KR20170086926A - Apparatus for security vulnerabilities evaluation of application and control method of the same - Google Patents

Abstract

The present invention provides an apparatus for evaluating security vulnerability of an application that provides objective data on security vulnerability by providing a quantitative value of an application and an evaluation method thereof. A security vulnerability evaluation method of an application of the present invention includes: determining at least one application programming interface (API) used in an application to be evaluated; Determining the degree of access to the exclusive information for the API based on the determined property information of the API; And evaluating the security vulnerability of the application based on the determined degree of access to the exclusive information of the API.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a security vulnerability assessment apparatus,

The present invention is a security vulnerability assessment apparatus and evaluation method for an application that provides objective data on security vulnerability by providing quantitative values of an application based on an analysis of APPLICATION PROGRAMING INTERFACE used in an application.

The vulnerability evaluation technique of the application program related to the present invention evaluates the vulnerability using an application's permission or data leakage. They also did not provide quantitative vulnerability figures. The results evaluated in this way contain the subjective intent of the evaluation technique developer and therefore do not provide objective numerical values and have difficulty in providing quantitative figures.

In addition, the method using the above-mentioned permission evaluates the vulnerability through the permission of the application, which has the possibility of evaluation error such as revealing the vulnerability despite the use of the permission for the normal operation.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an AP application programming interface (API) which can always analyze clearly and thus provides quantitative values of an application based on an analysis thereof, And an evaluation method thereof.

According to another aspect of the present invention, there is provided a method for evaluating security vulnerabilities of an application, comprising: determining at least one application programming interface (API) used in an application to be evaluated; Determining the degree of access to the exclusive information for the API based on the determined property information of the API; And evaluating the security vulnerability of the application based on the determined degree of access to the exclusive information of the API.

Here, the method may further include acquiring characteristic information corresponding to the at least one API used from the network.

The step of determining the degree of access to the exclusive information may include calculating a degree of access to the exclusive information by using a probability of a word included in the name of the at least one API among the property information of the API .

The step of evaluating the security vulnerability of the application may include calculating a degree of vulnerability of evaluating the security vulnerability of the application by using a probability of the name of the API whose degree of access to the exclusive information among the characteristic information of the API is determined Step < / RTI >

And providing the result information on the vulnerability evaluation of the application based on at least one of the API for which the degree of access to the exclusive information is determined and the API for which the security vulnerability of the application is evaluated.

Here, the method may further include calculating a degree of access to the exclusive information for at least one API used in at least one of malicious application and normal application, and degree of vulnerability evaluating security vulnerability of the application can do.

The step of determining the degree of access to the exclusive information may include determining whether the degree of access to the exclusive information for at least one API used in the evaluation target application satisfies the calculated malicious behavior, And the degree of access to the exclusive information with respect to at least one API to be used among the plurality of APIs.

The step of evaluating the security vulnerability of the application may include evaluating the security vulnerability of the application to be evaluated based on the calculated malicious behavior and the vulnerability evaluating security vulnerability Value of the input signal.

The property information of the API may include at least one of a package, a class, a name, a parameter type, a return value, and a description of the API.

Here, the API for which the degree of access to the exclusive information is determined may include an API that may infringe at least one of information and rights of at least one of an individual and a group.

According to another aspect of the present invention, there is provided an apparatus for evaluating vulnerability of an application, comprising: a communication unit capable of receiving data on an application; Determining at least one APPLICATION PROGRAMING INTERFACE used for the application to be evaluated, determining an access degree to the exclusive information for the API based on the determined property information of the API, And evaluating a security vulnerability of the application based on the degree of access of the application.

Here, the control unit may control the communication unit to acquire characteristic information corresponding to the at least one API used from the network.

The control unit may calculate a degree of access to the exclusive information by using a probability of a word included in the name of the at least one API among the property information of the API.

Here, the control unit may calculate the degree of vulnerability that evaluates the security vulnerability of the application using the probability of the name of the API for which the degree of access to the exclusive information among the characteristic information of the API is determined.

And a display unit for displaying result information on the vulnerability evaluation of the application, wherein the control unit is configured to display the result of the vulnerability evaluation based on at least one of the API for which the degree of access to the exclusive information is determined and the API for which the security vulnerability of the application is evaluated, The display unit can be controlled to provide the result information on the vulnerability evaluation of the application.

Here, the control unit may calculate a degree of access to the exclusive information of at least one API used in at least one of an application that performs a malicious action and an application that performs a normal action, and a degree of vulnerability that evaluates a security vulnerability of the application have.

The control unit may further include a storage unit that stores the degree of access to the exclusive information and the degree of vulnerability, and the control unit calculates the degree of access to the exclusive information for at least one API used in the application to be evaluated A degree of access to the exclusive information for at least one API used in an application for malicious activity stored in the storage unit and an application for performing a normal operation.

The control unit may further include a storage unit that stores the degree of access to the calculated exclusive information and the degree of vulnerability, and the control unit calculates a degree of vulnerability of the vulnerability of the application to be evaluated, It is possible to determine which of the malicious application and the malicious application is vulnerable to the security vulnerability.

The property information of the API may include at least one of a package, a class, a name, a parameter type, a return value, and a description of the API.

Here, the API for which the degree of access to the exclusive information is determined may include an API that may infringe at least one of information and rights of at least one of an individual and a group.

According to the present invention, APPLICATION PROGRAMING INTERFACE (APPLICATION PROGRAMING INTERFACE) used in an application can always be analyzed clearly. Therefore, it is possible to provide objective data on the security vulnerability of an application by providing a quantitative value of the application based on the analysis .

1 is a block diagram showing the configuration of an evaluation device according to the present invention,
2 is a block diagram showing a configuration of an evaluation device according to an embodiment of the present invention,
3 is a control flowchart showing a security vulnerability evaluation method of an application of an evaluation device according to the present invention,
4 is a control flowchart showing a security vulnerability evaluation method of an application of an evaluation device according to an embodiment of the present invention,
5 is a schematic diagram showing an evaluation device according to an embodiment of the present invention,
FIG. 6 is a schematic structure diagram specifically showing an evaluation device according to another embodiment of the present invention,
7 is a control flowchart showing an overall flow of an evaluation method of an evaluation device according to another embodiment of the present invention,
8 and 9 are exemplary tables showing the conditional probabilities for the API using the Naive Bayes Classification formula in the evaluation device according to another embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing a configuration of an evaluation device 10 according to the present invention. The evaluation device 10 according to the present invention may include a communication unit 110 and a control unit 100. [

The communication unit 110 may receive a signal from an external input and transmit the signal to the control unit 100. The communication unit 110 can receive a signal from the external input through a wired connection by connecting various external input cables or can receive a wirelessly received signal according to a predetermined wireless communication standard.

The communication unit 110 may include a plurality of connectors (not shown) to which the respective cables are individually connected. The communication unit 110 receives a signal from an external input, for example, a HDMI, a USB, a component standard, a video signal, a data signal, or the like, or receives communication data through a communication network .

The communication unit 110 may include a wireless communication module (not shown) for wireless communication and a tuner (not shown) for tuning a broadcast signal, according to a design method of the evaluation device 10 (Not shown), and the like. In addition to receiving a signal from an external device, the communication unit 110 may also transmit the information / data / signal of the evaluation device 10 to an external device. That is, the communication unit 110 can not be limited to a configuration for receiving a signal to an external device, and can be implemented as an interface capable of bidirectional communication. The communication unit 110 can receive a control signal for selecting a UI from a plurality of control devices. The communication unit 110 may be a communication module for publicly known short range wireless communication such as Bluetooth, IR, UWB (Ultra Wideband), ZigBee, etc. and may be a known communication port for wired communication . The communication unit 110 may be used for various purposes such as a command for operating a display, transmission / reception of data, etc., in addition to a control signal for selecting a UI. The communication unit 110 can receive data for the application.

The control unit 100 determines at least one application programming interface (API) used in the application to be evaluated. The control unit 100 determines the degree of access to the exclusive information on the API based on the determined property information of the API, The security vulnerability of an application can be evaluated based on the degree of access to information.

2 is a block diagram showing a configuration of an evaluation device 10 according to an embodiment of the present invention. 1 and may further include an image processing unit 120, a display unit 130, a user input unit 140, a storage unit 150, An image pickup unit 160, and a UI generation unit 170. [

The type of the image processing process performed by the image processing unit 120 is not limited. For example, the image processing unit 120 may perform de-multiplexing for distributing a predetermined signal to each characteristic signal, decoding corresponding to the image format of the image signal, De-interlacing for converting an interlaced video signal into a progressive mode, noise reduction for improving image quality, detail enhancement, frame refresh rate (frame refresh rate) (not shown) for decoding a source image corresponding to an image format of an encoded source image, and a frame buffer (not shown) for storing a decoded source image on a frame basis can do.

The image processor 120 may be a system-on-a-chip (SOC) that integrates various functions, or an individual configuration capable of independently performing each of the processes, And can be embodied in the evaluation device 10.

The image processing unit 120 performs predetermined image processing processes on a source image including a broadcast signal including a video signal received from the communication unit 110 and a video signal supplied from a video source (not shown). The image processor 120 outputs the processed image signal to the display unit 130 so that the processed source image can be displayed on the display unit 130.

The display unit 130 can display an image based on the image signal output from the image processing unit 120. [ The display unit 130 may be implemented in various forms including, but not limited to, a liquid crystal, a plasma, a light-emitting diode, an organic light-emitting diode, electron conduction electron-emitter, carbon nano-tube, nano-crystal, and the like.

The display unit 130 may further include an additional configuration depending on the implementation method. For example, when the display unit 130 is a liquid crystal type, the display unit 130 may include a display liquid crystal display panel (not shown), a backlight unit (not shown) for supplying light thereto, and a panel drive substrate Not shown).

The display unit 130 displays an image based on the image signal processed by the image processing unit 120. There is no limitation on the manner in which the display unit 130 displays an image, but includes a method of an LCD, a PDP, and an OLED. In this case, the display unit 130 may include an LCD panel, a PDP panel, an OLED panel, and the like.

The display unit 130 may display an image and a color correction process. The display unit 130 may include a display panel for displaying an image and a panel driver for displaying an image on the display panel by processing an input image signal. An image signal received from an external input source through an interface may be displayed on the display unit 130 through an image processing process such as decoding, deinterlacing, and scaling. When a control unit, which will be described later, performs color correction according to a user's command, the display unit 130 may display a color correction process including a color patch and a color correction status window. The display unit 130 may display the result information on the vulnerability evaluation of the application.

The user input unit 140 may transmit various preset control commands or information to the control unit 100 according to a user's operation and input. The user input unit 140 may be realized by a menu-key or an input panel installed outside the evaluation device 10 or a remote controller separated from the evaluation device 10 . Alternatively, the user input unit 140 may be integrated with the display unit 130, and when the display unit 130 is a touch screen, the user may select the input menu 130 displayed on the display unit 130 (Not shown) to the control unit 100 by touching the predetermined command.

The user input unit 140 may receive the user's motion and voice. The user's motion may include a touch input. The user input unit 140 may directly receive the user's motion and voice, or may receive information about the user's motion and voice from an external device.

Preferably, the storage unit 150 is provided with a writable nonvolatile memory (Writable ROM) so that data may remain in the evaluation device 10 even when the power is turned off, and may reflect changes of the user. That is, the storage unit 150 may be a flash memory, an EPROM, or an EEPROM. The storage unit 150 may store the degree of access to the calculated exclusive information and the degree of vulnerability.

The image pickup unit 160 may be provided by a camera and may take an image of the outside and store it in the storage unit 150 under the control of the control unit 100. [

The UI generation unit 170 may generate a UI for operating an application program to be executed. The generated UI includes a plurality of sub-UIs provided in the form of an icon, text, and the like. When a user selects a specific sub-UI through the evaluation device 10, the application program can be operated corresponding to the selected sub-UI. That is, each of the sub-UIs can be generated in units of a plurality of functions or events capable of operating an application program being executed in the evaluation device 10. [

The UI generating unit 170 means a software function or a hardware function for generating and controlling the UI displayed on the display unit 130, and the function of the UI generating unit 170 can be performed by the control unit 100. [ In other words, the UI generating unit 170 may be implemented by a separate chipset or by a separate microprocessor.

The property information of the API may include at least one of a package, a class, a name, a parameter type, a return value, and a description of the API.

An API for which the degree of access to exclusive information is determined may include an API that may infringe at least one of the information and rights of at least one of an individual and a group.

The control unit 100 may control the communication unit 110 to acquire characteristic information corresponding to at least one API used for the application from the network. The control unit 100 may randomly search the network to acquire characteristic information corresponding to at least one API used in the application and continuously update the information.

The control unit 100 may calculate the degree of access to the exclusive information by using the probability of a word included in the name of at least one API used in the characteristic information of the API.

The control unit 100 can calculate the degree of vulnerability that evaluates the security vulnerability of the application by using the probability of the name of the API for which the degree of access to the exclusive information is determined among the characteristics information of the API.

The control unit 100 can control the display unit 130 to provide the result information on the vulnerability evaluation of the application based on at least one of the API for which the degree of access to the exclusive information is determined and the API for which the security vulnerability of the application is evaluated .

The control unit 100 may calculate the degree of access to the exclusive information for at least one API used in at least one of the malicious application and the malicious application and the degree of vulnerability evaluating the security vulnerability of the application .

The control unit 100 determines whether the access to the exclusive information for at least one API used in the application to be evaluated is calculated and stored in the application for performing the malicious action stored in the storage unit 150 and at least one The degree of access to the exclusive information on the API can be determined.

The control unit 100 calculates the degree of vulnerability evaluating the security vulnerability of the application to be evaluated and calculates the degree of vulnerability assessing the vulnerability among the applications that perform the malicious action and the applications that perform normal actions stored in the storage unit 150 It is possible to judge whether it is close.

3 is a control flowchart showing a security vulnerability evaluation method of an application of the evaluation device 10 according to the present invention.

(APPLICATION PROGRAMING INTERFACE) to be used in the evaluation target application (S11).

The degree of access to the exclusive information on the API is determined based on the determined property information of the API (S12).

The security vulnerability of the application is evaluated based on the degree of access to the determined exclusive information of the API (S13).

4 is a control flowchart showing a security vulnerability evaluation method of an application of the evaluation device 10 according to an embodiment of the present invention.

And acquires characteristic information corresponding to at least one API used from the network (S21). It is possible to continuously collect, store, and update APIs that are open to multiple accessible addresses. Unpublished APIs may be received.

The degree of access to the exclusive information for at least one API used in at least one of the malicious application and the malicious application and the degree of vulnerability evaluating the vulnerability of the application are calculated (S22). Evaluating the degree of access to the exclusive information and the security vulnerability of the application using the probability of the word contained in the name and the name of at least one API used in at least one of malicious application and normal application The degree of vulnerability is calculated.

Upon receiving the application to be evaluated, at least one application programming interface (API) used for the application to be evaluated is determined (S23).

The degree of access to the exclusive information is calculated using the probability of a word included in the name of at least one API used in the characteristic information of the API (S24).

A degree of access to exclusive information for at least one API used in an application to be evaluated and a degree of access to exclusive information for at least one API used for an application that performs malicious action and an application that performs a normal action (S25).

The degree of vulnerability evaluating the security vulnerability of the application is calculated using the probability of the name of the API for which the degree of access to the exclusive information is determined in the characteristic information of the API (S26).

(S27) whether the degree of the vulnerability evaluating the security vulnerability of the application to be evaluated is close to the calculated value of the calculated malicious behavior and the vulnerability evaluating the security vulnerability among the applications performing the normal operation.

And provides the result information on the vulnerability assessment of the application based on at least one of the API for which the degree of access to the exclusive information is determined and the API for which the vulnerability of the application is evaluated (S28).

5 is a schematic diagram showing an evaluation device 10 according to an embodiment of the present invention.

The evaluating device 10 of FIG. 5 may verify and evaluate a mobile application that desires verification of a security vulnerability and provide the application vulnerability evaluation value using the generated data. 5 may include an API learning device 200, an API verifier 210, a database 230, and a real-time API information collector 220.

The database 230 includes an API database based on API property information provided by the framework, a Sensitive API database storing whether or not the API can access exclusive information, an API Dataset Database . The database 230 may correspond to the storage unit 150 of FIG.

The real-time API information collector 220 can obtain API property information from a referable web page such as a mobile platform. Using the obtained API property information, a data structure can be created and an API database can be constructed. The real-time API information collector 220 may correspond to the communication unit 110 and the control unit 100 of FIG.

The API learning machine 200 can extract the API based on the application to be learned and learn it by using the API characteristic information and Dataset in the method of evaluating the security vulnerability of the application. After learning, Sensitive API and API Dataset database can be created. The API learning machine 200 may correspond to the control unit 100. [

The API verifier 210 receives the application to be verified and can verify the received application using the Sensitive API database and the API Dataset database. The API verifier 210 may correspond to the control unit 100. [

FIG. 6 is a schematic structural diagram specifically showing an evaluation device 10 according to another embodiment of the present invention.

Fig. 6 shows the configuration of Fig. 5 in detail.

The database 230 may include an API database 232, a Sensitive API database 234, and an API Dataset 236.

The API database 232 can collect the information about the API provided by the framework by the control of the control unit 100 and configure the database. The API database 232 may have API property information such as a package name, a class name, an API method name, a parameter, a return value, and a description of the corresponding API to which each API belongs.

Sensitive API database 234 is a database of APIs accessible from the API property classification module 204 for accessing exclusive information learned through a machine learning algorithm (a method for evaluating security vulnerability of an application). Store the post-learning data, and store information about whether or not each of the APIs provided on the framework can access the exclusive information.

The API Dataset 236 may be a database storing post-learning data of the Sensitive API from the API Dataset classification module 206.

The real-time API information collector 220 may include a web parsing module 222, a data structure generation module 224, and a data management module 226.

The web parsing module 222 can obtain the data of the API characteristic information from the reference site in real time. The reference site may be composed of API property information, and the web parsing module 222 may obtain only the necessary API property information by parsing web data that may be composed of tags such as HTML and XML.

The data structure generation module 224 can generate a data structure using API property information generated by the web parsing module 222. [

The data management module 226 may generate the API database 232 using the data structure generated by the data structure generation module 224. [

The API learning machine 200 may include an application input module 202, an API property classification module 204, an API Dataset classification module 206, and a data management module 208.

The application input module 202 receives an application selected for learning. An application selected for learning is an application that performs malicious acts and an application that performs normal tasks normally. The application input module 202 may receive the two applications (malicious action, general action application) and extract APIs used by each application. A data structure for post-extraction learning can be generated.

The API property classifying module 204 can learn whether APIs that can access the exclusive information based on the data structure generated by the application input module 202 using a machine learning algorithm. It is possible to utilize the information of the API database 232 at the time of learning using the machine learning algorithm, and the API characteristics such as the package, class, API name, and description of the API database 232 can be used.

The API Dataset classification module 206 learns a dataset through a machine learning algorithm using the data structure generated by the application input module 202 and the Sensitive API database 234. [ In Dataset classification, it is possible to use the API which is accessible to the exclusive information used by the selected application as the learning source, and generate the post-learning data.

The data management module 208 can manage a database, such as creating a database and inquiring database contents. The database can be generated based on the data learned from the API property classifying module 204 and the API Dataset classifying module 206. [ You can query specific databases at the request of other modules. And can serve as an intermediary between the API verifier 210 and the API learning machine 200.

The API verifier 210 may include an application input module 211, an API property verification module 213, an API Dataset verification module 214, a data management module 215, and a result output module 212.

The application input module 211 receives an application to be verified and extracts an API used to generate a data structure.

The API property verification module 213 inquires the data in the sensitive API database 234 in which the learned data is stored through the API property classification module 204 to obtain an API that can access the exclusive information used by the application to be verified Verify. After completing the verification, it is possible to generate the result data such as whether the API is accessible to the exclusive information and characteristic information (package name, class name, method name, description) of the API.

The API Dataset validation module 214 can verify the Dataset used by the application to be verified by querying the data in the API Dataset database 236 in which the learned data is stored through the API Dataset classification module 206. [ Here, Dataset can be a group of APIs capable of malicious behavior. After the verification is completed, the result data can be generated as a Dataset that can access the exclusive information.

The data management module 215 is an overall module for communicating with the database on the API verifier 210. The API property verification module 213, the API Dataset verification module 214, and the result output module 212 can inquire data of the database. And can play an intermediate role between the API learning device 200 and the API verifier 210.

The result output module 212 may output the results of the quantitative vulnerability measurement based on the result data generated by the API property verification module 213 and the API Dataset verification module 214. [ It is also possible to display the description information and the Dataset of the API which are verified to be accessible to the exclusive information of the verification target application. The result output module 212 may correspond to the display unit 130 of FIG.

FIG. 7 is a control flowchart showing the overall procedure flow for the evaluation method of the evaluation device 10 according to another embodiment of the present invention.

Data of the API characteristic information is acquired in real time from the reference site (S31).

HTML, XML, or the like, and acquires only necessary API property information (S32).

The data structure is generated using the API characteristic information generated by the web parsing module 222 (S33).

The API database 232 is created using the data structure generated by the data structure generation module 224 (S34).

The application to be learned is received (S35). Applications selected for learning are applications that perform malicious acts and applications that perform common tasks.

And extracts the name and characteristic information of the API used on the application to be learned (S36).

The learning data corresponding to the API extracted from the application to be learned is generated using the API information stored in the API database 232, the learning is performed through the machine learning algorithm, and the characteristics of the API are classified (S37).

And generates a Sensitive API database 234 generated through learning (S38).

The post-learning API Dataset 236 is generated through the machine learning algorithm using the data in the sensitive API database 234 and the API extracted on the learning target application (S39).

The database of the API Dataset 236 is configured with the learned data (S40).

The verification target application is received (S41).

AP information used by the verification target application is extracted (S42).

The API that can access the exclusive information used by the verification target application is verified (S43).

The Dataset of the malicious action used by the verification target application is verified (S44).

Based on API property-based verification and API Dataset-based verification, it provides API property information of API which can access exclusive information used based on result data generated, and API Dataset (236) which can access exclusive information, and provides the result of quantitative vulnerability measurement (S45).

8 and 9 are exemplary tables showing conditional probabilities for the API using the Naive Bayes Classification formula in the evaluation device 10 according to another embodiment of the present invention.

Naive Bayes Classification is a technique that determines the class based on the Naive Bayes theorem with the probability of each property as a parameter. In the Naive Bay classification, it is assumed that all attribute values are independent from each other, and the estimation of the parameters uses Maximum Likelihood Estimation.

Table 1 shows the formula for the Naive Bayes classification (1), which is a formula for the probability of a certain class (c) when there are n properties (x) by Naive Bayes theorem. (2) shows what each of the formulas in (1) means. Posterior, Evidence, Likelihood, and Prior (Prior). (3) is the formula for selecting the results of the class, and since the Naive Bay classification uses the maximum likelihood method, the class that maximizes the Likelihood value is selected as the result.

FIG. 8 shows the conditional probability when the API property classifying module 204 of the API learning machine 200 uses each class to use the machine learning algorithm (a class that can access the exclusive information or a general class). Here, the value of the attribute (x) for obtaining the conditional probability can use the API property information (the name of the package, the class, the API to which the API belongs, the type of parameter, return value, API description, etc.). Then, APIs in the API database can be classified using the conditional probability. The Sensitive API database 234 is created by using the API classified as a class.

For example, the conditional probability can be obtained as follows.

Example) Learning getLine1Number API in API database

1) Loading the API property information: getLine1Number Loads the property information of the API from the API database to determine the API class.

API name getLine1Number Packages that the API belongs to android.Telephony The class to which the API belongs TelephonyManager Descriptions of the API Returns the phone number string for line 1 ... ...

2) Preprocessing: The characteristics information is as above, and excludes the part (the, for, 1) such as article or preposition number which is not necessary to judge in case of description. If the API name and package name are composed of multiple words, separate them by each word. Remove the unnecessary parts as described after the detachment. (getLine1Number => get + line + number)

3) Vector configuration: Parses the characteristic information and constructs the vector so that there are no duplicated items.

{x1, x2, x3, ... , x9} = {get, line, number, android, telephony, manager, returns, phone, string}

4) Verification: Use the machine learning algorithm (using the Naive Bay classification in this case) for the vector in question.

(1) The probability that the API belongs to an API that can access exclusive information (assuming P (Sensitive API) = 0.5)

(2) probability that the corresponding API belongs to the general API (assuming P (Normal API) = 0.5)

(1), the probability of the getLine1Number API being a sensitive API is 0.000395136, which is greater than the probability of a normal API being 0.00000504, so it is judged as a Sensitive API by the maximum likelihood method.

 5) Sensitive API database 234 using the entered class information.

 6) Sensitive API verification: Judged using the contents in the Sensitive API database 234, whether the input API is an API that can access exclusive information.

9 shows the conditional probabilities when the API Dataset classifying module 206 of the API learning machine 200 uses each class to use the machine learning algorithm (Dataset class or general Dataset class accessible to exclusive information). At this time, the attribute (x) value for obtaining the conditional probability is configured as the Sensitive API database 234 obtained through the API property classification process. Thereafter, the API Dataset database 236 is configured using the conditional probability.

The API Dataset verification module 214 of the API verifier 210 uses the API Dataset database 236 to determine whether or not the API Dataset verification module 214 includes a Dataset that is accessible to the application or exclusive information input by the machine learning algorithm.

For example, the conditional probability can be obtained as follows.

Example) {getLine1Number, sendTextMessage, getDeviceID, moveToNext} Dataset judgment

1) Extraction of an API that can access exclusive information in the application: Extracts only the APIs that are accessible to the exclusive information in the sensitive API database 234 among the APIs used in the application.

2) Vector composition: Then construct a vector so that there are no duplicated items.

{x1, x2 ....} = {getLine1Number, sendTextMessage, getDeviceID, movetoNext}

3) Verification: Use the machine learning algorithm (using the Naive Bay classification in this case) for that vector.

(1) The probability that the corresponding dataset belongs to a sensitive dataset (assuming P (Sensitive Dataset) = 0.5)

(2) The probability that the corresponding API belongs to the normal API (assuming P (Normal API) = 0.5)

{GetLine1Number, sendTextMessage, getDeviceID, moveToNext} in the assumption of (1) is larger than the probability of Sensitive Dataset being 0.0576 and probability of Normal Dataset being 0.0036, and it is determined as Sensitive Dataset by the maximum likelihood method.

The following is a quantitative numerical result.

And provides a quantitative numerical result based on the previously verified value in the result output module 212 of the API verifier 210. Sensitive APIs and Sensitive APIs Use posterior values through class judgment of Dataset. For example, {getLine1Number, sendTextMessage, getDeviceID, ... , moveToNext} Dataset, it is assumed that the following posterior probability is given.

Sensitive API

getLine1Number

sendTextMessage

getDeviceID

... moveToNext

라고 할 수 있다. Also, {getLine1Number, sendTextMessage, getDeviceID, ... , moveToNext} Dataset's posterior probability

.

At this time, it is possible to provide the quantitative value Evaluation by a specific operation using the Sensitive API posterior probability possessed by the evaluation target application and the posterior probability of the Sensitive Dataset as a parameter.

An application can be said to consist of a user-created method and a flow of an API. The characteristics and functions of a specific application can be defined according to the method that the user has created and how to use the API. The actual function is the API and the user-created method finally calls the API and shows the functional characteristics.

Due to the above evaluation device 10, the API used in the malicious application can be analyzed using the characteristic information extracted in real time of the API provided on the framework, and the vulnerability of the application can be quantitatively evaluated through the machine learning algorithm . The application can be verified and the resulting quantitative figures can be used to validate the application being analyzed currently, and to obtain information on what parts are vulnerable and what malicious actions can be taken. In addition, since the API feature information of the latest trend can be used because the feature information extracted in real time is used, it can be applied effectively even in the latest version of mobile platform.

While the embodiments of the present invention have been shown and described, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, without departing from the scope or spirit of this invention. Accordingly, the scope of the present invention should not be construed as being limited to the embodiments described so far, but rather by the appended claims and their equivalents.

10: Evaluation device 100:
110: communication unit 120: image processing unit
130: display unit 140: user input unit
150: storage unit 160:
170: UI generation unit 200: API learning device
210: API verifier 220: Real-time API information collector
230: Database

Claims (20)

In an application security vulnerability assessment method,
Determining at least one APPLICATION PROGRAMING INTERFACE to be used in the application being evaluated;
Determining the degree of access to the exclusive information for the API based on the determined property information of the API;
And evaluating the security vulnerability of the application based on the determined degree of access to the exclusive information of the API. The method according to claim 1,
Further comprising obtaining characteristic information corresponding to the at least one API used from the network. The method according to claim 1,
Wherein determining the degree of access to the exclusive information comprises:
And calculating a degree of access to the exclusive information by using a probability of a word included in a name of at least one API among the property information of the API. The method according to claim 1,
Wherein evaluating the security vulnerability of the application comprises:
Calculating a degree of vulnerability of the application by evaluating a security vulnerability of the application using a probability of a name of an API for which an access degree to the exclusive information is determined among characteristics information of the API. The method according to claim 1,
And providing result information on the vulnerability evaluation of the application based on at least one of an API for which the degree of access to the exclusive information is determined and an API for which the vulnerability of the application is evaluated. The method according to claim 1,
Calculating an extent of access to said exclusive information for at least one API used in at least one of malicious and normal applications and the degree of vulnerability evaluating security vulnerabilities of said application, Security vulnerability assessment method. The method according to claim 6,
Wherein determining the degree of access to the exclusive information comprises:
Wherein the degree of access to the exclusive information for at least one API used in the application to be evaluated is less than the accessibility to the exclusive information for at least one API used in the application Of the security vulnerability of the application. The method according to claim 6,
Wherein evaluating the security vulnerability of the application comprises:
Determining whether the degree of vulnerability evaluating the security vulnerability of the application to be evaluated is close to a value of the calculated malicious behavior and the degree of vulnerability evaluating security vulnerability among the applications performing normal operation; Vulnerability assessment method. The method according to claim 1,
Wherein the characteristic information of the API includes at least one of a package, a class, a name, a parameter type, a return value, and a description of the API. The method according to claim 1,
Wherein the API whose degree of access to the exclusive information is determined includes an API that may infringe at least one of information and rights of at least one of an individual and a group. An application security vulnerability assessment device comprising:
A communication unit capable of receiving data for an application;
Determining at least one APPLICATION PROGRAMING INTERFACE used for the application to be evaluated, determining an access degree to the exclusive information for the API based on the determined property information of the API, And a control unit for evaluating a security vulnerability of the application based on the access degree of the application. 12. The method of claim 11,
Wherein the control unit controls the communication unit to acquire characteristic information corresponding to the at least one API used from the network. 12. The method of claim 11,
Wherein the control unit calculates a degree of access to the exclusive information by using a probability of a word included in the name of the at least one API among the property information of the API. 12. The method of claim 11,
Wherein the control unit calculates a degree of vulnerability in which a security vulnerability of the application is evaluated by using a probability of a name of an API whose degree of access to the exclusive information is determined among characteristics information of the API. 12. The method of claim 11,
Further comprising a display unit for displaying result information on the vulnerability evaluation of the application,
Wherein the control unit controls the display unit to provide the result information on the vulnerability evaluation of the application based on at least one of the API for which the degree of access to the exclusive information is determined and the API for which the vulnerability of the application is evaluated, Evaluation device. 12. The method of claim 11,
Wherein the control unit controls the security of the application that calculates the degree of access to the exclusive information for at least one API used in at least one of the malicious application and the malicious application and the degree of vulnerability evaluating the security vulnerability of the application Vulnerability Assessment Instrument. 17. The method of claim 16,
And a storage unit for storing the degree of access to the calculated exclusive information and the degree of vulnerability,
Wherein the control unit calculates at least one API used for the at least one API used in the application to be evaluated and calculates at least one API used for an application for performing a malicious action stored in the storage unit and an application for performing a normal operation The degree of access to the exclusive information of the application. 17. The method of claim 16,
And a storage unit for storing the degree of access to the calculated exclusive information and the degree of vulnerability,
Wherein the control unit calculates a degree of vulnerability evaluating a security vulnerability of the application to be evaluated and calculates a degree of vulnerability of the application that performs the malicious action calculated in the storage unit and evaluates the security vulnerability The security vulnerability assessment apparatus of the present invention determines the security vulnerability of the application. 12. The method of claim 11,
The characteristic information of the API includes at least one of a package, a class, a name, a parameter type, a return value, and a description of the API. 12. The method of claim 11,
Wherein the API whose degree of access to the exclusive information is determined includes an API that may infringe at least one of information and rights of at least one of an individual and a group.

Images