CN103227992A - Android terminal-based vulnerability scanning system - Google Patents
Android terminal-based vulnerability scanning system Download PDFInfo
- Publication number
- CN103227992A CN103227992A CN2013101103509A CN201310110350A CN103227992A CN 103227992 A CN103227992 A CN 103227992A CN 2013101103509 A CN2013101103509 A CN 2013101103509A CN 201310110350 A CN201310110350 A CN 201310110350A CN 103227992 A CN103227992 A CN 103227992A
- Authority
- CN
- China
- Prior art keywords
- scanning
- android terminal
- vulnerability
- user
- scanning system
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Computer And Data Communications (AREA)
Abstract
The invention relates to an Android terminal-based vulnerability scanning system which comprises an Android terminal, a weak password detection module and a scanning control platform, wherein the Android terminal is connected with the scanning control platform through the weak password detection module. According to the Android terminal-based vulnerability scanning system, the Android terminal can be scanned comprehensively, through port scanning, a user can check opened ports, and through vulnerability scanning, vulnerabilities of the terminal can be scanned out, and patches can be downloaded to repair the vulnerabilities; and hardware information of the terminal is stored in an encrypted file, and the user can view the file through decryption, so that the file cannot be stolen, and safety is improved. The Android terminal-based vulnerability scanning system can improve safety of Android terminal equipment, and decreases vulnerabilities of the terminal equipment.
Description
Technical field
The present invention relates to network communications technology field, be specifically related to a kind of vulnerability scanning system based on the Android terminal.
Background technology
According to incompletely statistics, on Internet, have and surpass server and the client that 95% hacker can attack those mis-arranges.These server and client sides often exist a lot of security breaches, and the hacker of most of the Internets just seeks the security breaches that exist by some simple scanning imaging systems in fact.By stamping corresponding security patch or revising corresponding configuration, just can stop most attack.
The cyberspace vulnerability scanning system is exactly to come from the instrument that the hacker adopts when the invasion network system.The cyberspace vulnerability scanning system is comprehensively tested system, and test result is analyzed according to known security breaches set, and the leak to system provides the repairing suggestion at last.The cyberspace vulnerability scanning system can help the network manager to find the security breaches that may exist early before the assailant attacks, and got rid of potential safety hazard, prevented trouble before it happens.
Nowadays, the Android system is very universal, the Android mobile phone is seen everywhere especially, along with gradually becoming strong of cell-phone function, mobile phone has been not only a communication equipment, and people also surf the Net through mobile phone commonly used, some hackers just may invade people's mobile phone by network, obtain personal information and number of the account etc., so, our attention also should be caused for the safety problem of mobile phone.At present, have the strategy of multiple solution based on Android terminal security problem, wherein vulnerability scanning system can be found the leak that system is potential, prevents trouble before it happens, and becomes one of important technology of terminal security.
Android software itself exists as leaks such as internal memory leakages, and the user needs in time to repair leak to improve the fail safe of terminal; Secondly Android system development so far, leak is attacked also to be existed often, the patch of Google issue needs download timely to repair terminal, makes its maintenance safety and stability.
Summary of the invention
The objective of the invention is to propose, can find system vulnerability potential in the Android terminal equipment, improve the fail safe of Android terminal equipment, reduce the leak that terminal equipment exists by native system at having the problem of leak in the Android terminal equipment.
Technical scheme of the present invention is:
A kind of vulnerability scanning system based on the Android terminal comprises Android terminal, weak tendency password detection module and scan control platform, and described Android terminal use links to each other by weak tendency password detection module with the scan control platform.
Further, the scan control platform comprises vulnerability scanning, application information scanning, TCP and end message scanning, and described vulnerability scanning links to each other with vulnerability database, and vulnerability database carries out the vulnerability database down loading updating by downloading leak information from server; Described application information scanning links to each other with vulnerability database, is used for checking of set up applications information; Described TCP comprises tcp port scanning and udp port scanning; Described end message scanning provides by the file of encrypting.
Beneficial effect of the present invention is: 1) can in time pass through the server update vulnerability database, scan existing leak of Android terminal and download patches, thereby help reducing the attack that comes from network; 2) can check port information by TCP, be convenient to the user and the later stage respective handling is done in the corresponding port.
Description of drawings
Fig. 1 is the theory diagram of native system.
Embodiment
The present invention is further illustrated below in conjunction with drawings and Examples.
A kind of vulnerability scanning system based on the Android terminal comprises Android terminal, weak tendency password detection module and scan control platform, and described Android terminal use links to each other by weak tendency password detection module with the scan control platform.
At first, the Android terminal use will be at first carry out password to the user and detect before entering the scan control platform, if the key of user's input correctly then judge that the user has authority to enter vulnerability scanning system, can enter the scan control platform.
Further, the scan control platform comprises vulnerability scanning, application information scanning, TCP and end message scanning, described vulnerability scanning links to each other with vulnerability database, vulnerability database is by downloading leak information from server, carry out the vulnerability database down loading updating, mate with the Android terminal then; Described application information scanning links to each other with vulnerability database, is used for checking of set up applications information; Described TCP comprises tcp port scanning and udp port scanning; Described end message scanning provides by the file of encrypting.
Further, the Socket based on Transmission Control Protocol is used in tcp port scanning, and the Datagram Socket based on udp protocol is used in udp port scanning.When the Socket that uses based on Transmission Control Protocol, create Socket, subsequently connect is carried out in the corresponding port, at last Socket is closed; DatagramSocke when using based on udp protocol at first creates DatagramPacket, creates corresponding DatagramChannel subsequently, and connect creates DatagramSocket then, and sends data, judges according to sending the result whether port is opened.The user can freely select TCP or udp port scanning.Whether after TCP, the user can check terminal prot information, knows that thus which port is open, select port to open according to the Android terminal for safe requirement then, can close the port that there is risk in some.
In addition, when carrying out vulnerability scanning, at first need to download already present leak information from server, carry out the vulnerability database down loading updating,, multiple attributes such as the dbase of comprising and version number arranged with the AppInfo(customization type) form is stored among the ArrayList, the ArrayList of the dbase of retrieving out with the Android terminal compares then, if there is leak in the Android terminal, then can offer the patch download address of user's relevant vulnerability, the user can select to download voluntarily.
When the user checked application information, the user can see all application programs that the Android terminal is installed.Obtain a series of information such as the title of corresponding software and version number by creating the PackageInfo example, show in the tabulation mode at last, software for display name and version number, the system that being convenient to vulnerability scanning and leak influences is complementary.
When the user checked terminal hardware information, terminal hardware information provided by file, and this file is encrypted, DES provided herein, DESed, three kinds of cryptographic algorithm of AES.With DES is example, according to the encryption key of input, creates the Cipher example, by init () function and doFinal () function character string is encrypted then.
The course of work of native system is: the user who holds the Android terminal equipment at first needs to input password, and this password just can not be changed once input, and after this land this system all needs to input this password at every turn, and this password can not be too simple; After the user enters system, the user according to own needs select that leak is checked, application information is checked, terminal hardware information inspection or port information check.
The present invention can in time pass through the server update vulnerability database, scans the existing leak of Android terminal and downloads the leak patch according to the patch download address, thereby help reducing the attack that comes from network; Can check port information by TCP, be convenient to the user and the later stage respective handling is done in the corresponding port.
Claims (6)
1. vulnerability scanning system based on the Android terminal is characterized in that: comprise Android terminal, weak tendency password detection module and scan control platform, described scan control platform links to each other with the Android terminal use by weak tendency password detection module.
2. the vulnerability scanning system based on the Android terminal according to claim 1, it is characterized in that: comprise that also weak tendency password detection module carries out the step that password detects to the user, when the user imports correct key, then system judges that the user has authority to enter the scan control platform; Otherwise the user cannot enter the scan control platform.
3. the vulnerability scanning system based on the Android terminal according to claim 1, it is characterized in that: described weak tendency password detection module comprises vulnerability scanning, application information scanning, TCP and four functional modules of end message scanning, described vulnerability scanning links to each other with vulnerability database, vulnerability database carries out the vulnerability database down loading updating by downloading leak information from server; Described application information scanning links to each other with vulnerability database, is used for checking of set up applications information; Described TCP comprises tcp port scanning and udp port scanning; Described end message scanning provides by the file of encrypting.
4. the vulnerability scanning system based on the Android terminal according to claim 3 is characterized in that: the described information of set up applications comprises the name and the version number of application program.
5. the vulnerability scanning system based on the Android terminal according to claim 3 is characterized in that: the Socket based on Transmission Control Protocol is used in described tcp port scanning, and the Datagram Socket based on udp protocol is used in udp port scanning.
6. the vulnerability scanning system based on the Android terminal according to claim 3 is characterized in that: described end message scanning is used for the display terminal hardware information.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2013101103509A CN103227992A (en) | 2013-04-01 | 2013-04-01 | Android terminal-based vulnerability scanning system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2013101103509A CN103227992A (en) | 2013-04-01 | 2013-04-01 | Android terminal-based vulnerability scanning system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN103227992A true CN103227992A (en) | 2013-07-31 |
Family
ID=48838209
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2013101103509A Pending CN103227992A (en) | 2013-04-01 | 2013-04-01 | Android terminal-based vulnerability scanning system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103227992A (en) |
Cited By (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103501496A (en) * | 2013-09-26 | 2014-01-08 | 国家电网公司 | Detection device based on IEEE802.11 wireless communication safety in intelligent electric network |
| CN103996007A (en) * | 2014-05-29 | 2014-08-20 | 诸葛建伟 | Testing method and system for Android application permission leakage vulnerabilities |
| CN105095737A (en) * | 2014-04-16 | 2015-11-25 | 阿里巴巴集团控股有限公司 | Method and device for detecting weak password |
| CN105243329A (en) * | 2015-10-26 | 2016-01-13 | 北京奇虎科技有限公司 | Method and system for vulnerability discovery of Android system |
| CN105389510A (en) * | 2015-12-14 | 2016-03-09 | 江山市同舟数码科技有限公司 | Android mobile device malicious software detection method and system |
| CN105915565A (en) * | 2016-06-30 | 2016-08-31 | 浙江宇视科技有限公司 | Authentication method, device and system |
| CN106033512A (en) * | 2015-03-20 | 2016-10-19 | 中兴通讯股份有限公司 | Security vulnerability reinforcing method and system |
| CN106919844A (en) * | 2017-02-14 | 2017-07-04 | 暨南大学 | A kind of android system vulnerability of application program detection method |
| CN106921731A (en) * | 2017-01-24 | 2017-07-04 | 北京奇虎科技有限公司 | Leak restorative procedure and device |
| CN107392033A (en) * | 2017-08-30 | 2017-11-24 | 杭州安恒信息技术有限公司 | A kind of Android device Permeation Test System and its automation penetration testing method |
| CN107592302A (en) * | 2017-08-23 | 2018-01-16 | 北京国信云服科技有限公司 | The port scanner and method of a kind of mobile terminal |
| CN109067709A (en) * | 2018-07-06 | 2018-12-21 | 北京知道创宇信息技术有限公司 | A kind of Vulnerability Management method, apparatus, electronic equipment and storage medium |
| CN113190837A (en) * | 2021-03-29 | 2021-07-30 | 贵州电网有限责任公司 | Web attack behavior detection method and system based on file service system |
| CN114021144A (en) * | 2021-11-08 | 2022-02-08 | 安天科技集团股份有限公司 | Software vulnerability detection method and device, computer equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7424746B1 (en) * | 2001-11-30 | 2008-09-09 | Mcafee, Inc. | Intrusion detection and vulnerability assessment system, method and computer program product |
| CN102222184A (en) * | 2011-05-17 | 2011-10-19 | 中兴通讯股份有限公司 | Method and system for killing mobile terminal viruses |
| CN102945351A (en) * | 2012-11-05 | 2013-02-27 | 中国科学院软件研究所 | Security vulnerability fixing method based on two-dimensional code for mobile intelligent terminal in cloud environment |
-
2013
- 2013-04-01 CN CN2013101103509A patent/CN103227992A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7424746B1 (en) * | 2001-11-30 | 2008-09-09 | Mcafee, Inc. | Intrusion detection and vulnerability assessment system, method and computer program product |
| CN102222184A (en) * | 2011-05-17 | 2011-10-19 | 中兴通讯股份有限公司 | Method and system for killing mobile terminal viruses |
| CN102945351A (en) * | 2012-11-05 | 2013-02-27 | 中国科学院软件研究所 | Security vulnerability fixing method based on two-dimensional code for mobile intelligent terminal in cloud environment |
Non-Patent Citations (1)
| Title |
|---|
| 罗玉斌: "网络安全漏洞扫描系统的涉及与实现", 《中国优秀硕士论文全文数据库》 * |
Cited By (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103501496A (en) * | 2013-09-26 | 2014-01-08 | 国家电网公司 | Detection device based on IEEE802.11 wireless communication safety in intelligent electric network |
| CN105095737B (en) * | 2014-04-16 | 2019-03-01 | 阿里巴巴集团控股有限公司 | The method and apparatus for detecting weak password |
| CN105095737A (en) * | 2014-04-16 | 2015-11-25 | 阿里巴巴集团控股有限公司 | Method and device for detecting weak password |
| CN103996007A (en) * | 2014-05-29 | 2014-08-20 | 诸葛建伟 | Testing method and system for Android application permission leakage vulnerabilities |
| CN106033512A (en) * | 2015-03-20 | 2016-10-19 | 中兴通讯股份有限公司 | Security vulnerability reinforcing method and system |
| CN105243329A (en) * | 2015-10-26 | 2016-01-13 | 北京奇虎科技有限公司 | Method and system for vulnerability discovery of Android system |
| CN105389510A (en) * | 2015-12-14 | 2016-03-09 | 江山市同舟数码科技有限公司 | Android mobile device malicious software detection method and system |
| CN105915565A (en) * | 2016-06-30 | 2016-08-31 | 浙江宇视科技有限公司 | Authentication method, device and system |
| CN106921731B (en) * | 2017-01-24 | 2021-06-22 | 北京奇虎科技有限公司 | Vulnerability repair method and device |
| CN106921731A (en) * | 2017-01-24 | 2017-07-04 | 北京奇虎科技有限公司 | Leak restorative procedure and device |
| CN106919844B (en) * | 2017-02-14 | 2019-08-02 | 暨南大学 | A kind of android system vulnerability of application program detection method |
| CN106919844A (en) * | 2017-02-14 | 2017-07-04 | 暨南大学 | A kind of android system vulnerability of application program detection method |
| CN107592302A (en) * | 2017-08-23 | 2018-01-16 | 北京国信云服科技有限公司 | The port scanner and method of a kind of mobile terminal |
| CN107592302B (en) * | 2017-08-23 | 2021-07-20 | 北京国信云服科技有限公司 | Port scanner and method for mobile terminal |
| CN107392033A (en) * | 2017-08-30 | 2017-11-24 | 杭州安恒信息技术有限公司 | A kind of Android device Permeation Test System and its automation penetration testing method |
| CN107392033B (en) * | 2017-08-30 | 2019-12-31 | 杭州安恒信息技术股份有限公司 | Android device penetration test system and automatic penetration test method thereof |
| CN109067709A (en) * | 2018-07-06 | 2018-12-21 | 北京知道创宇信息技术有限公司 | A kind of Vulnerability Management method, apparatus, electronic equipment and storage medium |
| CN109067709B (en) * | 2018-07-06 | 2021-08-06 | 北京知道创宇信息技术股份有限公司 | Vulnerability management method and device, electronic equipment and storage medium |
| CN113190837A (en) * | 2021-03-29 | 2021-07-30 | 贵州电网有限责任公司 | Web attack behavior detection method and system based on file service system |
| CN114021144A (en) * | 2021-11-08 | 2022-02-08 | 安天科技集团股份有限公司 | Software vulnerability detection method and device, computer equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103227992A (en) | Android terminal-based vulnerability scanning system | |
| US11463458B2 (en) | Protecting against and learning attack vectors on web artifacts | |
| Antonakakis et al. | Understanding the mirai botnet | |
| US9584543B2 (en) | Method and system for web integrity validator | |
| KR101386097B1 (en) | Platform validation and management of wireless devices | |
| EP2748751B1 (en) | System and method for day-zero authentication of activex controls | |
| Nasr et al. | Power jacking your station: In-depth security analysis of electric vehicle charging station management systems | |
| Giaretta et al. | Adding salt to pepper: A structured security assessment over a humanoid robot | |
| US20150031332A1 (en) | Network and data security testing with mobile devices | |
| CN104468632A (en) | Loophole attack prevention method, device and system | |
| D'Orazio et al. | A Markov adversary model to detect vulnerable iOS devices and vulnerabilities in iOS apps | |
| Wang et al. | A new cross-site scripting detection mechanism integrated with HTML5 and CORS properties by using browser extensions | |
| Ray et al. | Bluetooth low energy devices security testing framework | |
| Makrakis et al. | Vulnerabilities and attacks against industrial control systems and critical infrastructures | |
| Pistoia et al. | Labyrinth: Visually configurable data-leakage detection in mobile applications | |
| Gür et al. | Security analysis of computer networks: Key concepts and methodologies | |
| Liebl et al. | Analyzing the attack surface and threats of industrial Internet of Things devices | |
| Knockel et al. | Protecting Free and Open Communications on the Internet Against Man-in-the-Middle Attacks on Third-Party Software: We're FOCI'd. | |
| Karl et al. | No keys to the kingdom required: a comprehensive investigation of missing authentication vulnerabilities in the wild | |
| KR20100124441A (en) | Apparatus and method for inspecting a contents and controlling apparatus of malignancy code | |
| Bai et al. | TD‐WS: a threat detection tool of WebSocket and Web Storage in HTML5 websites | |
| de Carné de Carnavalet | Last-Mile TLS Interception: Analysis and Observation of the Non-Public HTTPS Ecosystem | |
| Herodotou et al. | Spying on the Spy: Security Analysis of Hidden Cameras | |
| Ferronato | Iot white worms: design and application | |
| Cui | Embedded system security: A software-based approach |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C02 | Deemed withdrawal of patent application after publication (patent law 2001) | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20130731 |