JP6280018B2 - Rule deviation application discovery apparatus, rule deviation application discovery system, and rule deviation application discovery method - Google Patents

Description

  The present invention relates to a rule deviation application discovery apparatus, a rule deviation application discovery system, and a rule deviation application discovery method. More specifically, the present invention relates to a technique for a mobile network operator or the like to discover an application that does not follow the guidelines that it presents.

  As mobile devices such as smartphones have become widespread and processing capabilities have improved, various applications for mobile devices have been provided. For this reason, it is required to check whether an application provided by a mobile network operator or the like violates guidelines for creating an application.

  Conventionally, whether an application complies with application creation rules describing guidelines has been confirmed by static analysis. For example, a technique has been proposed in which a smartphone application that uploads privacy-related information to the Internet is discovered by static analysis (see Non-Patent Document 1).

Clint Gibber, et.al., "AndroidLeaks: Automatically Detecting Potential Privacy Leaks in Android Applications on a Large Scale", Supringer, Pages 291-307, 2012

  In the conventional static analysis, it is possible to find the target method, but it is not possible to perform a check reflecting the actual operation of the application. For example, if the communication timing of a smartphone application is correct, it is necessary to carefully check the source code in static analysis, and it is difficult to perform such confirmation for smartphone applications where many applications are released It is.

  An object of the present invention is to discover an application that performs communication that deviates from the application creation rule by using both static analysis from the source code of the application and dynamic analysis of the operation result of the application. .

A rule deviation application discovery apparatus according to an aspect of the present invention is provided.
A rule-deviation application discovery device that discovers applications that violate guidelines for creating applications,
A packet generation that reads a mapping file that associates a predetermined communication-related method with the characteristics of the packet generated by calling the communication-related method, and expresses the order of packets generated by the discovery target application using the packet characteristics A pre-processing unit for generating an order;
The packet capture data output by the application including the discovery target application and the application creation rules described in accordance with the guidelines for creating the application are read, and the discovery is performed from the capture data based on the packet generation order. A rule deviation application discovery unit for extracting a packet of a target application and finding a packet deviating from the application creation rule;
It is characterized by having.

Further, the rule deviation application discovery system according to one aspect of the present invention is:
A rule deviation application discovery device for finding an application that violates the guidelines for creating an application;
A mapping file generating device that captures a packet generated by calling a predetermined communication-related method, and generates a mapping file that associates the communication-related method with the characteristics of the captured packet;
A capture server that generates capture data for packets output by the application;
A rule deviation application discovery system comprising:
The rule deviation application discovery device includes:
A pre-processing unit that reads the mapping file and generates a packet generation order that represents the order of packets generated by the discovery target application by the characteristics of the packet;
Reading the capture data and application creation rules described in accordance with guidelines for creating an application, extracting packets of the discovery target application from the capture data based on the packet generation order, and creating the application A rule deviation application detection unit for detecting a packet deviating from the rule;
It is characterized by having.

Also, a rule deviation application discovery method according to an aspect of the present invention is:
A rule deviation application discovery method in a rule deviation application discovery device for discovering an application that violates a guideline for creating an application,
A packet generation that reads a mapping file that associates a predetermined communication-related method with the characteristics of the packet generated by calling the communication-related method, and expresses the order of packets generated by the discovery target application using the packet characteristics Generating a sequence;
The packet capture data output by the application including the discovery target application and the application creation rules described in accordance with the guidelines for creating the application are read, and the discovery is performed from the capture data based on the packet generation order. Extracting a packet of a target application and finding a packet deviating from the application creation rule;
It is characterized by having.

  According to the present invention, it is possible to find an application that performs communication that deviates from the application creation rule by using both static analysis from the application source code and dynamic analysis of the operation result of the application. become.

Schematic diagram showing a rule deviation application discovery method according to an embodiment of the present invention. The figure which shows the whole structure of the system containing the rule deviation application discovery apparatus based on the Example of this invention. FIG. 1 is an overall block diagram of a rule deviation application discovery apparatus according to an embodiment of the present invention. Functional block diagram of the pre-processing unit in the rule deviation application discovery apparatus according to an embodiment of the present invention Functional block diagram of a rule deviation application discovery unit in the rule deviation application discovery device according to an embodiment of the present invention Schematic diagram showing a procedure for extracting packets for each application in the application-related packet discovery function unit in the rule deviation application discovery apparatus according to an embodiment of the present invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  In an embodiment of the present invention, an application that deviates from an application creation rule that takes into account the timing of application behavior by performing both static analysis from the source code of the application and dynamic analysis of the operation result of the application. A rule deviation application discovery device for discovering the above will be described. The rule deviation application discovery device uses a packet generation order for each application generated by static analysis, and extracts a part matching the order from packet capture data in which packets of various applications are mixed, Packets originating from a specific application can be extracted. Thereby, the deviation from the application creation rule is found for each application, and the problem for each application is extracted.

  In the following examples, an application for smartphones will be described as an example, but the examples of the present invention can be applied to other applications including methods related to communication in addition to applications for smartphones. is there.

  FIG. 1 is a schematic diagram illustrating a rule deviation application discovery method according to an embodiment of the present invention.

  First, as a preparation before finding a rule deviation application, a mapping file is created between each API (Application Program Interface) method and the corresponding packet characteristics. The mapping file may be created in the rule deviation application discovery device according to the embodiment of the present invention, or may be created in a device outside the rule deviation application discovery device (mapping file generation device).

  Specifically, in order to generate a mapping file, a dedicated application for calling each representative API method is prepared, and each representative API method is called. Representative API methods are determined in advance by extracting methods related to communication (called communication-related methods) from API documents such as Android (registered trademark) and Java (registered trademark). . For example, as shown in FIG. 1, communication-related methods such as methodA, methodB, methodX, and methodY are determined in advance. Next, in the dedicated application, a packet generated for each communication-related method is captured. Analyze the capture result and extract the characteristics of the generated packet. As features to be extracted, the length of a packet, a character string included, a destination IP address, a destination port, and the like can be considered. Then, the mapping file is generated by associating the communication related method with the extracted feature.

  Further, as preparation before finding a rule-deviation application, a rule relating to application creation (also referred to as application creation rule) is created. The application creation rule may be created in the rule deviation application discovery device according to the embodiment of the present invention, or may be created in the application creation rule generation device outside the rule departure application discovery device.

  Specifically, a description related to communication is extracted from a guideline for creating a smartphone application created in advance, and is described as an application creation rule. The application creation rule is created regarding the timing of the communication-related method of the application. For example, methodA must be called in random time, and methodY must be called within 2 seconds after methodX, as described in the application creation rule.

  Next, by performing both static analysis and dynamic analysis, a smartphone application that deviates from the application creation rules is found using the prepared mapping file and application creation rules.

  In the static analysis stage, in step S11, a smartphone application is downloaded from an application distribution site or the like, and a binary file is acquired. In step S12, a call graph representing the calling relationship of methods in the application is generated by static analysis. In step S13, the calling order of methods related to communication is extracted from the call graph. The calling order of methods related to communication is generated by extracting a method that matches a communication-related method in the mapping file from methods included in the call graph. In step S14, a packet generation in which the order of packets to be generated is expressed by the packet characteristics for each application from the extracted method calling order and the corresponding file characteristic packet generated when each method is called. Generate order. The packet generation order may be represented by a directed graph with the packet characteristics as nodes.

  In the dynamic analysis stage, in step S15, the packet output by the application is captured from the mobile network. The packet may be captured in a capture server connected to the rule deviation application discovery device according to an embodiment of the present invention. In step S16, a packet that matches the packet generation order for each application is found from the capture result, and a packet for each application is extracted from the capture result. In step S17, the method call timing is extracted from the packet generation timing for each application as the extraction result. For example, it is possible to calculate the method invocation timing from the packet generation timing for each application by referring to the mapping file of the method created in preparation before the rule deviation application discovery and the corresponding packet characteristics. is there. In step S18, an application making a call that does not match the application creation rule is extracted from the extracted method call timing and the application creation rule. In step S19, the application making a call that does not conform to the application rule creation rule and the packets generated by the call are totaled, and the totaled result is output as the result of finding the rule deviation application.

  FIG. 2 is a diagram showing an overall configuration of a system including the rule deviation application finding device 100 according to the embodiment of the present invention.

  The rule deviation application discovery apparatus 100 is an apparatus that discovers an application that deviates from an application creation rule in consideration of the behavior timing of a smartphone application. The rule deviation application discovery device 100 may be a computer including a CPU (Central Processing Unit) such as a processor, a memory device such as a RAM (Random Access Memory) and a ROM (Read Only Memory), a storage device such as a hard disk, and the like. For example, each function and process of the rule deviation application discovery device 100 described below is realized by the CPU executing data or a program stored in the storage device or the memory device.

  As described with reference to FIG. 1, the rule deviation application discovery apparatus 100 reads in advance a “mapping file of each API method and its corresponding packet characteristics” and a “rule regarding application creation”. .

  Further, as described in the static analysis stage of FIG. 1, the rule deviation application discovery apparatus 100 reads a binary file of a discovery target application in advance and creates a packet generation order for each application.

  Further, as described in the dynamic analysis stage of FIG. 1, the rule deviation application discovery apparatus 100 receives the packet capture data in the mobile network from the capture server or the like, thereby generating the source of the packet included in the capture data. For each application, the amount of traffic that violates the rule is aggregated, and the aggregated result is output.

  FIG. 3 is an overall block diagram of the rule deviation application discovery apparatus 100 according to the embodiment of the present invention.

  The rule deviation application discovery apparatus 100 includes a preprocessing unit 110 and a rule deviation application discovery unit 120.

  The pre-processing unit 110 is a functional unit that performs static analysis. The pre-processing unit 110 reads a “mapping file between each API method and the corresponding packet characteristics” and an application binary file (for example, an APK file). The packet generation order is generated and stored.

  The rule deviation application discovery unit 120 is a functional unit that performs dynamic analysis, reads capture data from a capture server or the like, reads a packet generation order for each application generated in advance, and captures a portion close to the packet generation order from the capture data The detected part is compared with the rule regarding application creation, an application that deviates from the rule is found, the traffic amount of the discovered part is totaled, and the totaled result is output.

  FIG. 4 is a detailed functional block diagram of the preprocessing unit 110.

  The preprocessing unit 110 includes a mapping file reading function unit 111, an application binary file reading function unit 112, a source code generation function unit 113, a call graph generation function unit 114, a subgraph generation function unit 115, and a packet generation order. And a generation function unit 116.

  The mapping file reading function unit 111 reads a “mapping file of each API method and corresponding packet characteristics” created in advance.

  The application binary file reading function unit 112 reads one binary file of the application and passes it to the source code generation function unit 113. For example, the binary file may have a format such as an APK file.

  The source code generation function unit 113 that has acquired the binary file converts the binary file into the source code, and passes the converted source code to the call graph generation function unit 114. For example, the source code generation function unit 113 may convert an APK file into a JAR file.

  The call graph generation function unit 114 that has acquired the source code generates a call graph from the source code, and passes the generated call graph to the partial graph generation function unit 115. The call graph is a directed graph that represents a method call relationship.

  The partial graph generation function unit 115 that has acquired the call graph extracts a partial graph of only communication-related methods from the call graph, and passes the extraction result to the packet generation order generation function unit 116. The communication-related methods extracted from the call graph are methods included in the “mapping file of each API method and the corresponding packet characteristics”.

  The packet generation order generation function unit 116 that has acquired the subgraph refers to the mapping file read by the mapping file reading function unit 111, generates a graph structure representing the packet generation order from the subgraph, and outputs it. Since the subgraph of the communication-related method only is generated by the subgraph generation function unit 115, the packet generation order generation function unit 116 can generate the packet generation order using a directed graph with the packet features as nodes.

  FIG. 5 is a detailed functional block diagram of the rule deviation application discovery unit 120.

  The rule deviation application discovery unit 120 includes a packet generation order reading function unit 121, a rule reading function unit 122, a capture data reading function unit 123, an application related packet discovery function unit 124, a rule deviation determination function unit 125, a rule And a deviation packet total output function unit 126.

  The packet generation order reading function unit 121 reads the packet generation order for each application created in the preprocessing unit 110.

  The rule reading function unit 122 reads a rule relating to application creation created in advance.

  The capture data reading function unit 123 reads capture data from the capture server and passes it to the application-related packet discovery function unit 124.

  The application-related packet discovery function unit 124 that has acquired the capture data refers to the packet generation order read by the packet generation order reading function unit 121, extracts a packet for each application from the capture data, and uses it to determine a rule deviation determination function. Pass to unit 125. A specific procedure for extracting a packet for each application will be described below with reference to FIG.

  The rule deviation determination function unit 125 that has acquired the packet for each application refers to the rules related to the application creation read by the rule reading function unit 122, finds a packet that deviates from the rule, and outputs the rule deviation packet total output It passes to the functional part 126. For example, the rule deviation determination function unit 125 calculates a method call timing from the packet generation timing, and finds a packet whose method call timing has deviated from the rule.

  The rule deviation packet totaling output function unit 126 that has acquired the rule deviation packets acquires all the rule deviation packets, and totals and outputs the amount of packets that deviate from the rules for each application.

  FIG. 6 is a schematic diagram illustrating a procedure for extracting a packet for each application in the application-related packet discovery function unit 124.

  In step S21, a partial graph of communication-related methods is extracted from the call graph. This corresponds to the partial graph extracted by the partial graph generation function unit 115.

  In step S22, a packet generation order graph is generated from the extracted subgraph. This corresponds to the directed graph of the packet generation order generated by the packet generation order generation function unit 116. Each node in this graph has a size, protocol, destination IP address, destination port, etc. indicating the characteristics of the packet.

  In step S23, the application-related packet discovery function unit 124 uses the packet generation order graph as a template, and finds a portion close to the distance from the captured data by template matching.

  In this way, according to the embodiment of the present invention, communication that deviates from the application creation rule can be performed using both static analysis from the source code of the application and dynamic analysis of the operation result of the application. It will be possible to discover the application you are doing.

  As a result, mobile network operators, etc. discover applications that perform communications that deviate from the rules in the networks that they provide, and encourage application creators to correct the network by applications that deviate from the rules. Congestion can be suppressed.

  For convenience of explanation, the rule deviation application discovery device according to the embodiment of the present invention is described using a functional block diagram. However, the rule departure application discovery device according to the embodiment of the present invention may be hardware, software, or A combination thereof may be realized. For example, the embodiment of the present invention executes a program for realizing each function of the rule deviation application discovery apparatus according to the embodiment of the present invention on a computer, and executes each procedure of the method according to the embodiment of the present invention on the computer It may be realized by a program to be executed. In addition, the functional units may be used in combination as necessary. In addition, the method according to the embodiment of the present invention may be performed in an order different from the order shown in the embodiment.

  As described above, the method for discovering applications that are communicating outside the application creation rules using both static analysis from the application source code and dynamic analysis of the application operation results has been described. The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

100 Rule Deviation Application Discovery Device 110 Pre-Processing Unit 111 Mapping File Reading Function Unit 112 Application Binary File Reading Function Unit 113 Source Code Generation Function Unit 114 Call Graph Generation Function Unit 115 Partial Graph Generation Function Unit 116 Packet Generation Order Generation Function Unit 120 Rules Deviation Application Discovery Unit 121 Packet Generation Order Reading Function Unit 122 Rule Reading Function Unit 123 Capture Data Reading Function Unit 124 Application Related Packet Discovery Function Unit 125 Rule Deviation Determination Function Unit 126 Rule Deviation Packet Total Output Function Unit

Claims (6)

A rule-deviation application discovery device that discovers applications that violate guidelines for creating applications,
A packet generation that reads a mapping file that associates a predetermined communication-related method with the characteristics of the packet generated by calling the communication-related method, and expresses the order of packets generated by the discovery target application using the packet characteristics A pre-processing unit for generating an order;
The packet capture data output by the application including the discovery target application and the application creation rules described in accordance with the guidelines for creating the application are read, and the discovery is performed from the capture data based on the packet generation order. A rule deviation application discovery unit for extracting a packet of a target application and finding a packet deviating from the application creation rule;
A rule deviation application discovery device having: The preprocessing unit includes:
A mapping file reading function unit for reading the mapping file;
An application binary file reading function unit that reads a binary file of the application to be discovered;
A source code generation function unit for generating source code from the binary file;
A call graph generation function for generating a call graph from the source code;
A partial graph generation function unit that generates a partial graph consisting only of methods included in the predetermined communication-related method from the call graph;
A packet generation order generation function unit that generates a packet generation order of the application to be discovered from the subgraph based on the mapping file;
The rule deviation application discovery device according to claim 1, comprising: The rule deviation application discovery unit
A capture data reading function unit for reading the capture data;
An application-related packet discovery function unit that extracts a packet of the discovery target application from the capture data based on the packet generation order;
A rule reading function unit for reading the application creation rule;
A rule deviation determination function unit for finding a packet deviating from the application creation rule among the packets extracted from the capture data;
A rule deviation packet aggregation output function unit for aggregating packets deviating from the application creation rules;
The rule deviation application discovery device according to claim 1, comprising:   The rule deviation determination function unit calculates a method call timing from the generation timing of the packet extracted from the capture data, and determines whether the call timing deviates from the application creation rule, The rule deviation application discovery device according to claim 3, wherein a packet deviating from an application creation rule is found. A rule deviation application discovery device for finding an application that violates the guidelines for creating an application;
A mapping file generating device that captures a packet generated by calling a predetermined communication-related method, and generates a mapping file that associates the communication-related method with the characteristics of the captured packet;
A capture server that generates capture data for packets output by the application;
A rule deviation application discovery system comprising:
The rule deviation application discovery device includes:
A pre-processing unit that reads the mapping file and generates a packet generation order that represents the order of packets generated by the discovery target application by the characteristics of the packet;
Reading the capture data and application creation rules described in accordance with guidelines for creating an application, extracting packets of the discovery target application from the capture data based on the packet generation order, and creating the application A rule deviation application detection unit for detecting a packet deviating from the rule;
A rule deviation application discovery system comprising: A rule deviation application discovery method in a rule deviation application discovery device for discovering an application that violates a guideline for creating an application,
A packet generation that reads a mapping file that associates a predetermined communication-related method with the characteristics of the packet generated by calling the communication-related method, and expresses the order of packets generated by the discovery target application using the packet characteristics Generating a sequence;
The packet capture data output by the application including the discovery target application and the application creation rules described in accordance with the guidelines for creating the application are read, and the discovery is performed from the capture data based on the packet generation order. Extracting a packet of a target application and finding a packet deviating from the application creation rule;
A rule deviation application discovery method comprising:

Images