CN106126412A - The automatic Evaluation and Optimization of code quality based on Android API operating specification - Google Patents

Abstract

The present invention relates to a kind of automatic Evaluation and Optimization of code quality based on Android API operating specification.Its step includes: builds specific special resolver and resolves API general introduction document；Based on Android API operating specification, API is classified, set up API feature database；Setting up and automatically scan evaluation engine, Android application program to be measured calls API scanning, statistics calls the type distribution of API, and location removes API, do not recommends API and the calling station of hiding API；The code quality Optimizing Suggestions of automatization is provided, generates code quality assessment report.The present invention is to investigate Android application program to call the standardized degree of API and establish complete automatic check and evaluation system, Android application program developer can be effectively helped to detect and optimize the use of API, reduce the misuse of API, promote Android application program code quality, and then improve the safe class of Android application program.

Description

The automatic Evaluation and Optimization of code quality based on Android API operating specification

Technical field

The invention belongs to information technology, computer software technical field, be specifically related to a kind of based on Android API operating specification The automatic Evaluation and Optimization of code quality.

Background technology

Up to now, Google the Android system version researched and developed develops into from Android1.0 Marshmallow6.0, has issued more than 20 altogether and has planted different main versions, and corresponding Android application program DLL (Android Application Programming Interface, Android API) also rises to grade 23 from grade 1.Peace Each edition upgrading of tall and erect system all can be according to the demand of the aspects such as the function of system, performance, safety, correspondingly newly-increased, deletion With change part API, such as, when grade 21 upgrades to grade 22, increase 843 altogether newly, delete 29,144 API sides of change Method.But due to the inertial thinking of Android application developer, write code generally according to existing experience, ignore or do not note The API of Android official website statement uses suggestion, causes some not recommend or abandon use as far back as lowest version API is still called, and this can cause the application program write to there is potential safety problem, it is easier to is utilized by rogue program, example It is as general leak discloses CVE-2015-3833 in Common Vulnerabilities And Exposures (CVE) The information leakage leak that getRecentTasks () method causes, and the method in API Quality 21 by Android official website It is claimed as not recommending.As can be seen here, the improper use serious threat code quality of API, in turn result in mobile intelligent terminal The leakage of userspersonal information, even economic asset loss.

But up to the present, also it is not based on Android API operating specification Android application program code quality is carried out automatically The correlation technique of detection.Therefore the present invention is for the use of specification Android API, establishes complete automatic check and evaluation system, And propose the code quality optimisation strategy of automatization for developer's reference, make reducing API in process of application development By situation improperly, and then promote the code quality that Android application program is overall.

Summary of the invention

It is an object of the invention to fill up the blank at present Android application program API Calls standardization detected, propose one Planting the automatic Evaluation and Optimization of code quality based on Android API operating specification, the method can effectively help Android application program Developer detects and optimizes the use of API, reduces the misuse of API, promotes Android application program code quality, and then improves peace The safe class of tall and erect application program.

For achieving the above object, the present invention adopts the following technical scheme that

A kind of automatic Evaluation and Optimization of code quality based on Android API operating specification, its step includes:

1) summarizing the specific special resolver of document structuring for the API in Android source code, this resolver can complete to be owned API correspondence bag name, class name, method name and the extraction of parameter information and association；

2) based on Android API operating specification API is divided into and removes API, do not recommends API, hides API and normal API tetra-class, And set up API feature database；

3) foundation scans evaluation engine automatically, adds up Android application program to be measured and calls the type distribution of API, and location removes API, do not recommend API and the calling station of hiding API, based on API operating specification situation and API safety in utilization, propose code Quality classification method, assesses code quality；

4) the code quality optimisation strategy of automatization is provided, generates code quality assessment report, open for Android application program Send out personnel's reference.

Further, step 2) when setting up API feature database, for removing API, not recommending API and hiding API, need to search Whether API annotation exists and can cause security breaches such as information leak (deriving from American National vulnerability scan) etc. Keyword identification, if finding, think that this API can affect code security, in feature database for its add security implication mark Will, points out user's special concern.

Further, when setting up API feature database, for removing API, need to differentiate that it moves according to the version of API general introduction document Except initial version number.

Further, when setting up API feature database, for not recommending API, further extraction need to not recommend in source code annotates Initiate version number, do not recommend reason and Optimizing Suggestions.

Further, each API in API feature database records and includes following information: bag name, class name, method name, parameter Information, the most normally, whether remove, do not recommend, whether hide, the most safely, remove initial version number, do not recommend to initiate Version number, do not recommend reason and Optimizing Suggestions.

Further, step 3) use static disassembly analytical technology that Android application program to be measured is carried out dis-assembling, from Dynamic scanning show that it calls the type distribution of API；Step 3) described static disassembly analytical technology uses in following instrument Kind or multiple Android application program is carried out dis-assembling: apktool, dex2jar, Android Multitool and QARK etc..

Further, step 3) described code quality ranking method, consider abnormal API and (remove API, do not recommend API, hide API) proportion and weight, calculate code quality score, between 0.0-10.0, numerical value is the biggest, says Bright code quality is the poorest, and 0.0-3.5 is set to low danger rank, and 3.6-7.0 is set to middle danger rank, and 7.1-10.0 is set to high-risk level Not.

Further, step 4) content of described code quality assessment report includes: 1) type of routine call API to be measured Distribution；2) Android application program code quality rating result to be measured；3) routine call to be measured belong to every the API removing API Bag name, class name, method name, remove initial version number and concrete calling station；4) API is not recommended belonging to of routine call to be measured The bag name of every API, class name, method name, do not recommend initial version number, Optimizing Suggestions and concrete calling station；5) ranging is treated What sequence was called belongs to the bag name of every API of hiding API, class name, method name and concrete calling station.

The present invention proposes a kind of automatic Evaluation and Optimization of code quality based on Android API operating specification.By resolving Android official website API operating specification, classifies to API, sets up API feature database；On this basis, scan program to be measured to adjust With the distribution of API, assessment application code quality also proposes prioritization scheme.The present invention calls for investigating Android application program The standardized degree of API establishes complete Aulomatizeted Detect evaluation system, and provides the code quality optimisation strategy of automatization to supply Android application program developer's reference, is effectively reduced improper use and the misuse of API, and then it is whole to promote Android application program The code quality of body.

Accompanying drawing explanation

Fig. 1 is the flow chart of the automatic Evaluation and Optimization of code quality based on Android API operating specification of embodiment.

Fig. 2 is each processing module schematic diagram of the automatic Evaluation and Optimization of code quality of embodiment.

Fig. 3 is the flow chart setting up API feature database in embodiment.

Fig. 4 is the flow chart of scanning assessment code quality automatically in embodiment.

Fig. 5 is the syntactic analysis tree schematic diagram of API general introduction document resolver in embodiment.

Detailed description of the invention

Below in conjunction with the accompanying drawings, by embodiment, the present invention is further illustrated.

The automatic Evaluation and Optimization of code quality based on Android API operating specification of the present embodiment, its overall procedure is such as Shown in Fig. 1, each processing module is as in figure 2 it is shown, the method mainly comprises the steps that

1) summarize the specific special resolver of document structuring for the API in Android source code, set up syntactic analysis tree, pass through PID Packet Identifier, class identifier and method identifier can effectively position the bag name of each API, class name and method name, and then location The number of parameters of method and type, complete all API correspondence bag names, class name, method name and the extraction of parameter information and association.

2) search Android sound code file according to analysis result, position the position that realizes of each API, and its comment section is entered Row text mining, extracts the keyword relating to API operating specification.API is divided into and removes API, do not recommend API, hide API and just Often API tetra-class, sets up API feature database.For removing API, not recommending API and hiding API, need to determine whether in source code annotation Whether contain the keyword having an impact code safety, if containing, in feature database, add security implication mark to carry for this API Show user's special concern.

Specifically, based on Android API operating specification, API is classified, set up steps flow chart such as Fig. 3 of API feature database Shown in, it is described as follows:

2a) according to 1) in API summarize document analysis result, in Android source code position location API implement position, draw Divide its function body to realize and code annotation part, forward 2b to).

2b) comment section is carried out text mining, extract the keyword relevant to API operating specification, forward 2c to).

2c) according to key characteristics, API is divided into and removes API, do not recommend API, hide API and normal API tetra-class, turn To 2d)

2d) judge whether each API is normal API, the most then forward 2j to), directly in data base, create bar for it Mesh；If it is not, then forward 2e to).

2e) it is categorized further, as improper API removing API, not recommending API and hiding API, and gets the bid data base Know, forward 2f to).

2f) search each to remove API, do not recommend whether the source code of API and hiding API exists such as in annotating Information leak (deriving from American National vulnerability scan) etc. can cause the keyword identification of security breaches, if existing Then think that this API can cause application code to there is potential safety problem, forward 2g to)；If nothing, then forward 2h to).

It is 2g) that this API adds security implication mark, reminds user to pay attention in more, forward 2h to).

2h) judge whether this API is not recommend API, if so, forward 2i to), extract relevant information further；If it is not, then Forward 2j to).

2i) extract in API source code annotates and do not recommend not recommending initial version number, not recommending reason and optimization to build of API Views etc., forward 2j to).

2j) the information sorted out according to above-mentioned steps, creates API feature database.Each API record in API feature database Including following information: bag name, class name, method name, parameter information, the most normally, whether remove, do not recommend, whether hide, The most safely, remove initial version number, do not recommend to initiate version number, do not recommend reason and Optimizing Suggestions.

3) foundation scans evaluation engine automatically, assesses the code quality of Android application program to be measured.Use static analysis skill Art carries out dis-assembling to Android application program to be measured, and scanning show that it calls the type distribution of API automatically, and location wherein removes API, do not recommend the concrete calling station of API, propose code quality ranking method, assess code quality；

Specifically, automatically scan evaluation engine, assess the steps flow chart of program code quality to be measured as shown in Figure 4, specifically It is described as follows:

3a) Android application program to be measured is entered by the instrument such as apktool, dex2jar, Android Multitool and QARK Row dis-assembling, obtains .dex file, forwards 3b to).

3b) resolve .dex file, Study document head, obtain the deviant of each class, and then navigate to class block, analyze each Each method that class comprises and calling station thereof and physical storage address, forward 3c to).

3c) analyzing in Android application program to be measured the type of all API called, statistics removes API, does not recommend API, hidden Hide API and normal API percentage, forward 3d to).

3d) judge whether all API that Android application program to be measured is called contain remove API, do not recommend API and hide API, if having, then forwards 3e to)；If nothing, then forward 3f to).

3e) scan that Android application program to be measured calls removes API, does not recommend the concrete invocation bit of API and hiding API Put, facilitate Android application program developer to position, forward 3f to).

3f) adding up the API type distribution that Android application program to be measured is called, what inspection was called removes API, does not recommend API Whether there is safety issue with hiding API, based on API operating specification situation and API safety in utilization, propose code quality and comment Level method, assesses code quality.

The code quality ranking method that the present invention proposes considers abnormal API proportion and weight, calculates Code quality score, between 0.0-10.0, numerical value is the biggest, and description code quality is the poorest, and 0.0-3.5 is set to low danger level Not, 3.6-7.0 is set to middle danger rank, and 7.1-10.0 is set to high-risk rank.Circular is as follows: by Android application journey to be measured The API type distribution that sequence is called, it is known that the normal API number called is L, removing API number is M, and not recommending API number is N, Hiding API number is O.According to abnormal API, the dangerous of program is set ratio value, normal API: remove API: do not recommend API: hide API=1:4:3:2.Then the computing formula of code quality Q is:

$Q=\frac{4\×M+3\×N+2\×O}{L+4\×M+3\×N+2\×O}\×10$

Wherein, in order to highlight the potential danger that safety-related abnormal API is brought, each class is promoted abnormal In API, the weights of safety-related API are 2.Assuming to remove security-related in API has A, and unrelated with safety has B, then M in above formula is replaced withIn like manner, API and hiding API is not recommended to do similar replacement yet.

4) from API feature database, Optimizing Suggestions is extracted, it is provided that the code quality optimisation strategy of automatization also generates code matter Amount assessment report, for Android application program developer's reference.Code quality assessment report content includes:

4a) Android application program to be measured calls the type distribution of API.

4b) Android application program code quality rating result to be measured.

What 4c) Android application program to be measured was called belongs to the bag name of every the API removing API, class name, method name, removes Initial version number and concrete calling station.

The bag name of every the API not recommending API that what 4d) Android application program to be measured was called belong to, class name, method name, no Recommend initial version number, Optimizing Suggestions and concrete calling station.

The bag name of every the API belonging to hiding API that 4e) Android application program to be measured is called, class name, method name and concrete Calling station.

Providing below a concrete application example, implementation step includes:

1) the API general introduction document that specific special resolver resolves in Android source code is constructed.For Android.app.Activity Manager.setWatchHeapLimit (long) method, the syntactic analysis tree obtained such as figure Shown in 5.Bag name, class name and the method for each API can be effectively positioned by PID Packet Identifier, class identifier and method identifier Name, and then the number of parameters of localization method and type, and associated correspondence.

2) set up API feature database, based on Android API operating specification, API is classified.Table 1 is android.app.Act IvityManager.getRunningTasks (int) method and Android.database.sqlite.SQLiteProgram.native_bind_long (int long) method is in API feature Logic Structure Design in storehouse.The flag bit of " the most normal ", " whether removing ", " not recommending " and " whether hiding " embodies API classification.Whether " safety " be if flag bit 0 shows that this API may affect code safety.

Table 1.API feature database Logic Structure Design

One section of English in upper table is translated into Chinese and is: from LOLLIPOP version, because personal information may be let out by the method Reveal to called side, the unusable the method for third-party application.For back compatible, the method returns called side self mission bit stream, With other insensitive mission bit streams.

3) foundation scans evaluation engine automatically, assesses the code quality of program to be measured.Assume in Android application program to be measured The all types of API called are as shown in table 2.In table, data are illustrative only.

The all types of API numbers called in table 2 Android application program to be measured

The code quality ranking method proposed according to the present invention, is calculated the code quality of this Android application program to be measured Rating score Q is:

$Q=\frac{4\×1.2\×25+3\×1.25\×20+2\×1.2\×10}{200+4\×1.2\×25+3\×1.25\×20+2\×1.2\×10}\×10\≈5.23$

Belong to middle danger rank.

Location removes API, does not recommend API and hiding API calling station in the application, if do not recommended AP further I:android.app.ActivityManager.getRunningTasks (int), concrete calling station is as follows:

Lcom/wbtech/ums/common/CommonUtil；->getPackageName(Landroid/content/ Context；)Ljava/lang/String；

Lcom/fengjr/mobile/act/Base；->getActivityCountInTask()I

Lcom/fengjr/mobile/util/d；->e()Z

Lcom/wbtech/ums/common/CommonUtil；->getActivityName(Landroid/ content/Context；)Ljava/lang/String；

Lcom/fengjr/mobile/receiver/MipushMessageReceiver；-> isAppRunningForeground(Landroid/content/Context；)Z

Lcom/fengjr/mobile/receiver/JPushReceiver；->a(Landroid/content/ Context；)Z

Lcom/fengjr/mobile/act/Base；->isAppRunningForeground(Landroid/ content/Context；)Z

4) the code quality optimisation strategy of automatization is provided.Such as not recommending API:Landroid/net/ Connecti vityManager；-> getNetworkInfo (I), it is provided that optimisation strategy as follows:

This method was deprecated in API level 23.This method does not support multiple connected networks of the same type.Use getAllNetworks()and getNetworkInfo(android.ne t.Network)instead.

Chinese corresponding to one section of English is above: the method is classified as not recommending API in API Quality 23.The party Method does not support that the network of multiple same type connects, and please use getAllNetworks () and getNetworkInfo (android.net.Net work) substitutes.

For not recommending API:Landroid/speech/tts/TextToSpeech；->getFeatures (Ljava/util/Locale；), it is provided that following Optimizing Suggestions:

This method was deprecated in API level 21.As of API level 21,please use voices.In order to query features of the voice,call getVoices()to retrieve the list of available vo ices and getFeatures()to retrieve the set of features.

Chinese corresponding to one section of English is above: the method is classified as not recommending API in API Quality 21, please Use voices.Sound characteristic to be inquired about, please call getVoices () and retrieve available sounds list, and call getFeatures () retrieval sound characteristic set.

Generate code quality assessment report.Content includes the type distribution of routine call API to be measured, removes API, do not recommends A PI and the relevant information of hiding API, concrete calling station and Optimizing Suggestions etc., for Android application program developer's reference And carry out follow-up decision process.

Above example is merely to illustrate technical scheme rather than is limited, the ordinary skill of this area Technical scheme can be modified or equivalent by personnel, without departing from the spirit and scope of the present invention, and this The protection domain of invention should be as the criterion with described in claim.

Claims (10)

1. the automatic Evaluation and Optimization of code quality based on Android API operating specification, its step includes:

1) in Android source code API summarize document structuring resolver, by this resolver complete all API correspondence bag names, Class name, method name and the extraction of parameter information and association；

2) based on Android API operating specification API is divided into and removes API, do not recommends API, hides API and normal API tetra-type, And set up API feature database；

3) adding up Android application program to be measured and call the type distribution of API, location removes API, does not recommend API's and hiding API Calling station, based on API operating specification situation and API safety in utilization, proposes code quality ranking method, assesses code matter Amount；

4) the code quality optimisation strategy of automatization is provided, generates code quality assessment report.

2. the method for claim 1, it is characterised in that: step 1) API general introduction document in described Android source code includes The existing API document removing API document and the most up-to-date Android system version of each Android system version.

3. the method for claim 1, it is characterised in that: step 2) when setting up API feature database, for removing API, not pushing away Recommending API and hiding API, it is judged that whether this API has potential safety hazard, if having, in feature database, adding security implication mark for it Will, points out user's special concern.

4. method as claimed in claim 3, it is characterised in that differentiate whether API has the method for potential safety hazard and be: search Whether API annotation existing the keyword identification that can cause security breaches, if finding, thinking that this API has potential safety hazard.

5. method as claimed in claim 4, it is characterised in that: the described keyword identification causing security breaches derives from U.S. Country of state vulnerability scan, including information leak.

6. the method for claim 1, it is characterised in that: step 2) when setting up API feature database, for removing API, according to The version of API general introduction document differentiates that it removes initial version number；For not recommending API, extract in source code annotates and do not recommended Beginning version number, do not recommend reason and Optimizing Suggestions.

7. the method for claim 1, it is characterised in that each API record in API feature database includes following letter Breath: bag name, class name, method name, parameter information, the most normally, whether remove, do not recommend, whether hide, whether safety, Remove initial version number, do not recommend to initiate version number, do not recommend reason and Optimizing Suggestions.

8. the method for claim 1, it is characterised in that: step 3) use static disassembly analytical technology to Android to be measured Application program carries out dis-assembling, and scanning show that it calls the type distribution of API automatically；Described static disassembly analytical technology uses One or more in following instrument Android application program is carried out dis-assembling: apktool, dex2jar, AndroidMultitool and QARK.

9. the method for claim 1, it is characterised in that: step 3) described code quality ranking method, consider not Normal API i.e. removes API, does not recommend API, hiding API proportion and weight, calculates code quality score, between Between 0.0-10.0, numerical value is the biggest, and description code quality is the poorest, and 0.0-3.5 is set to low danger rank, during 3.6-7.0 is set to Danger rank, 7.1-10.0 is set to high-risk rank.

10. the method for claim 1, it is characterised in that step 4) content of described code quality assessment report includes: 1) type distribution of routine call API to be measured；2) Android application program code quality rating result to be measured；3) routine call to be measured Belong to the bag name of every the API removing API, class name, method name, remove initial version number and concrete calling station；4) to be measured The belonging to the bag name of every the API not recommending API, class name, method name, do not recommend initial version number, Optimizing Suggestions of routine call With concrete calling station；5) the bag name of every the API belonging to hiding API of routine call to be measured, class name, method name and specifically adjust Use position.