WO2013077538A1

WO2013077538A1 - Device and method for analyzing api-based application

Info

Publication number: WO2013077538A1
Application number: PCT/KR2012/007449
Authority: WO
Inventors: 고승원; 김용대; 김세일; 유영진; 김종만
Original assignee: 주식회사 안랩
Priority date: 2011-11-22
Filing date: 2012-09-18
Publication date: 2013-05-30
Also published as: KR101143999B1

Abstract

The present invention relates to an API-based application analysis technology which analyzes and diagnoses the properties and risks of an application installed in a mobile device on the basis of usage information of a mobile operating system platform API. To this end, the technology classifies the operating system platform API in terms of an action element and a pattern, provides a weight to each to create a diagnosis policy model, and then analyzes an API extracted from a corresponding application to analyze a functional property and risk. According to the present invention, since analysis on an application installed in a mobile device is automatically made, it is possible to more objectively and quickly analyze the tendencies and risk of the application without depending on an analyst, and it is possible to provide a guide to risk elements and risks to be predicted to a mobile device user along with quantitative figures that are risks and API distribution by risk element.

Description

AP-based application analysis device and method

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technology for analyzing an application used in a mobile device. In particular, the present invention analyzes the propensity and risk of an application installed in a mobile device based on usage information of a mobile application platform API (Application Programming Interface) and performs a diagnosis. Appropriate API-based application analysis device and method.

Today, mobile devices have become a necessity of modern people, and various ubiquitous environments are realized by enabling call, message sending, and wireless Internet access through one or more mobile devices per person.

Moreover, the popularity of smart terminals, which combines the advantages of mobile phones and personal digital assistants (PDAs), is increasing not only in foreign countries but also in Korea. Since the user can install various kinds of applications in the smart terminal, it is possible to install and drive financial transactions, movie and performance booking, navigation, game applications, etc. in addition to the basic call function.

However, as the use of such smart terminals increases, attack methods for smart terminals are also increasing. For example, when an application in which an API for leaking personal information is inserted in the smart terminal is executed, the personal information stored in the smart terminal may be leaked, or the system may be damaged through a specific action. Installation of an application that can perform risky behavior may soon lead to the leakage of personal information contained in the smart terminal and damage of financial transactions.

Accordingly, virus diagnosis companies and security institutes conduct behavior-based diagnosis on application permissions, or application analysts directly analyze application source code or machine language using reverse engineering technology, and analyze the analyzed results. On the basis of this, a diagnostic method through Cyclic Redundancy Check (CRC) is used to find the same file.

For example, in the case of Google's mobile operating system, the Android platform-based application, behavior-based diagnosis can be performed for a verification process that allows a user to control access rights in a manifest file.

As described above, in the behavior-based diagnosis method of an application used in a mobile device according to the prior art, it is too comprehensive and abstract to accurately predict the propensity and risk of the application. In addition, the method by which the analyst directly analyzes the source code using reverse engineering is effective for diagnosing malicious code, but it is difficult to grasp the propensity of the application or the overall API usage and risk.

Accordingly, an embodiment of the present invention may provide an API-based application analysis apparatus and method for analyzing and diagnosing and diagnosing characteristics and risks of an application based on usage information of a mobile operating system platform API before installing an application on a mobile device. .

In addition, the embodiment of the present invention, classify the operating system platform APIs by behavior elements and patterns, create a diagnostic policy model by assigning a weight to each, and then analyze the APIs extracted from the corresponding application to analyze the functional characteristics and risk of the application. An apparatus and method for analyzing an API-based application may be provided.

In addition, the embodiment of the present invention, classify the operating system platform APIs by behavioral elements and patterns, and assigns risk weights to each to create a risk diagnosis policy, and then extracts the requested application through reverse engineering, and extracts the extracted API. By analyzing, it is possible to provide an API-based application analysis apparatus and method for analyzing the functional propensity and risk of the application.

API-based application analysis apparatus according to an embodiment of the present invention, the input unit for receiving the analysis request message for at least one application, and the API (Application Programming Interface) in the operating system platform classified by the behavior element and pattern diagnostic policy model And an analysis control unit for outputting an analysis result by analyzing at least one of functional features and risks of the API of the application for which the analysis is requested, based on the generated diagnostic policy model, wherein the analysis control unit includes the analysis requested application. An API extracting unit for extracting an API from the API, a characteristic analyzing unit for analyzing the corresponding function in the extracted API based on the diagnostic policy model, and adding up the number of APIs having the same functional characteristics, and analyzing the corresponding risk in the extracted API Presets for APIs with the same risk It may include a risk analysis for adding weights.

The analysis control unit may include an API analysis unit performing API analysis for each API of the operating system platform for each action and pattern, and for each action according to a function-specific API list and pattern analysis based on the API analysis. The apparatus may further include an API classification unit classifying the API list, and a diagnostic policy establishment unit generating the diagnostic policy model based on the information classified from the API classification unit.

The diagnosis policy establishment unit may generate a risk diagnosis policy model by assigning a weight to each of a single API, an unordered combination API, and an ordered combination API as a list of APIs for each action according to the pattern analysis.

The API-based application analysis apparatus may further include a graph generator that generates a graph having a preset form based on the analysis result.

The API-based application analysis apparatus may further include an analysis result output unit configured to transmit analysis result information including the generated graph to a user's mobile device or an application store server.

An API-based application analysis method according to an embodiment of the present invention includes a process of receiving an analysis request message for at least one application, a process of generating a diagnostic policy model by classifying APIs in an operating system platform by behavior elements and patterns, and The method may include outputting an analysis result by analyzing at least one of a functional feature and a risk of an API of the requested application, based on the generated diagnostic policy model, and outputting the analysis result may include: Extracting an API from the API, analyzing the corresponding function in the extracted API based on the diagnostic policy model, adding up the number of APIs having the same functional characteristics, and analyzing the corresponding risk in the extracted API to determine the same risk. Process of summing preset weights for owned API It can be included.

The process of generating the diagnostic policy model may include performing API analysis for each API of the OS platform by behavior and pattern, and based on the API analysis and pattern analysis according to the function analysis based on the API analysis. The method may further include classifying into an API list and generating the diagnostic policy model based on the classified information.

The generating of the diagnosis policy model may generate a risk diagnosis policy model by assigning a weight to each of a single API, an orderless combination API, and an ordered combination API as an API list according to the pattern analysis.

The API-based application analysis method may further include generating a graph having a preset form based on the analysis result.

The API-based application analysis method may further include transmitting analysis result information including the generated graph to a user's mobile device or an application store server.

According to the API-based application analysis apparatus and method according to an embodiment of the present invention as described above has one or more of the following effects.

According to the API-based application analysis apparatus and method according to an embodiment of the present invention, it is possible to automate the analysis of the application installed in the mobile device to more objectively and quickly analyze the propensity and risk of the application without depending on the analyst.

In addition, by analyzing the distribution of the entire API, it is possible to provide mobile device users with a guide to predicting future risks and risks with quantitative values such as API distribution and risk level for each risk factor.

And by requesting the analyst only for applications where the risk level is above a certain level, the burden on the analyst can be significantly reduced.

1 is a block diagram showing the structure of an API-based application analysis device according to an embodiment of the present invention;

2 is a diagram illustrating databases in which a list of APIs for each function according to behavior analysis is stored according to an embodiment of the present invention;

3 is a diagram illustrating databases in which a list of APIs by behavior according to pattern analysis is stored according to an embodiment of the present invention;

4 is a flowchart illustrating an operation procedure of an API-based application analyzing apparatus according to an embodiment of the present invention;

5A and 5B are graphs for calculating the characteristics and risks of applications diagnosed according to an embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various forms, and only the embodiments are to make the disclosure of the present invention complete, and common knowledge in the art to which the present invention pertains. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

In describing the embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the embodiments of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the contents throughout the specification.

Combinations of each block of the accompanying block diagram and each step of the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

An embodiment of the present invention is to analyze and diagnose characteristics and risks of an application installed on a mobile device based on usage information of a mobile operating system platform API, and classify the operating system platform API by behavior elements and patterns, After creating a diagnosis policy model by assigning weights, the APIs extracted from the application are analyzed to analyze the functional characteristics and risk of the application.

Meanwhile, an embodiment of the present invention will describe an API analysis method of a mobile operating system platform (for example, Android, iOS, Bada, etc.), but is not limited to the mobile operating system platform, and provides APIs from operating system platform operators of various computing devices. If it can be provided, of course, it is possible to apply the present invention to perform the API analysis for this.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the structure of an API-based application analysis apparatus according to an embodiment of the present invention.

Referring to FIG. 1, the API-based application analyzing apparatus 100 may include an analysis control unit 110, an input unit 130, a graph generator 140, and an analysis result output unit 150. 110 may include an API analyzer 112, an API classifier 114, a diagnostic policy establisher 116, a feature analyzer 118, a risk analyzer 120, an API extractor 122, and the like. have.

The API-based application analysis apparatus 100 may be linked to an application store server to analyze an API of a corresponding application at the request of a mobile device user or an application store server operator.

Here, the application store server may be a server in which a plurality of mobile device users and a plurality of application providers are connected through a wired / wireless network, and when an application is uploaded from each application provider, sales thereof are made.

In detail, the input unit 130 may receive an analysis request message for a specific application from a mobile device user or an application store server operator, and transmit the received analysis request message to the analysis control unit 110. In addition, when a new API is input from the mobile operating system platform operator, it may be transmitted to the analysis controller 110.

The analysis control unit 110 may control the respective functional blocks, generate a diagnostic policy model by analyzing and classifying APIs received from the mobile operating system platform operators, and then analyze functional characteristics and risks of the requested application APIs. Can provide analysis results.

The API analysis unit 112 in the analysis control unit 110 may receive an API from a corresponding mobile operating system platform operator and perform behavior analysis and pattern analysis for each API. That is, by analyzing all APIs in the corresponding mobile operating system platform, an analysis for creating an API list by action and pattern may be performed, and the analysis result information may be output.

The analysis result information output through the API analysis unit 112 is transferred to the API classification unit 114 so that the API classification unit 114 displays a list of APIs by functions according to behavior analysis and API list by behaviors according to pattern analysis for each API. Classification can be done with

Since each API has its own function, each API can be classified by judging each function and the action performed based on each function.

FIG. 2 is a diagram illustrating databases in which API lists for functions according to behavior analysis are stored according to an embodiment of the present invention, and FIG. 3 is a diagram illustrating databases in which API lists for behaviors according to pattern analysis are stored according to an embodiment of the present invention. The figure is shown.

2 to 3, the API classification unit 114 may include a function-based API determination unit 200 according to a behavior analysis and an action-based API determination unit 310 according to a pattern analysis, and the like. The department may determine the function-specific and behavior-based API based on the analysis result information received through the API analysis unit 112 and perform classification into the corresponding database.

First, the API determination unit 200 of each function of FIG. 2 may determine each API based on behavior analysis information included in the analysis result information. That is, according to the determined function of the API can be stored in each function list database (DB).

Each function list database can be unauthorized charging API DB (210), general data leakage API DB (212), rootable API DB (214), Bluetooth hacking API DB (216), system damage possible API DB (218) , Personal information leakage API DB 220, terminal information leakage API DB 222, usage information leakage API DB 224, location information leakage API DB 226 and financial information leakage API DB 228 And the like, but are not limited thereto.

For example, the API analyzer 112 analyzes "getUserData" among the Android platform APIs, and analyzes that this API provides user information through a key associated with the account and the account information, and analyzes the result of the analysis. It may be delivered to the API classifier 114.

Accordingly, after checking the analysis result, the API determining unit 200 for each function of the API classification unit 114 may determine that the corresponding API provides the user information and transmit the stored information to the usage information leakable API DB 224. .

On the other hand, the action-specific API determination unit 310 of FIG. 3 may determine each API based on the pattern analysis information included in the analysis result information. That is, it can be stored in each behavior list database (DB) according to the determined behavior of the API, and the behavior list database includes a single API DB 312, an unordered combination API DB 314, and an API DB 316 having an order. And the like.

For example, when it is analyzed that the "getUserData" API is included in the android.accounts package including the "getAccounts" API and the "getPassword" API, the analyzed result information may be transmitted to the API classification unit 114. The API classification unit 114 may be delivered to the API determination unit 310 for each action, and the API determination unit 200 for each function may deliver and store the "getUserData" API to the personal information leakage possible API DB 220.

In addition, the action-based API determination unit 310 may link the "getUserData" API to the single API DB 312 and the unordered combination API DB 314 to give weights, and then store the weight.

As such, all APIs included in each application are not used independently but are used by many combinations. Therefore, they should not be evaluated alone, and should be judged considering organic relations with each other.

The single API DB 312 stores APIs that can be used independently, and the unordered combination API DB 314 includes, for example, an API for reading personal information, an API for temporary storage in a file or memory area, and a later point in time. If it is determined that the API to be sent to the server set in advance is performed in any order in one combination, it can be stored. In the ordered API DB 316, for example, when personal information is read, APIs that sequentially perform a specific function may be classified and stored, such as when the personal information is read directly to a predetermined server.

On the other hand, each of the functional API determination unit 200 and the behavior-specific API determination unit 310 may be linked to each other DB, depending on the implementation method may be dependent on each other.

The diagnostic policy establishment unit 116 may receive classification information from the API classification unit 114 and generate a diagnosis policy model based on the classified information. That is, the functional characteristics can identify the functional characteristics or propensity of the application based on the number of APIs for each function included in one application, and the risk is a single API classified in the application, an unordered combination API, and a combination having an order. Risk diagnosis is given by assigning a risk weight to each API.

As described above, the diagnostic policy model for confirming the functional characteristics and the risk of the specific application may be transmitted to the characteristic analyzer 118 and the risk analyzer 120, respectively.

On the other hand, the API extraction unit 122 receives the analysis request message of the mobile device user from the input unit 130, parses the application data contained in the analysis request message using reverse engineering technology, at least one set through parsing The package and at least one API included in the package may be extracted. The extracted API may be transmitted to the characteristic analyzer 118 and the risk analyzer 120.

In this case, the API extracting unit 122 may receive the application data for extraction directly from the mobile device user through the analysis request message, but the analysis request message does not include additional data other than the systematic information about the application. In the request to the application to the associated application store server may be delivered.

The characteristic analysis unit 118 is for analyzing and confirming the propensity of the application, that is, the functional characteristics, and classifies the API into functional APIs through the functional analysis of each API based on a diagnosis policy model, and classifies the API number information for each functional function as an analysis result. You can print

The risk analysis unit 120 is for diagnosing a potential risk of an application. The risk analysis unit 120 may classify each API into action APIs through action analysis based on a diagnosis policy model, and may assign a risk weight to each action API. . For example, the risk weights for an unordered combinatorial API or an ordered combinatorial API may be summed up to a single API risk to finally calculate the potential risk of the application.

Accordingly, the result information analyzed from the characteristic analyzer 118 and the risk analyzer 120 may be transmitted to the analysis result output unit 150 and the graph generator 140.

The graph generator 140 receives the characteristic and risk result information from the characteristic analyzer 118 and the risk analyzer 120, and digitizes or percentages the graph through a preset graph. Accordingly, trend analysis and statistical results such as functional statistics, risk weight calculation details, etc. may be calculated and graph output information including the same may be transmitted to the analysis result output unit 150.

The analysis result output unit 150 may receive the characteristic and risk result information from the characteristic analyzer 118 and the risk analyzer 120, and may receive the graph output information from the graph generator 140. The information may be linked to each other and transmitted to an application store server or transmitted to a mobile user device.

This enables you to quickly and accurately measure the functional characteristics and risks of numerous applications stored in the application store server, and to check various functions for each application in advance, and according to the characteristics of potential risks that can be generated by the implementation of each function. It can be used as data for trend analysis and statistics.

4 is a flowchart illustrating an operation procedure of an API-based application analyzing apparatus according to an embodiment of the present invention.

Referring to FIG. 4, when the API analysis unit 112 in the API-based application analysis apparatus 100 is previously stored or received API information from an operating system platform operator through the input unit 130 in step 400, for each API The analysis is performed for each action element and pattern, and the analyzed result information is transmitted to the API classification unit 114.

Accordingly, the API classifier 114 determines the API according to the function in step 402 based on the result information analyzed in step 402, and stores each API determined as the API for each pattern in step 404 in the corresponding DB. However, steps 402 and 404 are not necessarily sequentially performed, or may be performed simultaneously or step 404 may be performed before step 402.

In addition, the API classification unit 114 transmits the classified information to the diagnosis policy establishing unit 116 to establish a policy and a risk policy for each service function in the diagnosis policy establishing unit 116, and generate this as a diagnosis policy model.

After the diagnostic policy model is generated as described above, when the API extraction unit 122 receives the analysis request message of the mobile device user from the input unit 130 in step 408, the corresponding application data is based on the application information included in the analysis request message. API is parsed by reverse engineering.

The extracted API is transferred to the characteristic analyzer 118 and the risk analyzer 120, and in step 410, the characteristic analyzer 118 compares and analyzes the API extracted for each functional element of the diagnostic policy model to correspond to each API. The number is added, and the risk analysis unit 120 compares the risk-specific weights of the APIs and the behavior-specific weights set in the diagnostic policy model with the extracted APIs and adds the corresponding risk weights.

As a result, an analysis result about the general service function is derived through the characteristic analysis unit 118, and an analysis result about the potential risk is derived through the risk analysis unit 120. Each derived analysis result information is transferred to the analysis result output unit 150. In step 412, the analysis result output unit 150 displays text and numbers of the analysis result information including service functions and potential risks for the corresponding application. The graph is output through the interlocked graph generation unit 140 and transferred to the application store server or the mobile device of the user.

5A and 5B are graphs illustrating characteristics and risks of diagnosed applications according to an exemplary embodiment of the present invention.

5A and 5B, the graph generator 140 may receive functional characteristic information and risk information analyzed from the characteristic analyzer 118 and the risk analyzer 120 from the mobile device user or the application server operator. In this way, a graph of a predetermined format may be generated based on each information.

FIG. 5A is a circular graph of the functional characteristics and risks of APIs included in the application, indicating that the personal information access function API occupies about 30% of all APIs, and the location information API occupies about 25% of all APIs. Can be. However, these functions indicate that the likelihood of terminal information leakage is about 15%, and the possibility of charging cost is about 15%.

In this case, when the mobile device user clicks each function region, API list information for performing these functions may be provided. In addition, the pie graph may be represented as the sum of the number of APIs rather than the% format.

Figure 5b is a radial graph of the functional characteristics and risks of the APIs included in the application, the application has a high personal information access, location information use a lot, it can be confirmed that the terminal information leakage possibility is high. .

Through this, mobile device users who want to download the application uploaded to the application store server can be provided with the functional characteristics and risk information of the application that the user may not accurately know through the API analysis graph for each application.

Meanwhile, the functional characteristic information and the risk score calculated through the embodiment of the present invention may not be an absolute basis for determining whether the application is functional or malicious. However, it is sufficient to serve as a primary filter for automating analysis in environments where mobile applications are expected to grow exponentially, and by analyzing the combined patterns for these APIs, more sophisticated risks can be predicted and diagnosed. Can be done.

As described above, the API-based application analysis apparatus and method according to an embodiment of the present invention is for analyzing and diagnosing characteristics and risks of an application installed in a mobile device based on usage information of a mobile operating system platform API. The platform APIs are classified by action elements and patterns, weighted for each to generate a diagnostic policy model, and then the functional characteristics and risks of the application are analyzed by analyzing the API extracted from the application.

In the detailed description of the present invention, specific embodiments have been described. However, various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the scope of the following claims, but also by those equivalent to the scope of the claims.

Claims

An input unit configured to receive an analysis request message for at least one application;

API (Application Programming Interface) in OS platform is classified by action elements and patterns to generate a diagnostic policy model, and based on the generated diagnostic policy model, at least one of the functional characteristics or risks of the API of the requested application is analyzed. An analysis control unit for outputting a result,

The analysis control unit,

An API extraction unit for extracting an API from the application for which the analysis is requested;

A characteristic analysis unit for analyzing the corresponding function in the extracted API based on the diagnostic policy model and summing the number of APIs having the same functional characteristics;

A risk analysis unit for analyzing the corresponding risk in the extracted API and summing preset weights for APIs having the same risk.

API-based application analysis device comprising a.
The method of claim 1,

The analysis control unit,

An API analysis unit which performs API analysis for each API of each OS and pattern of the OS platform;

An API classification unit classifying the API list for each function according to the analysis of behavior and the API list for each action according to the pattern analysis based on the API analysis;

A diagnostic policy establishment unit that generates the diagnostic policy model based on information classified from the API classification unit

API-based application analysis device further comprising.
The method of claim 2,

The diagnosis policy establishing unit,

API-based application analysis device, characterized in that for generating a risk diagnosis policy model by assigning a weight to each of the single API, the orderless combination API and the ordered combination API as the API list for each action according to the pattern analysis.
The method of claim 1,

The API-based application analysis device,

Graph generation unit for generating a graph of a predetermined form based on the analysis result

API-based application analysis device further comprising.
The method of claim 4, wherein

The API-based application analysis device,

Analysis result output unit for transmitting the analysis result information including the generated graph to the user's mobile device or application store server

API-based application analysis device further comprising.
Receiving an analysis request message for at least one application;

Creating a diagnostic policy model by classifying APIs within operating system platforms by behavioral elements and patterns;

Analyzing at least one of functional features and risks of the API of the requested application based on the generated diagnostic policy model and outputting the analysis result;

The process of outputting the analysis result,

Extracting an API from the analysis-requested application;

Analyzing the corresponding function in the extracted API based on the diagnostic policy model and adding up the number of APIs having the same functional characteristics;

Analyzing the corresponding risk in the extracted API and summing preset weights for APIs having the same risk

API-based application analysis method comprising a.
The method of claim 6,

The process of generating the diagnostic policy model,

A process of performing API analysis for each API of each OS and pattern of the OS platform;

Classifying the API list by function based on the analysis of the API and the API list by action based on the pattern analysis;

Generating the diagnosis policy model based on the classified information

API-based application analysis method characterized in that it further comprises.
The method of claim 7, wherein

The process of generating the diagnostic policy model,

API-based application analysis method, characterized in that for generating a risk diagnosis policy model by assigning a weight to each of a single API, an orderless combination API and an ordered combination API as a list of APIs by behavior according to the pattern analysis.
The method of claim 6,

The API based application analysis method,

A process of generating a graph of a preset form based on the analysis result

API-based application analysis method characterized in that it further comprises.
The method of claim 9,

The API based application analysis method,

Transmitting the analysis result information including the generated graph to a user's mobile device or an application store server

API-based application analysis method characterized in that it further comprises.