fan CHAO, Zhi YANG, Xuehui DU, Bing HAN. Classified risk assessment method of Android application based on multi-factor clustering selection[J]. Chinese Journal of Network and Information Security, 2021, 7(2): 161-173.

图/表 13

表1

图1

图2

表2

表3

图3

表4

图4

表5

表6

图5

参考文献 22

[1]	PENG H , GATES C , SARMA B ,et al. Using probabilistic generative models for ranking risks of Android Apps[C]// The 19th ACM Conference on Computer and Communications Security (CCS). 2012: 241-252.
[2]	徐君锋, 王嘉捷, 朱克雷 ,等. 基于AHP的安卓应用安全信用指数度量方法[J]. 清华大学学报(自然科学版), 2018,58(2): 131-136.
	XU J F , WANG J J , ZHU K L ,et al. Credit index measurement method for Android application security based on AHP[J]. Journal of Tsinghua University(Science and Technology), 2018,58(2): 131-136.
[3]	RAHMAN A , PRADHAN P , PARTHO A ,et al. Predicting Android application security and privacy risk with static code metrics[C]// 2017 IEEE International Conference on Mobile Software Engineering and Systems. 2017: 149-153.
[4]	DINI G , MARTINELLI F , MATYEUCCI I ,et al. Risk analysis of Android applications:a user-centric solution[J]. Future Generation Computer Systems, 2018,80: 505-518.
[5]	张贤贤 . 安卓应用隐私评分技术的研究与实现[D]. 北京:北京邮电大学, 2018.
	ZHANG X X . Research and implementation of Android application privacy rating technology[D]. Beijing:Beijing University of Posts and Telecommunications, 2018.
[6]	李舟军, 吴春明, 王啸 . 基于沙盒的 Android 应用风险行为分析与评估[J]. 清华大学学报(自然科学版), 2016,56(5): 453-460.
	LI Z J , WU C M , WANG X . Analysis and assessment of Android application’s risk behavior based on sandbox[J]. Journal of Tsinghua University (Science and Technology), 2016,56(5): 453-460.
[7]	余小秋 . 基于行为分析的 Android 应用程序安全评估技术研究与系统设计[D]. 北京:北京邮电大学, 2015.
	YU X Q . The research and system design of Android application's safety assessment based on behavior analysis[D]. Beijing:Beijing University of Posts and Telecommunications, 2015.
[8]	卜同同, 曹天杰 . 基于权限的Android应用风险评估方法[J]. 计算机应用, 2019,39(1): 131-135.
	BU T T , CAO T J . Risk assessment method of Android application based on permission[J]. Journal of Computer Applications, 2019,39(1): 131-135.
[9]	王家琰 . Android应用软件安全检测与风险评估方法研究[D]. 郑州:战略支援部队信息工程大学, 2018.
	WANG J Y . Research on Android application security detection and risk assessment method[D]. Zhengzhou:Information Engineering University, 2018.
[10]	黄心依, 曾凡平 . 基于多重对应分析的Android应用安全等级评估[J]. 电子技术, 2016,8(18): 72-78.
	HUANG X Y , ZENG F P . The security level assessment model for Android application based on multiple correspondence analysis[J]. Electronic Technology, 2016,8(18): 72-78.
[11]	魏娟 . Android应用风险评估系统的设计与实现[D]. 成都:电子科技大学, 2015.
	WEI J . The design and implementation of application risk assessment system based on Android[D]. Chengdu:University of Electronic Science and Technology of China, 2015.
[12]	JING Y , AHN G J , ZHAO Z ,et al. RiskMon:Continuous and automated risk assessment of mobile applications[C]// The 4th ACM Conference on Data and Application Security and Privacy. 2014: 99-110.
[13]	PANDITA R , XIAO X , YANG W ,et al. WHYPER:Towards automating risk assessment of mobile applications[C]// The 22th USENIX Security Symposium. 2013: 527-542.
[14]	肖智婕 . 面向种群的Android安全风险评估和恶意应用检测[D]. 武汉:武汉科技大学, 2019.
	XIAO Z J . Population-based Android security risk assessment and malicious application detection[D]. Wuhan:Wuhan University of Science and Technology, 2019.
[15]	孟小峰, 朱敏杰, 刘俊旭 . 基于Android权限机制的应用安全检测方法[J]. 信息安全研究, 2019,5(9): 778-788.
	MENG X F , ZHU M J , LIU J X . Quantitative research on privacy risk of large-scale mobile users[J]. Journal of Information Security Research, 2019,5(9): 778-788.
[16]	中国互联网协会反网络病毒联盟. 移动互联网恶意代码描述规范[R]. 2011.
	Anti Network-Virus Alliance of China. Specification for mobile Internet malicious code[R]. 2011.
[17]	DESNOS A . Androguard documentation,release 3.3.5[R]. 2019.
[18]	ARZT S , RASTHOFER S , FRITZ C ,et al. FlowDroid:precise context,flow,field,object-sensitive and lifecycle-aware taint analysis for Android apps[C]// The 35th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI). 2014: 259-269.
[19]	GB/T 20984-2007,信息安全技术信息安全风险评估规范[S].
	GB/T 20984-2007,Information security technology-risk assessment specification for information security[S].
[20]	周志华 . 机器学习[M]. 北京: 清华大学出版社, 2016.
	ZHOU Z H . Machine learning[M]. Beijing: Tsinghua University Press, 2016.
[21]	ZHOU Y J , JIANG X X . Dissecting Android malware:characterization and evolution[C]// The 33rd IEEE Symposium on Security and Privacy (Oakland). 2012: 95-109.
[22]	GoogleGroups. VirusTotal[EB].

排序	安全威胁	行为描述
1	恶意扣费	通过隐秘执行、诱骗用户点击等手段，订购收费业务或支付金额，造成用户经济损失
2	隐私窃取	获取有关用户隐私信息的内容
3	远程控制	能够受到远程控制，接收指令并进行相关操作
4	恶意传播	通过感染、复制、发送、下载等方式扩散恶意代码
5	资费消耗	通过打电话、发短信、发邮件、联网等方式消耗用户资费
6	系统破坏	通过篡改、感染、劫持、删除、终止进程等手段导致设备或设备中其他软件、用户文件等部分或完全无法正常使用
7	诱骗欺诈	通过篡改、伪造、劫持短信、彩信、邮件、通信录、通话记录、收藏夹、桌面等方式诱骗欺诈用户，达到不正当目的
8	流氓行为	对系统没有直接损害，也未对用户信息、资费造成侵害的其他恶意行为

因素集	划分标准	因素子集
系统权限	申请的权限	①系统权限
API调用	申请相关权限并以API形式使用	②系统权限的API使用点
	未申请相关权限并以API形式使用	③系统权限的API使用点
Intent Filter	Activity组件声明	④系统action
	Service组件声明	⑤系统action
	Broadcast Receiver组件声明	⑥系统action
数据流	FlowDroid输出	⑦source-sink对

对象/安全威胁	1	2	3	4	5	6	7	8	风险等级	风险加成	风险值
BOOKMARK		√					√	√	7	3/21	80
CALENDAR		√							7	0	78
CALL_LOG		√					√		7	2/21	79
CONTACT		√					√		7	2/21	79
STORAGE		√		√					7	5/21	80
CAMERA		√							7	0	78
LOCATION		√							7	0	78
MIC		√							7	0	78
SENSOR		√							7	0	78
BLUETOOTH				√					5	0	56
MESSAGE	√	√		√	√		√		8	18/28	96
NETWORK	√	√	√	√	√	√	√	√	8	28/28	100
NFC				√					5	0	56
PHONE	√				√				8	4/28	91
SYNC		√							7	0	78
ACCOUNT		√							7	0	78
ID		√							7	0	78
LOG		√							7	0	78
SETTING						√			3	0	33
DEVICE						√		√	3	1/3	37
FILESYSTEM						√	√		3	2/3	41
PACKAGE				√			√	√	5	3/10	59
TASK			√			√		√	6	4/15	70
TEST						√			3	0	33
TOOL				√		√			5	3/10	59

因素子集	权重分配
1	0.155
2	0.188
3	0.149
4	0.132
5	0.091
6	0.179
7	0.106

因素子集	因素	数量	对象类别	风险值
1	android.permission.WAKE_LOCK	1	DEVICE	37
2	WAKE_LOCK对应API	3	DEVICE	37
3	INTERNET对应API	3	NETWORK	100
4	android.intent.action.MAIN	1	PACKAGE	59
7	STORAGE →LOG、STORAGE → SETTING、STORAGE → PACKAGE	13	STORAGE	80
	FILESYSTEM → LOG、PACKAGE → LOG	10	LOG	78
	FILESYSTEM → SETTING	1	FILESYSTEM	41
	FILESYSTEM → PACKAGE、PACKAGE → SETTING	3	PACKAGE	59