TW201807611A - Sampling and judging method for unknown state by APP detection comparing the double-wire test result with each other through an intelligent mobile device - Google Patents

Abstract

This invention relates to a sampling and judging method for an unknown state by APP detection. The sampling and judging method is a method comprising the steps: when a mobile application APP program is used for a safe detection, carrying out a double-wire test on an unknown detection result, comparing the double-wire test result with each other, and deducting a correct convergence result by mutual comparison.

Description

APP detection unknown pattern acquisition and judgment method

The invention relates to a smart mobile device, and a convergence method for judging the security verification items of its application program.

The actual harm caused by the vast majority of mobile app malicious content and related security detection is the so-called "security" issue and "malicious appearance". In the "real world", the actual malicious appearance or security is far more than ordinary The testing that can be done with tools, or that it is impossible to design a testing tool artificially, can detect the same risks as the "real world". That is to say, the accuracy is actually facing testing and needs to be improved.

As far as the existing technologies are concerned, the tools for detecting APP security can at most part be close to the malicious number in the real world or only a part of them. Therefore, there is no 100% inspection tool that meets all risks. In other words, the reliability of the tool's testing ability can only be guessed as far as possible but cannot be confirmed.

In view of the problems of the prior art, the present inventor believes that there should be an improved device. To this end, an APP is used to detect and collect unknown patterns. It uses computer equipment and programs to operate, that is, a method for detecting mobile applications. Interpretation, cross-comparison based on the interpreted multiple clues, and a detection and correction method for convergence judgment confirmation.

The present invention sets up a double channel test model, and performs two different tests on the same APP. The engine allows it to produce two sets of results, and then cross-compares the two sets of results to find identifiable and reliable clues, determine whether the APP has malicious and security issues, etc., and finds confirmation clues by cross-comparison. Through cross-comparison, find out the good line, and analyze it to confirm whether its clues have reference value. Through the system construction of the present invention, a mechanism for correcting accurate interpretation is generated, and a calculation mode of continuous convergence accuracy is formed. The operation of the model of the present invention is an automated process and a continuous operation method.

The first diagram is a block diagram of the method flow of the present invention.

The second diagram is a schematic diagram of the job definition of the present invention

The third diagram is a detailed schematic diagram of block 6 of the first diagram of the present invention

The following describes the contents, features, and embodiments of the present invention with the aid of drawings, so that your reviewer can have a further understanding of the present invention.

1. Please refer to the first icon box 1 to put the APK application of Android operating system or the IPA application (collectively APP or application) of iOS operating system into the working area or server to be tested by transferring or copying In the specific storage area of, waiting for the subsequent inspection and analysis, the APK or IPA source referred to in this module can be downloaded, copied, stored by itself, or entrusted to carry, and is not limited to the aforementioned source method.

2. Please refer to the first icon showing box 2 and box 3 to receive the APK or IPA (APP or application) assignment from step 1 for analysis. The analysis method is as follows:

(A). Rule (RULE) A which defines the detection, represents a series of headers for detecting the content of the original program (Header) and testing code (Testing Code) or testing performed in the execution simulation environment is defined to perform file disassembly or APP execution behavior and results, regardless of the use of inverse translation or calling the Test Code method and simulation execution, Can be regarded as dismantling and judgment.

(B). According to the dismantling and judgment of the contents of the file, search for compliance with the rules and conduct a MatchQuery to determine the malicious state.

(C). According to the execution result and the content of the log file generated by the execution, search for the compliance of the rules, and conduct a MatchQuery to determine the malicious state.

(D). Analysis system A is triggered by the implementation of Service or Executive tool, and the development of rules and regulations needs to be isolated from the analysis rules B and the naturally derived testing rules and methods, which are generated under natural development Test rules without intentional imitation. The analysis system B is triggered by the execution of the service or the execution tool (Executive tool), and the development of rules and regulations needs to be isolated from the analysis rules and methods derived from the analysis system A, which will occur unintentionally under natural development. Imitation test rules. That is, the analysis methods, rules, and conditions of analysis systems A and B have been developed independently and are independent analysis systems, which serve as an important comparison basis for subsequent screening and filtering of malicious clues.

Please refer to the second figure, and cooperate with the first icon to show the known standards of blocks 1 and 2 or the accumulation of known safety discrimination techniques to formulate and establish inspection rules (rules), such as the second icon to show box 3.

A list of malicious patterns and key control codes are defined according to the inspection rules and regulations, as shown in the second icon box 5. Establish a dismantling and interpretation method (test content) according to the inspection rules, as shown by the second icon in block 4. Detect and interpret according to the defined malicious pattern list and disassembly and interpretation methods, and confirm whether there is a malicious list, as shown in the second icon in boxes 6 and 7. Analyze security clues The rule sets A and B receive the results from the analysis systems A and B disassembled and analyzed according to the first and second blocks 2 and 3, and perform a security clue rule set of the analysis result. The set can be a file format or a database. Format, and has a single security clue that clearly matches the interpretation of the corresponding malicious list. The security clue rule set A of static analysis security clue rule set A is also called MalPattern. This malicious pattern will be stored as an index for further digital identification, but it has not yet been issued for use as security evidence.

3. Receive the step (2), please refer to the third figure, and cooperate with the first icon to show the clues of the analysis results of blocks 4 and 5 and perform the following judgments: (A). Analysis generated by the analysis systems A and B The (dynamic) malicious patterns of security clue rule sets A and B coincide with the origin of the original detected program, which means that analysis system A and analysis system B use different rules but both detect the same security problem at the same location. That is, if it falls in area a, it will be regarded as "dynamic malicious interpretation with high credibility of fast screening rules"; (B). (Static) key control codes for analyzing security clue rules set A and B generated by analysis systems A and B The coincidence and the origin of the original detected program intersect, that is, analysis system A and analysis system B use different rules but both detect the same security problem at the same location, that is, they fall in zone b. (C). The analysis of security clues generated by analysis systems A and B. The (static) key control codes of A and B match (dynamic) malicious patterns and the original detected program. The intersection of the provenances, that is, It is analysis system A and analysis system B that have different rules but both detect the same security problem at the same location, that is, they fall in area e, and are regarded as "trusted results of mobile application security detection" of "dependent common security clues"; ( D). By analogy, when the malicious pattern or key control code does not match, the security clue rule set A and B. The clues that do not match, such as zone d and zone c, are regarded as "not detected" or the rule definition Due to poor design of the testing method, it will be stored separately in a file or database format, and the original testing rules, the location where the program matches the rules, and the program name, file template, etc., including but not limited to the foregoing Enough information for subsequent comparison and interpretation; (E). By analogy, when the malicious pattern and the key control code do not match, the analysis of the clues of the security clue rules set A and B, such as f area, will be regarded as "unchecked" Out "and the rules and regulations are not met, but the geometric distance is similar, as shown in the first icon box 9, 10, 11 and will be stored separately in a file or database format, and the original inspection rules and regulations, and the location where the program meets the rules and regulations are marked. , As well as program names, file templates, etc., and manually compare and repeat the test to confirm the clues, and after the confirmation, incorporate the rules and test methods, such as the first icon shown in boxes 12 and 13.

In summary, the technology provided by the present invention is sufficiently industrially applicable, novel, and progressive enough to obtain patent approval. However, what has been described above is only an industrially preferred embodiment of the present invention. The equal variations of the disclosure of the invention are all within the scope of the present invention.

Claims (2)

A method for collecting and judging unknown patterns of APP detection. It uses computer equipment and programs to operate, and uses a dual channel model to verify the same APP as two different inspection engines to produce two sets of results. The results were cross-matched to find identifiable and reliable clues. The method for collecting and judging unknown patterns of APP detection as described in item 1 of the scope of patent application, includes the following steps: (1). Put the APP into the work area to be tested or a specific storage area of the server by transmission or copying ; (2). Analyze whether the analysis is in accordance with the specifications defined by analysis system A and the specifications defined by analysis system B whether they are in a malicious state; (3). Receive clues from the analysis results of step (2) and perform the following judgments: ( A). Analytical security clue rules set A and B generated by analysis systems A and B coincide with the dynamic malicious pattern of A and B and the origin of the original detected program intersects, that is, analysis system A and analysis system B use different rules but both have different rules. If the same security problem at the same location is detected, that is, if it falls in area a, it is regarded as a dynamic malicious interpretation with high credibility of the fast screening rules; (B). The analysis security clue rules set A and B generated by the analysis systems A and B The (static) key control code of B coincides with the origin of the original program under test, which means that analysis system A and analysis system B use different rules but both detect the same security problem at the same location, that is, they fall in zone b. It is regarded as a static malicious interpretation with high credibility of the fast screening rules; (C). The analysis of the security clue rules generated by the analysis systems A and B coincides with the (static) key control codes of the analysis rules A and B, and the dynamic malicious appearance and original impact The origin of the detection program intersects, that is, analysis system A and analysis system B use different rules but both detect the same security problem at the same location, that is, they fall in area e, they are regarded as dependent and common security. The credible mobile application security detection credible results; (D). By analogy, when the malicious pattern or key control code does not match, the security clue rule set A and B that do not match, such as d and e, are analyzed. Deemed to be undetected or due to poorly defined rules and design and testing methods, will be stored separately in a file or database format, and the original testing rules, the location where the program matches the rules, and the program name, file template Etc., including but not limited to the foregoing sufficient information for subsequent comparison and interpretation; (E). By analogy, when the malicious pattern and key control code do not match, the security clue rule set A and B that do not match will be analyzed, such as f Areas are considered unchecked and the rules and regulations are not met, but the geometric distance is similar. They will be stored separately in a file or database format, and the original inspection rules and regulations, the location where the program matches the rules, and the program name will be marked. , File templates, etc., and carry out manual comparison and repeated testing to confirm the clues, and after the confirmation, incorporate the rules and testing methods.