WO2019004502A1

WO2019004502A1 - Application security assessment method and system

Info

Publication number: WO2019004502A1
Application number: PCT/KR2017/006903
Authority: WO
Inventors: 안성범; 정명주; 김태우; 정상민; 임성열; 전상훈; 한광희; 서동필; 류주현
Original assignee: 라인 가부시키가이샤
Priority date: 2017-06-29
Filing date: 2017-06-29
Publication date: 2019-01-03

Abstract

Provided are an application security assessment method and system. The security assessment method may comprise the steps of: storing pattern data per perspective, the pattern data being for analyzing a package file according to an obfuscation perspective and a vulnerability perspective; receiving a registration of a package file for distribution to users so as to enable the installation and execution of an application; generating obfuscation perspective analysis data and vulnerability perspective analysis data by analyzing the registered package file according to the pattern data per perspective; and providing the generated analysis data.

Description

Method and system for evaluating security of an application

The following description relates to a method of evaluating the security of an application and to a computer program stored on a computer-readable recording medium for causing a computer to execute the security evaluation method in combination with the system and the computer.

The App store is an online content market that sells a variety of applications that can be loaded on terminals such as smart phones. For example, an application developer registers a file (for example, an Android application package (APK)) for installing the developed application on a terminal in the App Store, and users of the application The user can download the file for the application and install and operate the application in his / her terminal. There are also cases where various game applications such as game publishers are distributed to users. As such, there are application publishers that register various applications that developers themselves have not developed and distribute registered applications to users.

At this time, the risk of the application can be explained from various viewpoints.

For example, the first risk of an application is that the application contains information developed with malicious intent, such as malicious code, so that the application publisher in which the application is registered, or a malicious function in the terminal of the user This is the risk of the case. Korean Patent Laid-Open No. 10-2014-0098025 relates to a system and method for security evaluation of an application uploaded to an application store. When an application to be registered in the application store is detected as performing a malicious function, (Registration in the AppStore) of the application.

As another example, the second risk of an application is the risk to the security of the application itself. As the source code of the application is changed or modified through the analysis of the distributed application, the application performs functions other than those originally intended by the developer, thereby reducing the reliability of the service to be provided through the application Lt; / RTI > Accordingly, there is a need for application publishers to provide a certain level of security to applications in distributing various applications (installation files of applications) that they have not developed directly.

However, with respect to the second risk of such an application, there is a difference in the level of security provided by each registered application. For example, each application may have security solutions at different security levels and may not include any security measures. There is also a difference in the level of security provided for each security solution installed in each application.

In the prior art, only the vulnerability of the Java platform can be checked only at the programming language level (for example, the Android application package (APK)). From the viewpoint of the application publisher, There is a problem in that it is difficult to provide a security that is maintained at a certain level or more.

From the perspective of an application publisher, it analyzes and grasps the security level applied to the registered application in an objective way according to each viewpoint of obfuscation, vulnerability and security solution, and provides analyzed information, And provides a security evaluation method and system that can be utilized for improvement.

A method of evaluating security of an application, the method comprising: storing pattern information for each point of view for analyzing a package file according to obfuscation and vulnerability; Registering a package file for distribution to users for installation and operation of an application; Analyzing the registered package file according to the per-view pattern information to generate analytical information on the obfuscation point and analyzed information on the point of view of the vulnerability; And providing the generated analysis information. &Lt; RTI ID = 0.0 > [10] < / RTI >

A system for assessing the security of an application, the system comprising: at least one processor implemented to execute computer readable instructions, the at least one processor being operable to cause a package file to be viewed in an obfuscation perspective and vulnerability, The method includes storing pattern information for each point of view for analysis according to a point of view, registering a package file for distribution to users for installing and running an application, analyzing the registered package file according to the point-of-view pattern information, And generates analysis information of the analysis viewpoint and the vulnerability viewpoint, and provides the generated analysis information.

And a computer program for causing the computer to execute the security evaluation method.

There is provided a computer program stored in a computer-readable recording medium for causing a computer to execute the security evaluation method in combination with a computer.

From the viewpoint of the application publisher, it analyzes and grasps the security level applied to the registered application in an objective way according to each viewpoint of obfuscation, vulnerability and / or security solution, and provides analyzed information, It can be utilized for improving security.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention.

2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention.

3 is a block diagram of a security evaluation system according to an embodiment of the present invention.

4 is a diagram illustrating an example of information included in a report for providing analysis information in an embodiment of the present invention.

FIG. 5 is a diagram showing an example of analysis information of a viewpoint of a vulnerability in an embodiment of the present invention. FIG.

6 is a diagram illustrating an example of a class and a method included in a parsed dll file according to an exemplary embodiment of the present invention.

FIG. 7 is a diagram illustrating an example of analysis information in terms of obfuscation based on classes and methods identified in a parsed dll file according to an exemplary embodiment of the present invention.

FIG. 8 is a diagram showing an example of analysis information in terms of obfuscation with respect to a parsed so file, according to an embodiment of the present invention.

9 is a diagram showing another example of analysis information in terms of obfuscation with respect to a parsed so file, in an embodiment of the present invention.

10 is a block diagram illustrating an example of components that a processor of a server according to an embodiment of the present invention may include.

11 is a flowchart illustrating an example of a security evaluation method that can be performed by a server according to an embodiment of the present invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

The security evaluation system according to embodiments of the present invention can be implemented through a server to be described later, and a security evaluation method according to embodiments of the present invention can be performed through the server described above. For example, a computer program according to an embodiment of the present invention may be installed and operated on a server, and the server may perform a security evaluation method according to an embodiment of the present invention under the control of a computer program have. The above-described computer program may be stored in a computer-readable recording medium in combination with a computer-implemented server to execute a security evaluation method on the computer.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention. 1 shows an example in which a plurality of

electronic devices

110, 120, 130, 140, a plurality of

servers

150, 160, and a network 170 are included. 1, the number of electronic devices and the number of servers are not limited to those shown in FIG.

The plurality of

electronic devices

110, 120, 130, 140 may be a fixed terminal implemented as a computer device or a mobile terminal. Examples of the plurality of

electronic devices

110, 120, 130 and 140 include a smart phone, a mobile phone, a navigation device, a computer, a notebook, a digital broadcast terminal, a PDA (Personal Digital Assistants) ), And tablet PCs. For example, FIG. 1 illustrates the shape of a smartphone as an example of the first electronic device 110, but in the embodiments of the present invention, the first electronic device 110 transmits the network 170 using a wireless or wired communication method. May refer to any one of a variety of physical devices capable of communicating with other

electronic devices

120, 130, 140 and / or servers 150,

The communication method is not limited, and may include a communication method using a communication network (for example, a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network) that the network 170 may include, as well as a short-range wireless communication between the devices. For example, the network 170 may be a personal area network (LAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN) , A network such as the Internet, and the like. The network 170 may also include any one or more of a network topology including a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or a hierarchical network, It is not limited.

Each of the

servers

150 and 160 is a computer device or a plurality of computers that communicate with a plurality of

electronic devices

110, 120, 130 and 140 through a network 170 to provide commands, codes, files, Lt; / RTI > devices. For example, the server 150 may be a system that provides a first service to a plurality of

electronic devices

110, 120, 130, 140 connected through a

network

170, 170, and 140 to the first and second

electronic devices

110, 120, 130, and 140, respectively. More specifically, the server 150 may be at least a part of the apparatuses constituting the system of the application publisher, and the package file of the application installed and operated in the plurality of

electronic apparatuses

110, 120, 130 and 140 may be registered And distribute the service as the first service. As another example, the server 160 may provide a service associated with the application as a second service to a plurality of

electronic devices

110, 120, 130, 140 that install and operate the application through the distributed package file .

2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention. 2 illustrates an internal configuration of the electronic device 1 (110) and the server 150 as an example of the electronic device. Other

electronic devices

120, 130, 140 and server 160 may also have the same or similar internal configuration as electronic device 1 110 or server 150 described above.

The electronic device 1 110 and the server 150 may include

memories

211 and 221,

processors

212 and 222,

communication modules

213 and 223 and input /

output interfaces

214 and 224. The

memories

211 and 221 may be a computer-readable recording medium and may include a permanent mass storage device such as a random access memory (RAM), a read only memory (ROM), and a disk drive. The non-decaying mass storage device such as a ROM and a disk drive may be included in the electronic device 110 or the server 150 as a separate persistent storage device different from the

memory

211 or 221. The memory 211 and the memory 221 are provided with an operating system and at least one program code (for example, a program installed in the electronic device 1 (110) and used for a browser or an application installed in the electronic device 1 Code) can be stored. These software components may be loaded from a computer readable recording medium separate from the

memories

211 and 221. [ Such a computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, and a memory card. In other embodiments, the software components may be loaded into

memory

211, 221 via

communication modules

213, 223 rather than a computer readable recording medium. For example, at least one program may be a computer program installed by files provided by a file distribution system (e.g., the server 160 described above) that distributes installation files of developers or applications, May be loaded into the

memory

211, 221 based on the application (e.g., the application described above).

Processors

212 and 222 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. The instructions may be provided to the

processors

212 and 222 by the

memories

211 and 221 or the

communication modules

213 and 223. For example, the

processor

212, 222 may be configured to execute a command received in accordance with a program code stored in a recording device, such as the

memory

211, 221.

The

communication modules

213 and 223 may provide functions for the electronic device 1 110 and the server 150 to communicate with each other through the network 170 and may be provided to the electronic device 1 110 and / May provide a function for communicating with another electronic device (e.g., electronic device 2 120) or another server (e.g., server 160). The request generated by the processor 212 of the electronic device 1 110 according to the program code stored in the recording device such as the memory 211 is transmitted to the server 170 via the network 170 under the control of the communication module 213 150 < / RTI > Conversely, control signals, commands, contents, files, and the like provided under the control of the processor 222 of the server 150 are transmitted to the communication module 223 of the electronic device 110 via the communication module 223 and the network 170 213 to the electronic device 1 (110). For example, control signals, commands, contents, files, and the like of the server 150 received through the communication module 213 can be transmitted to the processor 212 or the memory 211, (The above-mentioned persistent storage device), which may further include a storage medium 110.

The input / output interface 214 may be a means for interfacing with the input / output device 215. For example, the input device may include a device such as a keyboard or a mouse, and the output device may include a device such as a display, a speaker, and the like. As another example, the input / output interface 214 may be a means for interfacing with a device having integrated functions for input and output, such as a touch screen. The input / output device 215 may be composed of the electronic device 1 (110) and one device. The input / output interface 224 of the server 150 may be a means for interfacing with the server 150 or an interface with a device (not shown) for input or output that the server 150 may include. More specifically, when the processor 212 of the electronic device 1 (110) processes the command of the computer program loaded in the memory 211, the configuration is performed using the data provided by the server 150 or the electronic device 2 (120) A service screen or contents can be displayed on the display through the input / output interface 214. [

Also, in other embodiments, electronic device 1 110 and server 150 may include more components than the components of FIG. However, there is no need to clearly illustrate most prior art components. For example, electronic device 1 110 may be implemented to include at least a portion of input / output devices 215 described above, or may be implemented with other components such as a transceiver, Global Positioning System (GPS) module, camera, Elements. More specifically, when the electronic device 1 (110) is a smart phone, the acceleration sensor, the gyro sensor, the camera module, various physical buttons, buttons using a touch panel, input / output ports, A vibrator, and the like may be further included in the electronic device 1 (110).

3 is a block diagram of a security evaluation system according to an embodiment of the present invention. The security evaluation system 300 shown in FIG. 3 can be implemented through the server 150 described above. The security evaluation system 300 includes a package decomposition module 310, a file identification module 320, The analysis module 340 and the report module 350 may be representations of different functions of the processor 222 of the server 150. For example,

For example, the package decomposition module 310 may be used as a function of the processor 222 in which the processor 222 of the server 150 decomposes the package file according to control commands included in the computer program.

As described above, the server 150 may provide a service for distributing package files of applications registered by developers to users.

At this time, the package decomposition module 310 can decompose the registered package files. For example, the Android Application Package (APK) has a file extension of '.apk' as the file format of the package file used for Android's software and middleware distribution, the mobile operating system. Although embodiments of the present invention are described based on a package file such as APK in the following embodiments, those skilled in the art can easily understand that the same or similar features can be applied to other kinds of package files through this description .

Also, since the APK is already well known, the description of the files themselves included in the APK file or the APK file will also be easily understood by those skilled in the art through the already-cut conventional techniques, and thus the APK file or the files Will not be described in detail.

The file identification module 320 can identify files included in the decomposed package file. The extensions ('dex', 'so', 'dll', 'json', 'ini', 'apk', 'xml', 'cert') shown in FIG. 3, It will be readily apparent to those skilled in the art.

The parsing module 330 may parse the identified files. To do this, the parser 331 may parse files of a particular extension (e.g., 'dex', 'so', 'dll') of the identified files and the collector 332 may parse the files of a particular extension You can gather the necessary information from the files 'json', 'ini', 'apk', 'xml', 'cert'

The parsed information and the collected information may be passed to the analysis module 340.

The analyzing module 340 analyzes the package file (or the application installed and operated on the user terminal such as the electronic device 1 110 through the package file) based on the information transmitted from the parsing module 330, vulnerability viewpoints, and security solutions from the viewpoints of security, obfuscation, vulnerability, and security solution.

For example, obfuscation detection module 341 may generate analysis information about how much obfuscation is applied to files of a particular extension (e.g., 'dex', 'so', 'dll') . For this purpose, the obfuscation detection module 341 can determine whether obfuscation is applied to each item set in advance according to the type of the file.

In addition, the vulnerability detection module 342 generates analysis information as to what vulnerability exists in the files of a specific extension (for example, 'dex', 'so', or the extension of the configuration file 'config' can do. To this end, the security evaluation system 300 can manage information on already known vulnerabilities, and the vulnerability detection module 342 uses information on the vulnerabilities to determine what vulnerabilities exist in which files Can be generated.

In addition, the platform detection module 343 can extract information about a platform on which the application is developed and / or a platform on which the application operates. For example, the security assessment system 300 can utilize different analysis methods depending on the platform in which the application is developed (for example, a development tool such as Unity or Cocos).

Alternatively, since the file format of the package file may be different for each platform on which the application operates, the security evaluation system 300 may utilize different analysis methods for each platform.

For this purpose, the security evaluation system 300 can extract information about the platform for the package file, analyze the package file based on the information, or provide the extracted platform information to the outside.

The security tool detection module 344 may detect the security solution that the developers of the package file themselves have inserted into the package file. For example, a first security tool provided in the form of a library by a third party may be added to the corresponding package file by the developer. As another example, the second security tool developed by the developer may be added to the corresponding package file by the developer. In other words, the security tool detection module 344 can generate analysis information on whether the security tool is applied to the package file.

The relationship analysis module 345 can generate analysis information on a reference relationship between files included in the package file. For example, when the first file includes a code for calling a second file, analysis information may be generated such that information about a reference relationship between the first file and the second file is included in the analysis information.

The report module 350 collects analysis information generated by the analysis module 340 and provides a report for providing the analysis information to the persons concerned (for example, the administrator of the server 150 or the security inspection team of the application publisher) of the security evaluation system 300 Lt; / RTI > Such a report can be provided to a terminal of an interested party using Hypertext Markup Language (HTML) or XML (extensible Markup Language) as in the example of FIG.

4 is a diagram illustrating an example of information included in a report for providing analysis information in an embodiment of the present invention. FIG. 4 is a diagram for explaining an embodiment of the invention. The analysis information included in the report and the method of transmitting analysis information may vary according to the embodiment.

For example, if the file format of the package file is a file format for an operating system other than Android, it is easily understood by those skilled in the art that the information about the files included in the package file and the configuration method thereof may vary depending on the file format. There will be. The files 410 to 480 to be described later may include template information for organizing the information included in the files so as to be meaningful to the user.

The 'Report.html' file 410 may include information on the overall vulnerability class of the target package file and information on the security tool applied to the package file.

The 'WikiReport.html' file 420 may include information on the obfuscation level for each module or file included in the package file, and other information about obfuscation.

The 'Packages.html' file 430 may include information on files included in the package file (for example, plist file, so file, xml file, json file, etc.).

The 'Platfrom.html' file 440 may include information about the platform on which the corresponding package file is developed, such as a development tool such as Unity or Cocos.

The ' Perm.html ' file 450 may include information about a list of usage of Android permits.

The 'Correlation.html' file 460 may include information about the relationship between the modules of the package file or between the files.

The 'AppliedSecurityTool.html' file 470 may contain list information about security tools applied to the package file. In addition, the 'AppliedSecurityTool.html' file 470 may further include information on the type and version of each applied security tool.

'dll, so files information' (480) may contain information about a particular item contained in each file. For example, if information about an IAT (Import Address Table), an EAT (Export Address Table), a section header, a program header, a symbol, etc. of a so file is 'dll, so files information' (480). &Lt; / RTI >

In the table 500 of FIG. 5, 'type' indicates that the item is analysis information of the vulnerability viewpoint. In the table 500 of FIG. 5, 'name' may indicate an identifier indicating a certain vulnerability. Also, 'dangerous grade' in the table 500 of FIG. 5 may indicate the severity of the detected vulnerability. In the table 500 shown in FIG. 5, 'detected log' indicates a vulnerability associated with an identifier (a file name including a path) of the corresponding file and a vulnerability associated with the vulnerability so as to indicate which one of the files included in the package file, Information (e.g., an identifier for a vulnerability found in any open source).

FIG. 6 is a diagram illustrating an example of a class and a method included in a parsed dll file according to an exemplary embodiment of the present invention. FIG. 7 illustrates an example of a class And methods based on obfuscation analysis information.

The square box 600 of FIG. 6 shows identification information of each of classes and methods extracted from a so file included in the package file. For example, the obfuscation detection module 341 described with reference to FIG. 3 can identify the obfuscated class and the obfuscated method by analyzing the extracted classes and methods as shown in FIG.

At this time, the security evaluation system 300 can generate analysis information on the obfuscation point as shown in the table 700 of FIG.

In the table 700 of FIG. 7, 'name' indicates the identifier of the corresponding dll file, 'dangerous grade' indicates the degree of danger of tampering of the corresponding dll file, and 'detected log' indicates information about obfuscation have.

In this case, 'MethodCrypted' in the table 700 of FIG. 7 may indicate whether obfuscation is applied to the method, and 'yes' may be a value indicating that obfuscation is applied to the method.

In the table 700 of FIG. 7, 'TotalClassNum = 23' means that the number of classes extracted from the corresponding dll file is 23, 'TotalMethodNum = 23' means that the number of methods extracted from the corresponding dll file is 23 . &Lt; / RTI >

Meanwhile, 'TotalObfuscatedClassNum = 2' in the table 700 of FIG. 7 may mean that obfuscation is applied to only two classes out of the 23 classes included in the corresponding dll file. In the table 700 of FIG. 7, 'TotalObfuscatedMethodNum = 7' may mean that obfuscation is applied only to 7 classes among the 23 methods included in the corresponding dll file.

At this time, the security evaluation system 300 or the obfuscation detection module 341 can determine the degree of danger of obfuscation of the corresponding dll file based on the number of obfuscated classes and / or the number of obfuscated methods have. For example, the severity of obfuscation can be determined based on the ratio of the number of classes / methods to the number of obfuscated classes across all classes / methods. As a more specific example, the higher the ratio, the lower the degree of risk of relative obfuscation.

FIG. 8 is a diagram showing an example of analysis information in terms of obfuscation with respect to a parsed so file according to an embodiment of the present invention. And shows another example of analysis information in terms of obfuscation.

The table 800 in FIG. 8 indicates that the danger level of the obfuscation point for the file 'libopenal.so' is a safe (SAFE) rating, and the table 900 in FIG. 9 indicates that the file 'libnmscrash64-v1.so' And the risk level of obfuscation is CRITICAL.

To this end, the security evaluation system 300 or the obfuscation detection module 341 determines whether obfuscation is applied to the items included in each of the so files, and determines whether obfuscation is applied according to the degree of obfuscation. The risk level can be determined. For example, in FIGS. 8 and 9, items included in each of the so files are a section header, a string, a string table, a symbol table, and a code. Here, 'yes' may be a value indicating that obfuscation is applied, and 'no' may be a value indicating that obfuscation is not applied.

In the embodiment of FIG. 8, obfuscation is applied to the session header and symbol table of the 'libopenal.so' file, and the code of the 'libopenal.so' file is packed ('codepacking = yes' ), So the risk level of obfuscation in the 'libopenal.so' file is determined to be low. If the code is packed, it is difficult to obtain the original code of the packed code easily.

On the other hand, in the embodiment of FIG. 9, since obfuscation is not applied to all of the predetermined items with respect to the file 'libnmscrash64-v1.so', the danger level of obfuscation in the file 'libnmscrash64-v1.so' Is a highly determined example.

As described above, the security evaluation system 300 is a system in which different types of items (for example, items of a class or method in a dll file, a session header, a string, a string table, a symbol table and / Or code), and the analysis information can be generated by automatically determining the risk level of the obfuscation point of the files according to whether the obfuscation is applied or not.

The security evaluation system 300 generates and manages pattern information for each point of view in terms of the obfuscation point, the vulnerability point of view, and / or the security solution point of view, and analyzes the obfuscation point of view Analysis information from information and vulnerability viewpoints, and / or analysis information from a security solution perspective. The generated analysis information can be provided to the persons concerned. Further, pattern information for each additional viewpoint may be further input through the participant. For example, new pattern information may be developed for analyzing obfuscation and vulnerability based on existing open source new vulnerabilities or already provided analysis information. To this end, the security evaluation system 300 can update the previously stored pattern information for each viewpoint by adding the inputted pattern information for each viewpoint to the previously stored pattern information for each viewpoint. At this time, additional analysis may be performed on the registered package files for further analysis according to the new pattern information.

FIG. 10 is a block diagram illustrating an example of a component that a processor of a server according to an exemplary embodiment of the present invention may include; FIG. 11 is a diagram illustrating a security evaluation performed by a server according to an exemplary embodiment of the present invention; Fig. 2 is a flowchart showing an example of a method. Fig.

The security evaluation system according to embodiments of the present invention may be implemented in the form of a computer device such as the server 150 described above. 10, the processor 222 of the server 150 is a component for implementing the security evaluation system. The processor 222 of the server 150 includes a per-view pattern information storage unit 1010, a package file registration unit 1020, 1030, an analysis information providing unit 1040, and an additional pattern information processing unit 1050. The components of the processor 222 and the processor 222 may perform the steps 1110 to 1180 included in the security evaluation method of FIG. At this time, the components of the processor 222 and the processor 222 may be implemented to execute control instructions according to code of the operating system or code of at least one program that the memory 221 includes. Here, the components of processor 222 may be representations of different functions of processor 222 performed by processor 222 in accordance with the control instructions provided by the code stored in server 150 . For example, the per-perspective pattern information storage unit 1010 may be used as a functional representation of the processor 222 in which the processor 222 stores per-view pattern information according to the control command described above.

In step 1110, the per-view pattern information storage unit 1010 may store per-view pattern information for analyzing the package file in terms of obfuscation and vulnerability. The pattern information may include information on how to analyze the registered package file according to the viewpoint, the file type, and / or the platform type.

In step 1120, the package file registration unit 1020 may register a package file for distribution to users for installation and operation of the application. For example, the package file registration unit 1020 can register a package file input to the server 150 through a package file transmitted from the developer terminal to the server 150 via the network or a separate recording medium. The registered package files may be distributed to users who want to use the application, but the security evaluation may be performed before providing a certain level of security.

In step 1230, the analysis information generation unit 1030 analyzes the registered package file according to the pattern information for each point of view, and generates analysis information on the obfuscation point and analysis information on the point of view of the vulnerability.

For example, the analysis information generation unit 1030 may identify the files included in the package file by decomposing the registered package file. In addition, the analysis information generation unit 1030 can identify the files for which analysis is requested based on the extensions of the identified files, and generate analysis information of the viewpoints corresponding to the files identified by the viewpoints.

More specifically, the obfuscation-based pattern information among the per-view pattern information includes pattern information for identifying whether obfuscation is applied for each item from a file identified as an obfuscation out of the files included in the registered package file can do.

In one embodiment, whether or not obfuscation is applied to each item may include obfuscation for each of the methods and classes included in the file identified in terms of obfuscation. In this case, the analysis information generation unit 1030 identifies the obfuscated method and class in the file identified from the obfuscation point of view according to the pattern information from the obfuscation point of view in step 1230, (2) the number of obfuscated classes, (3) the number of obfuscated methods, and (4) the degree of danger determined based on the number of obfuscated classes. can do. The generation of such analysis information has been described in detail with reference to FIG. 6 and FIG.

In another embodiment, whether or not item obfuscation is applied may include a section header, a string, a string table, a symbol table, and a section header included in the file identified from the obfuscation point of view. And whether to obfuscate each of the information corresponding to at least one item of the code. In this case, the analysis information generation unit 1030 identifies the obfuscated items in the file identified from the obfuscation point of view according to the pattern information from the obfuscation point of view in step 1230, and (1) The type of the item, and (2) the type of item to which the obfuscation is applied.

In addition, the pattern information of the point of view of the weak point among the pattern information by point of view may include vulnerability information for at least one of a protocol, a library, and an API (Application Programming Interface) known to have a vulnerability. In this case, in step 1230, the analysis information generation unit 1030 identifies a file including a protocol, a library, or an API corresponding to the vulnerability information among the files included in the registered package file, according to the pattern information of the vulnerability point of view And generate analysis information of the vulnerability view including (1) an identifier of the identified file, and (2) a risk level determined based on the type of the vulnerability included in the identified file.

In addition, as described above, analysis information from the perspective of a security solution can be further generated. For example, the per-view pattern information storage unit 1010 may further store per-view pattern information for analyzing the package file according to the security solution view in step 1110. In this case, the analysis information generation unit 1030 may further analyze the package file registered in step 1230 according to the per-view pattern information corresponding to the viewpoint of the security solution, and further generate the analysis information of the security solution view .

In step 1140, the analysis information providing unit 1040 may provide the generated analysis information. The analysis information generated as described above may be provided to an interested party (e.g., an administrator of the server 150 or a security verification team of an application publisher). As already described, analysis information on the reference relationship between the files included in the package file can be further generated. In this case, the analysis information providing unit 1040 may further provide analysis information on the reference relationship. The analysis and the information provided have already been described in detail.

In step 1150, the additional pattern information processing unit 1050 can receive additional pattern information for each point of view in association with the provision of the analysis information. For example, the additional pattern information processing unit 1050 can receive additional pattern information for each point of view from the person to whom the analysis information is provided. As a more specific example, as new vulnerabilities in open source are discovered, pattern information for detecting new vulnerabilities can be input from the relevant parties. Or a new file format is developed and commercialized, pattern information for each point of view for analyzing the package file according to the new file format may be inputted.

In step 1160, the additional pattern information processing unit 1050 can update the stored pattern information for each point of view by using the inputted pattern information for each point of view. At this time, the additional pattern information processing unit 1050 may simply add the inputted pattern information for each point of view to the stored pattern information for each point of view, or exchange the inputted pattern information for each point of view and the pattern information for each point of view.

In step 1170, the analysis information generation unit 1030 reanalyzes each of the package files registered in accordance with the entered pattern information for each point of view or the updated point information for each point of view to analyze the obfuscation analysis information and the vulnerability point analysis information Each of the registered package files can be regenerated.

In step 1180, the analysis information providing unit 1040 may provide the regenerated analysis information.

In addition, the security evaluation system may provide a function for exception processing of a vulnerability. For example, there may be cases where the security vulnerability assessment system does not detect an accurate vulnerability of files in a program in detecting whether a vulnerability exists according to pattern information of the vulnerability point of view. For example, there may be a case where a normal file is detected through pattern information of a specific vulnerability viewpoint, and such pattern information can not be modified programmatically. In this case, the security assessment system can provide an exception handling function to exclude from the vulnerability detection even if the pattern information of the vulnerability point of view is already well known.

In addition, the security evaluation system can provide obfuscation and index management functions for analysis results of vulnerability. For example, the security assessment system may provide statistical information, such as information on the number of times a specific vulnerability is detected, over time, and whether the number of times the vulnerability is detected increases or decreases over a period of time . In another example, the security assessment system may provide indicators such as an obfuscation technique whose application is increasing for package files, or information about obfuscation techniques for which application is diminishing.

As described above, according to the embodiments of the present invention, from the viewpoint of the application publisher, the security level applied to the registered application is analyzed in an objective way according to the obfuscation, vulnerability, And can provide the analyzed information to improve the security of the application.

The system or apparatus described above may be implemented as a hardware component, a software component or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device As shown in FIG. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Such a recording medium may be a variety of recording means or storage means in the form of a single or a plurality of hardware combined and is not limited to a medium directly connected to any computer system but may be dispersed on a network. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims

A method for evaluating security of an application,

Storing pattern information for each point of view for analyzing a package file according to obfuscation and vulnerability points;

Registering a package file for distribution to users for installation and operation of an application;

Analyzing the registered package file according to the per-view pattern information to generate analytical information on the obfuscation point and analyzed information on the point of view of the vulnerability;

Providing the generated analysis information;

And the security evaluation method.
The method according to claim 1,

Updating pattern information for each stored point of view using the inputted per-view point pattern information when additional per-view point pattern information is input in association with provision of the analysis information;

Re-analyzing each of the package files registered in accordance with the inputted per-view pattern information or the updated per-view per-view pattern information to reproduce the analysis information of the obfuscation viewpoint and the analysis information of the viewpoint of the vulnerability per each registered package file; And

Providing the regenerated analysis information

Further comprising the step of:
The method according to claim 1,

Wherein the storing step comprises:

Store more pattern information per viewpoint for analyzing the package file according to the viewpoint of the security solution,

Wherein the generating comprises:

Further analyzing the registered package file according to point-of-view pattern information corresponding to the point of view of the security solution, and further generating analysis information from the perspective of the security solution.
The method according to claim 1,

The obfuscation-based pattern information in the per-view pattern information includes pattern information for identifying whether obfuscation is applied to each item from a file identified as an obfuscation point among the files included in the registered package file A security evaluation method characterized by:
5. The method of claim 4,

Whether or not obfuscation is applied to each item includes whether obfuscation is applied to each of the methods and classes included in the file identified from the obfuscation point of view,

Wherein the generating comprises:

(1) the number of obfuscated methods for each target file, (2) the number of obfuscated methods, and (2) the number of obfuscated methods. And (3) the analysis information of obfuscation, which includes a risk level determined based on the number of methods to which obfuscation is applied and the number of classes to which obfuscation is applied, is generated.
5. The method of claim 4,

Whether or not the obfuscation is applied to each item may include at least one of a section header, a string, a string table, a symbol table, and code included in a file identified from the obfuscation point of view Whether or not obfuscation is applied to each piece of information corresponding to one item,

Wherein the generating comprises:

The obfuscated items are identified in the file identified from the obfuscation point of view according to the pattern information from the obfuscation point of view, and the obfuscated items are classified into (1) types of obfuscated items and (2) types of obfuscated items Wherein the analysis information is generated from an obfuscated viewpoint including a risk level determined based on the analysis result.
The method according to claim 1,

The pattern information of the viewpoint of the vulnerability among the viewpoint-by-view pattern information includes vulnerability information for at least one of a protocol, a library, and an API (Application Programming Interface)

Wherein the generating comprises:

Identifying a file including a protocol, a library, or an API corresponding to the vulnerability information among the files included in the registered package file according to the pattern information of the vulnerability point; (1) ) Generates analysis information of a vulnerability view point including a risk level determined based on the type of the vulnerability included in the identified file.
The method according to claim 1,

Wherein the generating comprises:

Disassembling the registered package file to identify files included in the package file; And

Identifying files for which analysis is required based on the extensions of the identified files by point of view and generating analysis information of points of view corresponding to the identified files by point of view

And the security evaluation method.
9. The method of claim 8,

Further comprising generating analysis information on a reference relationship between files included in the package file

Further comprising:

Wherein the providing step comprises:

And further provides analysis information on the reference relationship.
A computer-readable recording medium storing a computer program for causing a computer to execute the method according to any one of claims 1 to 9.
A system for evaluating security of an application,

At least one processor configured to execute computer readable instructions,

Lt; / RTI >

Wherein the at least one processor comprises:

Store pattern information for each point of view for analyzing the package file according to obfuscation viewpoint and vulnerability viewpoint,

A package file for distribution to users is registered for installation and operation of the application,

Analyzing the registered package file according to the per-view pattern information to generate analytical information on the obfuscated viewpoint and analyzed information on the viewpoint of the vulnerability,

Providing the generated analysis information

The security evaluation system comprising:
12. The method of claim 11,

Wherein the at least one processor comprises:

When the additional pattern information for each point of view is input in association with the provision of the analysis information, the pattern information for each point of view stored is updated using the inputted pattern information for each point of view,

Analyzing each of the package files registered in accordance with the inputted per-view pattern information or the updated per-view per-view pattern information to reproduce the analysis information of the obfuscation point of view and the analysis information of the point of view of the vulnerability,

Providing the regenerated analysis information

The security evaluation system comprising:
12. The method of claim 11,

Wherein the at least one processor comprises:

Store more pattern information per viewpoint for analyzing the package file according to the viewpoint of the security solution,

Further analyzing the registered package file according to the point-of-view pattern information corresponding to the point of view of the security solution, and further generating analysis information from the perspective of the security solution

The security evaluation system comprising:
12. The method of claim 11,

The obfuscation-based pattern information in the per-view pattern information includes pattern information for identifying whether obfuscation is applied to each item from a file identified as an obfuscation point among the files included in the registered package file Security evaluation system that features.
15. The method of claim 14,

Whether or not obfuscation is applied to each item includes whether obfuscation is applied to each of the methods and classes included in the file identified from the obfuscation point of view,

Wherein the at least one processor comprises:

(1) the number of obfuscated methods for each target file, (2) the number of obfuscated methods, and (2) the number of obfuscated methods. And (3) the degree of obfuscation analysis information including the degree of danger determined based on the number of obfuscated methods and the number of classes to which obfuscation is applied.
15. The method of claim 14,

Whether or not the obfuscation is applied to each item may include at least one of a section header, a string, a string table, a symbol table, and code included in a file identified from the obfuscation point of view Whether or not obfuscation is applied to each piece of information corresponding to one item,

Wherein the at least one processor comprises:

The obfuscated items are identified in the file identified from the obfuscation point of view according to the pattern information from the obfuscation point of view, and the obfuscated items are classified into (1) types of obfuscated items and (2) types of obfuscated items And generates analysis information of an obfuscation view that includes a danger level determined based on the analysis result.
12. The method of claim 11,

The pattern information of the viewpoint of the vulnerability among the viewpoint-by-view pattern information includes vulnerability information for at least one of a protocol, a library, and an API (Application Programming Interface)

Wherein the at least one processor comprises:

Identifying a file including a protocol, a library, or an API corresponding to the vulnerability information among the files included in the registered package file according to the pattern information of the vulnerability point; (1) ) Generates analysis information of a vulnerability view point including a danger level determined based on the type of the vulnerability included in the identified file.