WO2019004503A1 - Application vulnerability detection method and system - Google Patents

Abstract

Provided are an application vulnerability detection method and system. The vulnerability detection method may comprise the steps of: managing predetermined detection patterns for diagnosing vulnerabilities of an application with respect to at least one among files included in a package file for installing and executing the application, and codes included in the files; registering the package file for distribution to users so as to enable the installation and execution of the application; and by analyzing the registered package file according to at least one detection pattern among the detection patterns, detecting vulnerability data per each of the at least one detection patterns.

Description

A method and system for detecting vulnerabilities in an application

The following description relates to a method and system for detecting vulnerabilities in an application and to a computer program stored on a computer readable recording medium for causing a computer to execute a vulnerability detection method in combination with the computer.

The App store is an online content marketplace that sells a variety of applications that can be installed on terminals such as smart phones. For example, an application developer registers a file (for example, an Android application package (APK)) for installing the developed application on a terminal in the App Store, and users of the application The user can download the file for the application and install and operate the application in his / her terminal. There are also cases where various game applications such as game publishers are distributed to users. As such, there are application publishers that register various applications that developers themselves have not developed and distribute registered applications to users.

At this time, the risk of the application can be explained from various viewpoints.

For example, the first risk of an application is that the application contains information developed with malicious intent, such as malicious code, so that the application publisher in which the application is registered, or a malicious function in the terminal of the user This is the risk of the case. Korean Patent Laid-Open No. 10-2014-0098025 relates to a system and method for security evaluation of an application uploaded to an application store. When an application to be registered in the application store is detected as performing a malicious function, (Registration in the AppStore) of the application.

As another example, the second risk of an application is the risk to the security of the application itself. As the source code of the application is changed or modified through the analysis of the distributed application, the application performs functions other than those originally intended by the developer, thereby reducing the reliability of the service to be provided through the application Lt; / RTI > Accordingly, there is a need for application publishers to provide a certain level of security to applications in distributing various applications (installation files of applications) that they have not developed directly.

However, with respect to the second risk of such an application, there is a difference in the level of security provided by each registered application. For example, each application may have security solutions at different security levels and may not include any security measures. There is also a difference in the level of security provided for each security solution installed in each application.

In the prior art, only the vulnerability of the Java platform can be checked only at the programming language level (for example, the Android application package (APK)). From the viewpoint of the application publisher, There is a problem in that it is difficult to provide a security that is maintained at a certain level or more.

A vulnerability detection method and system capable of detecting a vulnerability of a package file of an application registered for distribution on the basis of a detection pattern set in advance and a search pattern for diagnosing an application vulnerability are preset.

A method for detecting a vulnerability of an application, the method comprising: detecting a predetermined detection pattern for diagnosing a vulnerability of the application, with respect to at least one of files included in a package file for installing and running an application and codes included in the files; ; Registering a package file for distribution to users for installation and operation of an application; And analyzing the registered package file according to the detection pattern of at least one of the detection patterns to detect the vulnerability information according to the at least one detection pattern.

And a computer program for causing the computer to execute the vulnerability detection method is recorded in the computer readable recording medium.

And a computer program stored in a computer-readable recording medium for causing the computer to execute the vulnerability detection method in combination with the computer.

A system for detecting a vulnerability in an application, the system comprising: at least one processor configured to execute computer readable instructions, the at least one processor comprising: Managing a predetermined detection pattern for diagnosing a vulnerability of the application with respect to at least one of codes included in the files, registering a package file for distribution to users for installation and operation of the application, Analyzing the registered package file according to at least one detection pattern among the patterns, and detecting the vulnerability information according to the at least one detection pattern.

A search pattern for diagnosing an application vulnerability can be set in advance and a vulnerability of a package file of an application registered for distribution based on a set detection pattern can be detected.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention.

2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention.

3 is a block diagram of a security evaluation system according to an embodiment of the present invention.

4 is a diagram for explaining a call relationship between instruction masses in an embodiment of the present invention.

5 is a diagram for explaining a calling relationship between methods in an embodiment of the present invention.

6 is a diagram for explaining rules and patterns according to an embodiment of the present invention.

7 is a diagram for explaining a structure of a pattern in an embodiment of the present invention.

8 is a diagram for explaining a source of a pattern in an embodiment of the present invention.

9 is a diagram showing an example of a pattern for arbitrary files in an embodiment of the present invention.

10 is a diagram illustrating an example of a result of detecting a specific character string in a file and a result of detecting a specific file in a package file in an embodiment of the present invention.

11 is a diagram showing an example of a pattern for an Android manifest file in an embodiment of the present invention.

12 is a diagram showing an example of a pattern for a Dex file in an embodiment of the present invention.

13 is a diagram showing an example of a pattern for a so file in an embodiment of the present invention.

14 is a diagram showing an example of a pattern for a dll file in an embodiment of the present invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

The vulnerability detection system according to embodiments of the present invention can be implemented through a server to be described later, and a vulnerability detection method according to embodiments of the present invention can be performed through the server described above. For example, a computer program according to an exemplary embodiment of the present invention may be installed and operated on a server, and the server may perform a vulnerability detection method according to an embodiment of the present invention under the control of a computer program that is run . The above-described computer program may be stored in a computer-readable recording medium in combination with a computer-implemented server to cause the computer to execute the vulnerability detection method.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention. 1 shows an example in which a plurality of electronic devices 110, 120, 130, 140, a plurality of servers 150, 160, and a network 170 are included. 1, the number of electronic devices and the number of servers are not limited to those shown in FIG.

The plurality of electronic devices 110, 120, 130, 140 may be a fixed terminal implemented as a computer device or a mobile terminal. Examples of the plurality of electronic devices 110, 120, 130 and 140 include a smart phone, a mobile phone, a navigation device, a computer, a notebook, a digital broadcast terminal, a PDA (Personal Digital Assistants) ), And tablet PCs. For example, FIG. 1 illustrates the shape of a smartphone as an example of the first electronic device 110, but in the embodiments of the present invention, the first electronic device 110 transmits the network 170 using a wireless or wired communication method. May refer to any one of a variety of physical devices capable of communicating with other electronic devices 120, 130, 140 and / or servers 150,

The communication method is not limited, and may include a communication method using a communication network (for example, a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network) that the network 170 may include, as well as a short-range wireless communication between the devices. For example, the network 170 may be a personal area network (LAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN) , A network such as the Internet, and the like. The network 170 may also include any one or more of a network topology including a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or a hierarchical network, It is not limited.

Each of the servers 150 and 160 is a computer device or a plurality of computers that communicate with a plurality of electronic devices 110, 120, 130 and 140 through a network 170 to provide commands, codes, files, Lt; / RTI > devices. For example, the server 150 may be a system that provides a first service to a plurality of electronic devices 110, 120, 130, 140 connected through a network 170, 170, and 140 to the first and second electronic devices 110, 120, 130, and 140, respectively. More specifically, the server 150 may be at least a part of the apparatuses constituting the system of the application publisher, and the package file of the application installed and operated in the plurality of electronic apparatuses 110, 120, 130 and 140 may be registered And distribute the service as the first service. As another example, the server 160 may provide a service associated with the application as a second service to a plurality of electronic devices 110, 120, 130, 140 that install and operate the application through the distributed package file . According to an embodiment, the server 150 may be used to implement a dedicated system for detecting vulnerability information of a package file to be registered.

2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention. 2 illustrates an internal configuration of the electronic device 1 (110) and the server 150 as an example of the electronic device. Other electronic devices 120, 130, 140 and server 160 may also have the same or similar internal configuration as electronic device 1 110 or server 150 described above.

The electronic device 1 110 and the server 150 may include memories 211 and 221, processors 212 and 222, communication modules 213 and 223 and input / output interfaces 214 and 224. The memories 211 and 221 may be a computer-readable recording medium and may include a permanent mass storage device such as a random access memory (RAM), a read only memory (ROM), and a disk drive. The non-decaying mass storage device such as a ROM and a disk drive may be included in the electronic device 110 or the server 150 as a separate persistent storage device different from the memory 211 or 221. The memory 211 and the memory 221 are provided with an operating system and at least one program code (for example, a program installed in the electronic device 1 (110) and used for a browser or an application installed in the electronic device 1 Code) can be stored. These software components may be loaded from a computer readable recording medium separate from the memories 211 and 221. [ Such a computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, and a memory card. In other embodiments, the software components may be loaded into memory 211, 221 via communication modules 213, 223 rather than a computer readable recording medium. For example, at least one program may be a computer program installed by files provided by a file distribution system (e.g., the server 160 described above) that distributes installation files of developers or applications, May be loaded into the memory 211, 221 based on the application (e.g., the application described above).

Processors 212 and 222 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. The instructions may be provided to the processors 212 and 222 by the memories 211 and 221 or the communication modules 213 and 223. For example, the processor 212, 222 may be configured to execute a command received in accordance with a program code stored in a recording device, such as the memory 211, 221.

The communication modules 213 and 223 may provide functions for the electronic device 1 110 and the server 150 to communicate with each other through the network 170 and may be provided to the electronic device 1 110 and / May provide a function for communicating with another electronic device (e.g., electronic device 2 120) or another server (e.g., server 160). The request generated by the processor 212 of the electronic device 1 110 according to the program code stored in the recording device such as the memory 211 is transmitted to the server 170 via the network 170 under the control of the communication module 213 150 < / RTI > Conversely, control signals, commands, contents, files, and the like provided under the control of the processor 222 of the server 150 are transmitted to the communication module 223 of the electronic device 110 via the communication module 223 and the network 170 213 to the electronic device 1 (110). For example, control signals, commands, contents, files, and the like of the server 150 received through the communication module 213 can be transmitted to the processor 212 or the memory 211, (The above-mentioned persistent storage device), which may further include a storage medium 110.

The input / output interface 214 may be a means for interfacing with the input / output device 215. For example, the input device may include a device such as a keyboard or a mouse, and the output device may include a device such as a display, a speaker, and the like. As another example, the input / output interface 214 may be a means for interfacing with a device having integrated functions for input and output, such as a touch screen. The input / output device 215 may be composed of the electronic device 1 (110) and one device. The input / output interface 224 of the server 150 may be a means for interfacing with the server 150 or an interface with a device (not shown) for input or output that the server 150 may include. More specifically, when the processor 212 of the electronic device 1 (110) processes the command of the computer program loaded in the memory 211, the configuration is performed using the data provided by the server 150 or the electronic device 2 (120) A service screen or contents can be displayed on the display through the input / output interface 214. [

Also, in other embodiments, electronic device 1 110 and server 150 may include more components than the components of FIG. However, there is no need to clearly illustrate most prior art components. For example, electronic device 1 110 may be implemented to include at least a portion of input / output devices 215 described above, or may be implemented with other components such as a transceiver, Global Positioning System (GPS) module, camera, Elements. More specifically, when the electronic device 1 (110) is a smart phone, the acceleration sensor, the gyro sensor, the camera module, various physical buttons, buttons using a touch panel, input / output ports, A vibrator, and the like may be further included in the electronic device 1 (110).

3 is a block diagram of a security evaluation system according to an embodiment of the present invention. The security evaluation system 300 of FIG. 3 may be implemented through the server 150 described above. The vulnerability detection system described above may be implemented to be included in the security evaluation system 300, It is possible to include only the configuration for detecting the vulnerability separately.

The package disassembly module 310, the file identification module 320, the parsing module 330, the analysis module 340 and the report module 350 included in the security evaluation system 300 are installed in the server 150, Lt; RTI ID = 0.0 > 222 < / RTI > For example, the package decomposition module 310 may be used as a function of the processor 222 in which the processor 222 of the server 150 decomposes the package file according to control commands included in the computer program. At this time, the vulnerability detection module 342 included in the analysis module 340 may be implemented as a core module for detecting the vulnerability.

As described above, the server 150 may provide a service for distributing package files of applications registered by developers to users.

At this time, the package decomposition module 310 can decompose the registered package files. For example, the Android Application Package (APK) has a file extension of '.apk' as the file format of the package file used for Android's software and middleware distribution, the mobile operating system. In the following embodiments, embodiments of the present invention will be described based on a package file such as APK, but it will be understood by those skilled in the art that the same or similar features may be applied to other kinds of package files .

Also, since the APK is already well known, the description of the files themselves included in the APK file or the APK file will also be easily understood by those skilled in the art through the already-cut conventional techniques, and thus the APK file or the files Will not be described in detail.

The file identification module 320 can identify files included in the decomposed package file. The extensions ('dex', 'so', 'dll', 'json', 'ini', 'apk', 'xml', 'cert') shown in FIG. 3, It will be readily apparent to those skilled in the art.

The parsing module 330 may parse the identified files. To do this, the parser 331 may parse files of a particular extension (e.g., 'dex', 'so', 'dll') of the identified files and the collector 332 may parse the files of a particular extension You can gather the necessary information from the files 'json', 'ini', 'apk', 'xml', 'cert'

For example, the parsing module 330 can identify each of the classes and methods included in the 'dex' file, track instructions included in the method, And the like. Masses of instructions can be separated by a branch instruction such as a 'goto' statement, a 'switch' statement, or an 'if' statement. In addition, the parsing module 330 may generate and manage information about the call relationships between these instruction masses. For example, the call relationships between instruction masses can be managed in a tree structure, and the information about the call relationship can include information about the methods that a particular instruction mass calls. The generation and management of such information can be processed for each of the files included in the package file such as the APK file, and the parsing method can be changed according to the characteristics of the file.

The parsed information and the collected information may be passed to the analysis module 340.

The analyzing module 340 analyzes the package file (or the application installed and operated on the user terminal such as the electronic device 1 110 through the package file) based on the information transmitted from the parsing module 330, vulnerability viewpoints, and security solutions from the viewpoints of security, obfuscation, vulnerability, and security solution.

For example, obfuscation detection module 341 may generate analysis information about how much obfuscation is applied to files of a particular extension (e.g., 'dex', 'so', 'dll') . For this purpose, the obfuscation detection module 341 can determine whether obfuscation is applied to each item set in advance according to the type of the file.

In addition, the vulnerability detection module 342 generates analysis information as to what vulnerability exists in the files of a specific extension (for example, 'dex', 'so', or the extension of the configuration file 'config' can do. To this end, the security evaluation system 300 can manage information on already known vulnerabilities, and the vulnerability detection module 342 uses information on the vulnerabilities to determine what vulnerabilities exist in which files Can be generated.

In addition, the platform detection module 343 can extract information about a platform on which the application is developed and / or a platform on which the application operates. For example, the security assessment system 300 can utilize different analysis methods depending on the platform in which the application is developed (for example, a development tool such as Unity or Cocos).

Alternatively, since the file format of the package file may be different for each platform on which the application operates, the security evaluation system 300 may utilize different analysis methods for each platform.

For this purpose, the security evaluation system 300 can extract information about the platform for the package file, analyze the package file based on the information, or provide the extracted platform information to the outside.

The security tool detection module 344 may detect the security solution that the developers of the package file themselves have inserted into the package file. For example, a first security tool provided in the form of a library by a third party may be added to the corresponding package file by the developer. As another example, the second security tool developed by the developer may be added to the corresponding package file by the developer. In other words, the security tool detection module 344 can generate analysis information on whether the security tool is applied to the package file.

The relationship analysis module 345 can generate analysis information on a reference relationship between files included in the package file. For example, when the first file includes a code for calling a second file, analysis information may be generated such that information about a reference relationship between the first file and the second file is included in the analysis information.

The report module 350 collects analysis information generated by the analysis module 340 and provides a report for providing the analysis information to the persons concerned (for example, the administrator of the server 150 or the security inspection team of the application publisher) of the security evaluation system 300 Lt; / RTI > Such a report can be provided to a terminal of an interested party using Hypertext Markup Language (HTML) or XML (extensible Markup Language) as in the example of FIG.

4 is a diagram for explaining a call relationship between instruction masses in an embodiment of the present invention. FIG. 4 illustrates a method 400 for a method A 400 including a root mass 410, an instruction mass 1 420, an instruction mass 2 430, an instruction mass 3 440, Five instruction masses, such as mass 5 (450), are identified. As already described, instruction masses can be distinguished based on branch instructions, and when each of the instruction masses is assumed to be a node, the dashed arrows in FIG. 4 indicate the parent node of the particular node. For example, FIG. 4 shows that the parent node of instruction mass 3 (440) is instruction mass 2 (430). Herein, the child node may include a mass of instructions which are classified according to a branch instruction included in the parent node. The root mass 410 may be the mass of instructions that are executed first for the method A 400.

4 illustrates that instruction mass 1 420 includes instructions for a conditional branch 421 and that instructions of instruction mass 3 440 or instruction mass 4 450 are executed according to the conditions Let's assume. At this time, instruction mass 3 440 and instruction mass 4 450 can be identified, and the parent nodes of instruction mass 3 440 and instruction mass 4 450 can be Instance Mass 1 420 . In addition, the position to be moved to instruction mass 3 440 according to the instruction for conditional branch 421 is moved by label 1 (Lable 1, 441) and the position where instruction mass 4 (450) 2, and 451, respectively. In other words, a call can be detected at instruction mass 1 420 and instruction masses 440 and 450, which are called through the detected call, can be directed through labels 441 and 451. In Fig. 4, solid lines indicate such an indicating relationship.

5 is a diagram for explaining a calling relationship between methods in an embodiment of the present invention. 5 shows information 510 and method a 520 for call reference. Method a 520 may include at least one instruction mass, and FIG. 5 illustrates one instruction mass 521.

5 shows an example in which a call to the method b 511 and the method c 512 is detected in the instruction mass 521. Each method can be identified by a unique method ID. The vulnerability detection system according to the present embodiment acquires information on the method b 511 and the method c 512 using the method ID of the method a 520 in the information 510 of the call reference in accordance with the detected call can do.

Here, the information on the method b 511 and the method c 512 are information on the instruction masses for the called method b 511 and the method c 512, respectively, as described with reference to FIG. 4, And information on the reference relationship between the nodes. Therefore, the vulnerability detection system can grasp how the execution control of the program according to the file is being transferred.

6 is a diagram for explaining rules and patterns according to an embodiment of the present invention. 6 illustrates an example of the structure of a rule (Rule) 600 according to the present embodiment. In the present embodiment, the rule 600 may include information on a detection pattern for detecting a vulnerability corresponding to any one of known vulnerabilities.

In FIG. 6, the 'Name' item 610 may include the name of the corresponding rule 600, and the 'Description' item 620 may include a detailed description of the corresponding rule 600 . For example, the rule 600 may include explanatory information on the vulnerability. Also, the 'Guide' item 640 may include information on the behavioral principles and instructions related to the use of the rule 600.

Also, the 'Priority' item 630 may include information on the risk level for the vulnerability. For example, a value for one of three risk classes, such as 'Critical', 'Warning', and 'Normal' is set to 'Priority' item 630 . It is clear that this risk level may be set to two or more than four levels.

Also, the 'Dependency' item 650 may indicate whether there is a condition that dynamically determines the actual vulnerability of the vulnerable layer. For example, there may be cases where the risk for a single vulnerability is conditional. For example, a vulnerability a may have a "critical" risk rating in condition 1, but a vulnerability a may have a "normal" risk rating in condition 2, or no risk at all . Therefore, in order to distinguish such a conditional difference, the 'Dependency' item 650 may include information on the condition and information on the danger level according to the condition. Or may simply include information as to whether such conditions exist.

The items of the rule 600 described above can be optionally included in the rule 600 according to the embodiment.

The 'Pattern' item 660 may include one or more detection patterns for detecting vulnerabilities. The detection patterns may be preset, and one rule 600 may include one detection pattern for detecting vulnerabilities or a combination of two or more detection patterns. The detection pattern may be implemented with at least one instruction, and each of the at least one instruction may be implemented in the form of a method or class having parameters. The parameter may be set in advance or dynamically set to a value extracted through another pattern.

7 is a diagram for explaining a structure of a pattern in an embodiment of the present invention.

The rule table (rule_tbl, 710) may include information on the set rule. 'rule_id (pk)' may mean a rule corresponding to a primary key (pk) among the set rules. In this case, 'rule_id (pk)' may refer to a function that takes the main identifier pk as a parameter and returns the identifier of the corresponding rule. 'name (key)' can mean the name of the rule corresponding to the key. This 'name (key)' can also mean a function that actually returns the name of the corresponding rule by taking the key key as a parameter. In this way, 'x (y)' in FIG. 7 means 'x' corresponding to 'y' although 'y' can mean function 'x' inputted. 'pattern_hash (fk)' may mean a hash value of a pattern corresponding to an external identifier (foreign key, fk). In addition, 'description', 'priority', 'guide' and 'dependency' are 'Description' item 620, 'Priority item' May refer to values corresponding to a 'Priority' item 630, a 'Guide' item 640, and a 'Dependency' item 650. 'pattern_hash (key)' can mean a hash value of the pattern corresponding to the key. The vulnerability detection system can obtain information on necessary rules using the rule table 710 and obtain a hash value of the pattern as an identifier of the pattern included in the obtained rule.

The pattern table (pattern_tbl, 720) may include information on the set pattern. 'pattern_id (pk)' may refer to a pattern corresponding to a primary key (pk), and 'rule_id (pk)' may refer to a rule corresponding to an external identifier (foreign key, fk). Also, 'source' may mean information about the source of the pattern. For example, the source of a pattern may represent the type of file to be searched in a package file such as APK. 'Join_pattern' is information of another pattern composing one rule, 'join_type (and / or or)', and 'join_type' is information of a type of pattern to be returned. / sub) ' can each mean information as to what type of patterns are combined. Here, 'and', 'or', and 'sub' may refer to logical operators for combinations of patterns as described in Table 19 below. The vulnerability detection system can identify the patterns included in the rule through information on rules obtained from the rule table 710 and obtain information on the patterns included in the rule through the pattern table 720 .

The dex file table (pattern_data_dex_find_api, 730) may include information extracted from the DEK file of the APK. 'pattern_id (fk)' may mean a pattern corresponding to the foreign key (fk) among the set patterns. 'Called_class_name' may be a value for identifying a class name to be called, and 'called_method_name' may be a value for identifying a method name to be called. 'argument_index (optional)' is a function that returns the index of the argument, and 'argument_type' is the type of the argument that is returned. It can mean. 'argument_from_null_detect (true / false)' can indicate whether to detect a null argument, and whether 'argument_from_null_except (true / false)' is an exception to the null argument. The dex file table 730 also includes an argument (argument_from_detect_api_list) from the detected API list, an argument (argument_from_except_api_list) from the exception-treated API list, an argument from the detected field list (argument_from_detect_field_list) (argument_from_except_list). The vulnerability detection system can refer to the dex file table 730 in detecting information necessary for detecting a vulnerability according to a pattern. For example, the vulnerability detection system can identify a method or a class to be invoked in a corresponding instruction mass by using a dex file table 730 in detecting a vulnerability to a specific instruction mass.

The file table (pattern_data_retrieve_file_tbl, 740) may include pattern information for extracting information of a specific file included in the package file. 'pattern_id (fk)' may mean a pattern corresponding to an external identifier (foreign key) fk, and 'pattern_hash (key)' may mean a hash value of a pattern corresponding to a key. 'File_type' is the type of the file to be searched through the pattern, 'file_extension' is the extension of the file to be searched through the pattern, 'file_name' is the file Quot ;, respectively.

The content table (pattern_data_retrieve_file_contents_tbl, 750) may include pattern information for extracting characters included in the file. 'pattern_id (fk)' may mean a pattern corresponding to an external identifier (foreign key) fk, and 'pattern_hash (key)' may mean a hash value of a pattern corresponding to a key. 'File_type' is the type of the file to be searched through the pattern, 'character_type' is the type of the character (or string), 'character' is the character String).

The permission table (pattern_data_retrieve_permission_tbl, 760) may include pattern information for extracting permission information of the package file. 'pattern_id (fk)' may mean a pattern corresponding to an external identifier (fk) among the set patterns, and 'name' may mean the name of a permission.

The activity table (pattern_data_retrieve_activity_tbl, 770) may include pattern information for extracting activity information. 'pattern_id (fk)' may mean a pattern corresponding to an external identifier (fk) among the set patterns, and 'name' may mean the name of an activity. Here, an activity means a screen with a user interface. For example, an activity class can be inherited from an APK. As such, terms such as activities and permissions described above will be readily understood by those skilled in the art through conventional techniques for APK.

The SDK table (pattern_data_retrieve_min_sdk, 780) may include pattern information for extracting information on an SDK (Software Development Kit). 'pattern_id (fk)' may mean a pattern corresponding to an external identifier (fk) among the set patterns, 'version' means version information of SDK, 'version detection condition' Can each mean a detection condition of the version. For example, if the version is set to '21' and the 'conditional_equality' is 'small or equal', then the version of the SDK may be detected if the version is 21 or less.

8 is a diagram for explaining a source of a pattern in an embodiment of the present invention. The source of the pattern 660 included in the rule 600 may be a specific file of a package file such as APK. In FIG. 8, the pattern 660 includes any file (810), a dex file (dex) 820, an Android manifest file (AndroidManifest.xml) 830, Or a dll file (dll, 850) as a source.

9 is a diagram showing an example of a pattern for arbitrary files in an embodiment of the present invention. FIG. 9 shows the types of patterns 900 for arbitrary files 810. FIG.

The pattern of the first kind 910 may refer to a pattern for finding a specific character (or string) in a file, and may be expressed as pattern 1 below.

[Pattern 1]

RetrieveFileContents:

     : FileType (string) CharacterType (string) Character (string)

For example, a pattern for finding a URL (Uniform Resource Locator) in a JavaScript Object Notation (JSON) file can be implemented as 'RetrieveFileContents: FileType (json) CharacterType (string) Character (http: // *)'. In other words, the above-mentioned example pattern may be a command to search for 'http: // *' as a string of a 'string' type in a file of 'json' type as a pattern for retrieving contents contained in a file. In this pattern 'RetrieveFileContents', the parameters of the file type' FileType () 'are' all ',' apk ',' txt ',' ini ',' property ',' json ',' xml ',' img ',' mp4 &Quot;, etc. < / RTI > Here, the file type 'all' can mean files of all extensions. In addition, the parameter of the character type 'CharacterType ()' may mean a character or a string type such as 'string', 'hexa', and the like. A parameter of 'Character ()' may mean a string to be searched, and an asterisk (*) may mean any string starting with a string before the asterisk.

The pattern of the second kind 920 may refer to a pattern for finding a specific file in the package file, and may be expressed as pattern 2 below.

 [Pattern 2]

RetrieveFile:

     : FileType (string) FileName (string)

For example, a pattern that contains a DLL (Dynamic Linking Library) type and has a file name of "Assembly-Csharp" among the files included in the package file is "RetrieveFile: FileType (string) FileName (Assembly-Csharp) Can be implemented together. As another example, a pattern for searching DLL type files among the files included in the package file can be implemented as 'RetrieveFile: FileType (string)'.

The parameters of the file type 'FileType ()' are the file extensions such as 'all', 'apk', 'txt', 'ini', 'property', 'json', 'xml', 'img', 'mp4' Or may be set dynamically. The parameters of the file name 'FileName ()' can also be pre-set or dynamically set. 'FileExtension ()' may be further used to search for a file based on the file extension, and the 'FileExtension ()' parameter may be set in advance or dynamically.

10 is a diagram illustrating an example of a result of detecting a specific character string in a file and a result of detecting a specific file in a package file in an embodiment of the present invention.

The detected information 1010 indicates that it may include a detected file name 1011 and a match string 1012 according to the pattern of the first type 910. In the example of FIG. 9 described above, when there are three 'json' type files, 'http: // *' can be searched as a string of 'string' type in each of the three files, May be provided by file name. If one 'json' file contains multiple URLs, multiple strings may be detected.

In addition, the detected information 1020 indicates that it may include a file name (File name, 1021) detected in the package file according to the pattern of the second kind (920). Even in this case, a plurality of file names can be searched according to the pattern.

11 is a diagram showing an example of a pattern for an Android manifest file in an embodiment of the present invention. 11 shows the type of the pattern 1100 for the Android manifest file (AndroidManifest.xml, 830).

The pattern of the third kind 1110 may refer to a pattern for finding a permission group in the Android manifest file 830 and may be expressed as pattern 3 below.

[Pattern 3]

RetrievePermission:

     : Name (string or *)

For example, as a result of detection for pattern 'RetrievePermission: Name (*)', permissions such as 'android.permission.GET_TASKS' and 'android.permission.INTERNET' may be provided. As another example, a permission with that name may be searched for a specific permission name, such as the pattern 'RetrievePermission: Name (android.permission.READ_EXTERNAL_STORAGE)'. If a vulnerability associated with a particular permission is known, a pattern can be set to detect if the permission exists and vulnerability detection can be performed based on the configured pattern. In the patterns to be described later, the common factors may include a common role.

The pattern of the fourth kind 1120 may refer to a pattern for finding an activity group in the Android manifest file 830 and may be expressed as pattern 4 below.

[Pattern 4]

RetrieveActivity:

     : Name (string or *)

The pattern of the fifth kind 1130 may refer to a pattern for finding the minimum SDK API version in the Android manifest file 830 and may be expressed as pattern 5 below.

[Pattern 5]

RetrieveMinSDK:

     : Version (string or *)

     : ConditionalEquality

The parameter of version 'Version ()' can be set to dynamically set the value of the desired version as a string type, or an asterisk (*) to mean all versions. Also, 'ConditionalEquality', which means a comparison condition, can be utilized for comparison between the value set in the version 'Version ()' using the equal sign or inequality and the SDK API version set in the Android manifest file. For example, 'RetrieveMinSDK: Version (21) ConditionalEquality (<=)' may refer to a pattern that detects a version 21 or less.

The pattern of the sixth kind 1140 may refer to a pattern for searching the target SDK API version in the Android manifest file 830 and may be expressed as pattern 6 below.

[Pattern 6]

RetrieveTargetSDK:

     : Version (string or *)

     : ConditionalEquality

The version 'Version ()' and 'ConditionalEquality', which means the comparison condition, can be common with the pattern 6.

The pattern of the seventh kind 1150 may refer to a pattern in which the main application is found in the Android manifest file 830 and may be expressed as pattern 7 below.

[Pattern 7]

RetrieveMainApplication:

     : Name (string or *)

The pattern of the eighth kind 1160 may refer to a pattern of finding a service group in the Android manifest file 830 and may be expressed as pattern 8 below.

[Pattern 8]

RetrieveService:

     : Name (string or *)

The pattern of the ninth kind 1170 may refer to a pattern for finding a receiver group in the Android manifest file 830 and may be expressed as pattern 9 below.

[Pattern 9]

RetrieveReceiver:

     : Name (string or *)

The pattern of the tenth kind (1180) may refer to a pattern of finding a provider group in the Android manifest file (830), and may be expressed as pattern 10 below.

[Pattern 10]

RetrieveProvider:

     : Name (string or *)

The permissions, activity, minimum SDK API version, target SDK API version, main application, service, receiver, and provider searched in the Android manifest file 830 may be readily understood by those skilled in the art through well known prior art techniques for APK .

12 is a diagram showing an example of a pattern for a Dex file in an embodiment of the present invention. 12 shows the types of the patterns 1200 for the dex file dex 820. FIG.

The pattern of the eleventh kind 1210 may refer to a pattern for searching a called API, and may be expressed as pattern 11 below.

[Pattern 11]

DexFindApi :

: DexCalledAPI (require)

          : ClassName, MethodName

: DexTraceArgument (optional)

          : ArgumentIndex (number)

          : ArgumentType (string)

: DexArgumentFrom (optional)

          : Exceptional (true / false)

          : FromNull

: List: FromAPIList

               : ClassName, MethodName

: List: FromFieldList

               : ClassName, MethodName

Here, 'DexFindApi' can refer to the pattern name of the pattern for which the called API is searched. Also, 'DexCalledAPI' can mean a factor for specifying a specific method of a specific class. These classes and methods can be specified according to 'ClassName' and 'MethodName'. Also, 'DexTraceArgument' may refer to a factor for specifying a specific index and / or an argument of a certain type. Also, 'DexArgumentFrom' can mean a factor for determining whether to handle an exception, detecting an argument from a null, or specifying a specific API list or a field list.

Table 1 below shows a first example of an instruction mass, and Table 2 shows a first example of a pattern.

Class cfindMe {public void mfindMe {SSLContext sc = SSLContext. getInstance ("TLS"); sc.init (null, new TrustManager [] {new VulnClass01 ()}, new java.security.SecureRandom ()); }}

DexFindApi : DexCalledAPI :: ClassName (Liavax / net / ssl / SSLContext) MethodName (init)

The pattern in Table 2 can refer to a pattern that looks for an API that calls the method 'init' in class 'Liavax / net / ssl / SSLContext'. In this case, the vulnerability detection system can detect that the method 'mfindMe' of the class' cfindMe 'calls the corresponding method' init 'in the instruction mass of Table 1 based on the corresponding pattern, and' called from cfindMe- gt; mfindMe &apos;. &lt; / RTI &gt;

Table 3 below shows the second example of the instruction mass, and Table 4 shows the second example of the pattern.

Class cfindMe {public void mfindMe {SSLContext sc = SSLContext. getInstance ("TLS"); TrustManager tm = TrustManagerFactory.getTrustManagers (); sc.init (null, tm, new java.security.SecureRandom ()); }}

DexFindApi : DexCalledAPI :: ClassName (Ljavax / net / ssl / SSLContext) MethodName (init) DexTraceArgument :: ArgumentIndex (2): ArgumentType (Ljavax / net / ssl / TrustManager) FromApiList :: FromApiList [0] {ClassName (Ljavax / net / ssl / TrustManagerFactory), MethodName (getTrustManagers)}: Exception (true)

The pattern in Table 4 finds the API calling the method 'init' in class 'Liavax / net / ssl / SSLContext' and traces the arguments of type 'Ljavax / net / ssl / TrustManager' in index '2' However, this can mean a pattern treated as an exception (true) for the class 'Ljavax / net / ssl / TrustManagerFactory' specified in ApiList and method 'getTrustManagers'.

As shown in Table 3, the API calling the method 'init' of the class' Liavax / net / ssl / SSLContext 'is the method' mfindMe 'of the class' cfindMe' and the type 'Ljavax / net / ssl / TrustManager 'argument is' tm'. However, since the method 'getTrustManagers' of the class 'Ljavax / net / ssl / TrustManagerFactory' does exception handling, the method 'mfindMe' of the argument 'tm' or class 'cfindMe' can be detected without exception.

Table 5 below shows a third example of the instruction mass, and Table 6 shows a third example of the pattern.

Class cfindMe {public void mfindMe {SSLContext sc = SSLContext. getInstance ("TLS"); sc.init (null, null, new java.security.SecureRandom ());

DexFindApi : DexCalledAPI :: ClassName (Ljavax / net / ssl / SSLContext) MethodName (init) DexTraceArgument :: ArgumentIndex (2) DexArgumentFrom :: FromNull

The pattern in Table 6 finds the API calling the method 'init' in class 'Liavax / net / ssl / SSLContext' and traces the argument of index '2' in method 'init' May refer to a pattern of looking for.

Looking at the instruction mass in Table 5, the API calling the method 'init' of class 'Liavax / net / ssl / SSLContext' is the method 'mfindMe' of class 'cfindMe' and the argument of index '2' Is null. Thus, according to 'DexCalledAPI', it can detect that method 'mfindMe' of class 'cfindMe' calls its method 'init', and arguments from 'null' according to 'DexTraceArgument' and 'DexArgumentFrom' init 'at index 2. At this time, as the detection result, 'called from cfindMe-> mfindMe' message and 'argument from null' message may be provided.

Table 7 below shows the fourth example of the instruction mass, and Table 8 shows the fourth example of the pattern.

Class A {public init () {String str = "xxx"; System.Collections.Start ();}} C # public static void m (string input) {StringBuilder str = new StringBuilder (input); }}

DexFindApi : DexCalledAPI :: ClassName (System) MethodName (loadLibrary) DexTraceArgument :: ArgumentIndex (1)

The pattern in Table 8 can refer to a pattern that looks for APIs that call the method 'loadLibrary' in class 'System' and traces the arguments at index '1' in method 'loadLibrary'.

According to the instruction mass in Table 7, it can be seen that the API calling the method 'loadLibrary' of the class 'System' is the method 'm' of the class 'C'. At this time, the argument of the index '1' of the method 'loadLibrary' is 'str', the argument 'str' is 'xxx' in the method 'init' of the class 'A' Notice that "xx" is 'append' in 'm'. The tracing for this argument 'str' can be done using the call relation between previously created and managed methods as described above.

At this time, the detection result of the pattern can be provided as shown in the message of Table 9 below.

called from C-> m argument str  is string str + = " xx " str = input (parameter) Parameter is "xxx" in A-> init

'called from C-> m' can indicate that the API calling the method 'loadLibrary' of class 'System' is a method m of class C. 'argument str is string' can indicate that the type of the argument 'str' is 'string'. In addition, 'str + = "xx"' can mean that "xx" is appended to the argument 'str' by the method 'str.append ("xx"); In addition, str = input (parameter) may mean that the argument 'str' was passed as parameter 'input', and parameter ' It can mean "xxx" in method 'init'. Therefore, it can be seen that the argument 'str' of the index '1' of the method 'loadLibrary' of the class 'System' has the value 'xxxxx' of the current 'string' type.

Table 10 below shows the fifth example of the instruction mass, and Table 11 shows the fifth example of the pattern.

Class cfindMe {public void mfindMe {SSLContext sc = SSLContext. getInstance ("TLS"); TrustManager tm = SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER; sc.init (null, tm, new java.security.SecureRandom ()); }}

DexFindApi : DexCalledAPI :: ClassName (Liavax / net / ssl / TrustManager) MethodName (init) DexTraceArgument :: ArgumentIndex (2) DexArgumentFrom : Exception (false): FromFieldList FromField [0] {ClassName (Lorg / apache / http / conn / ssl / SSLSocketFactory), FieldName (ALLOW_ALL_HOSTNAME_VERIFIER)

The pattern in Table 11 finds the API calling the method 'init' in class 'Liavax / net / ssl / SSLContext' and traces the arguments of index '2' in method 'init' May refer to a pattern that does not handle exceptions.

It can be seen that the API calling the method 'init' of class 'Liavax / net / ssl / SSLContext' through the instruction mass of Table 10 is the method 'mfindMe' of class 'cfindMe' Can be found to be 'tm'.

At this time, since the field 'ALLOW_ALL_HOSTNAME_VERIFIER' of the class 'Lorg / apache / http / conn / ssl / SSLSocketFactory' does not handle exceptions, the API calling the method 'init' of the class 'Liavax / net / ssl / SSLContext' (called from cfindMe -> mfindMe, for example) may be provided as a result of detection, and the argument 'tm' of index '2' of method 'init' (E.g., 'argument from SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER') to indicate that it is an argument from SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER may be further provided as a detection result.

Referring again to FIG. 12, the pattern of the twelfth kind 1220 may refer to a pattern for finding a specific instruction of a method, and may be expressed as pattern 12 below.

[Pattern 12]

DexMethodBody :

: MethodName (require)

          : MethodName

: DexInstructionList (require)

          : List <DexInstruction>

          : Except (true / false)

: DexInstruction

          : VoidBody

          : InvokeInstruction

               : ClassName (string)

               : MethodName (string)

Here, 'DexMethodyBody' can refer to a pattern name to find a specific instruction within a particular method. Also, 'MethodName' may mean a factor for specifying a method. Also, 'DexInstructionList' may mean a factor for specifying an instruction to detect. For example, 'List <DexInstruction>' can be used to specify the instruction to detect, and 'Except (true / false)' can be used to determine whether to handle the specified instruction. Also, 'VoidBody' can be used to specify an instruction of type void, and 'InvokeInstruction' can be used to specify the instruction to be called.

Table 12 below shows the sixth example of the instruction mass, and Table 13 shows the sixth example of the pattern.

TrustManager [] trustAllCerts = new TrustManager [] {new X509TrustManager () {@Override public void checkServerTrusted (...) {throws IllegalArgumentException {}}}

DexMethodyBody : MethodName :: checkServerTrusted DexInstructionList :: {DexInstruction (VoidBody)}: Except (false)

The pattern in Table 13 can refer to a pattern that checks whether the method 'checkServerTrusted' is a void type. Since the method 'checkServerTrusted' is declared as void type in the instruction mass of Table 12, a message (for example, 'Body is void') may be provided to notify that the method 'checkServerTrusted' is of type void.

Table 14 below shows the seventh example of the instruction mass, and Table 15 shows the seventh example of the pattern.

TrustManager [] trustAllCerts = new TrustManager [] {new X509TrustManager () {@Override public void checkServerTrusted (...) {throws IllegalArgumentException {for (java.security.cert.X509Certificate c: chain) {if (c.getIssuerDN () .compareTo ("correct")! = 0) {throw new CertificateException ("None of the TrustManagers trust this certificate chain"); }}}}}}

DexMethodyBody : MethodName :: checkServerTrusted DexInstructionList :: {DexInstruction (InvokeInstruction (Ljava / security / cert / CertificateException, <init>), DexInstruction (Ljava / lang / IllegalArgumentException,

The pattern in Table 13 can refer to a method that calls the method 'Ljava / security / cert / CertificateException' in the method 'checkServerTrusted' and the instruction to call the method 'Ljava / lang / IllegalArgumentException'. With respect to the instruction mass in Table 14, it can be seen that there is an instruction to call the method 'Ljava / security / cert / CertificateException'. Thus, a message (eg, 'Invoke instruction isdetected, CertificateException -> <init>') may be provided to indicate that an instruction that calls the method 'Ljava / security / cert / CertificateException' has been detected.

As briefly described above, the patterns can be joined. For example, you can use the pattern 'DexFindApi' to find a specific class 'a', then use the pattern 'DexMethodyBody' to find the specific instruction in the method of class 'a'. For example, these two patterns can be joined and included in one rule.

Referring again to FIG. 12, the pattern of the thirteenth kind 1230 may refer to a pattern of finding a child class of a specific class, and may be expressed as pattern 13 below.

[Pattern 13]

DexFindSubClass :

: DexParent (require)

                  : ClassName (string)

Here, 'DexFindSubClass' can refer to a pattern name for finding a child class of a specific class. 'DexParent' can be a factor for specifying the parent class of the child class to be searched.

Table 16 below shows the eighth example of the instruction mass, and Table 17 shows the eighth example of the pattern.

Class cfindMe extend IamYourFather {} Class csearchMe extend IamYourFather {}

DexFindSubClass : DexParent :: ClassName (IamYourFather)

Table 17 can refer to a pattern for locating a child class that has the class 'IamYourFather' as its parent. With respect to the instruction mass of Table 16, class' cfindMe 'and class' csearchMe' can be detected respectively, because class' cfindMe 'and class' csearchMe' are child nodes of class' IamYourFather 'respectively and detected class' cfindMe &Quot; and a class &quot; csearchMe &quot; may be provided.

The joins between the patterns can be utilized in various ways. For example, the pattern 'DexFindSubClass' is used to find the child class 'b' having the class 'a' as a parent, and then the detected class 'b' is dynamically changed as 'ClassName (b)' in the pattern 'DexFindApi' It can be used as a parameter.

13 is a diagram showing an example of a pattern for a so file in an embodiment of the present invention. FIG. 13 shows the types of patterns 1400 for the so file 840. FIG.

The pattern of the 14th type 1310 may be a pattern for searching a string (specific string) in the so file 840, and may be expressed as pattern 14 below.

[Pattern 14]

RetrieveSoContents:

     : Character (string)

Here, the pattern 'RetrieveSoContents' may be a pattern name for retrieving a string in the so file 840, and' Character (string) 'may be a specific string (for example,' http: Quot; // * &quot;). At this time, the string can be retrieved from the '.rdata' section included in the so file 840.

The pattern of the fifteenth kind 1320 may be a pattern for searching the API in the so file 840 and may be expressed as pattern 15 below.

[Pattern 15]

RetrieveApiContents:

     : APIType (iat) Name (strcpy)

Here, the pattern 'RetrieveApiContents' may refer to a pattern name for retrieving the API in the so file 840, and 'APIType ()' indicates the type of the API as one of an Import Address Table (IAT) and an Export Address Table , And 'Name ()' may be a factor for specifying a name of an API to be searched.

14 is a diagram showing an example of a pattern for a dll file in an embodiment of the present invention. 14 shows the type of the pattern 1400 with respect to the dll file 850. Fig.

The pattern of the sixteenth kind 1410 may refer to a pattern for searching a string (specific string) in the dll file 850, and may be expressed as pattern 16 below.

[Pattern 16]

RetrieveDllContents:

     : Character (string)

Here, the pattern 'RetrieveDllContents' may refer to a pattern name for searching a string in the dll file 850, and' Character (string) 'refers to a specific string (for example,' http: Quot; // * &quot;).

The parameters in the pattern can be dynamically determined as described above. For example, the value extracted through the pattern a through the combination of the pattern a and the pattern b can be dynamically utilized as a parameter for the pattern b.

The patterns 1 to 16 described above are examples for the APK, and other patterns may be utilized for other package files. The vulnerability detection system can provide the administrator or user with an editor function to register such patterns or to edit registered patterns. For example, if a new vulnerability is known to an application, a new pattern can be registered through the editor function to detect a newly known vulnerability. The vulnerability detection system analyzes the package files of the application through a new pattern Vulnerabilities can be detected.

In another embodiment, the types of patterns may appear as shown in Table 18 below.

Type	Target of detection
find_api	dex
find_sub	dex
method_body	dex
method_annotation	dex
exist_api	dex
exist_field	dex
manifest	AndroidManifest.xml
xml	* .xml
dll	* .dll
so	* .so
find_file	All files

Of the patterns in Table 18, the pattern 'dex (find_api)' may correspond to the pattern 11 'DexFindApi' described above. This pattern 'dex (find_api)' can be a pattern for detecting calls to the specified api in a method.

In addition, the pattern 'dex (find_sub)' may correspond to the pattern 13 'DexFindSubClass' described above, and may be used to detect child classes inherited from the specified class.

Also, the pattern 'dex (method_body)' may correspond to the pattern 12 'DexMethodBody' described above, and may be used for comparing and detecting invoke instructions, instructions, method names, and the like in aptjem.

The pattern 'dex (method_annotation)' can also be used in Java to detect annotations specified in a method.

Also, the pattern 'dex (exist_api)' may be used to detect whether a particular class and / or method exists. For example, when a combination of patterns using logic operations to be described later is used, a pattern combination (dex (exist_api) sub dex (find_api)) is a pattern that is searched for a class found through 'dex (exist_api) You can search for api calls specified via the pattern 'dex (find_api)'.

Also, the pattern 'dex (exist_field)' can be used to search for the existence of a member of a specific class. For example, the pattern 'dex (exist_field)' can be searched for a member of the specified regular expression by specifying a regular expression to compare the value of the form 'class → member name' with the value of that member.

Also, the pattern 'manifest' can be used for comparison with the items in AndroidManifest.xml.

Also, the patterns 'xml', 'so', 'dll', and 'find_file' can be used to perform searches on xml files, so files, dll files, and all files. For example, an example of performing a search in a dll file is described in more detail in Pattern 16 (RetrieveDllContents).

In addition, the patterns may be combined using logical operations and parentheses. For example, Table 19 below shows examples of logic operations that can be used for combinations of patterns.

Type	Explanation	example
or	Ordinary logical operation or	true or true = true false or true = true
and	Of general logic operations	true and false = falsetrue and true = true
sub	When the left pattern is detected, the detection result is used as the pattern of the right pattern.	true and true = true false and true = false

For example, if pattern A is detected in (pattern A or pattern B), detection for pattern B may not be performed because it is already 'true'. In addition, if pattern A is 'false' (pattern A sub pattern B), detection for pattern B may not be performed. A more specific example of a combination of patterns using such logic operations is a pattern combination (dex (find_sub_class) sub dex (find_api)). In this pattern combination, the children of all activities are searched through the pattern 'dex (find_sub_class)' on the left, and the classes searched through the pattern on the left can be used as classes for the right pattern. In other words, the right pattern 'dex (find_api)' traverses the api in the classes found through the left pattern.

FIG. 15 is a block diagram illustrating an example of a component that a processor of a server according to an exemplary embodiment of the present invention may include; FIG. 16 is a diagram illustrating a vulnerability detection method Fig.

The vulnerability detection system according to embodiments of the present invention may be implemented in the form of a computer device such as the server 150 described above. 15, the processor 222 of the server 150 is a component for implementing a vulnerability detection system, and includes a detection pattern management unit 1510, a package file registration unit 1520, and a vulnerability information detection unit 1530, . &Lt; / RTI &gt; The components of the processor 222 and the processor 222 may perform the steps 1610 through 1630 of the vulnerability detection method of FIG. At this time, the components of the processor 222 and the processor 222 may be implemented to execute control instructions according to code of the operating system or code of at least one program that the memory 221 includes. Here, the components of processor 222 may be representations of different functions of processor 222 performed by processor 222 in accordance with the control instructions provided by the code stored in server 150 . For example, the detection pattern manager 1510 may be used as a functional representation of the processor 222 in which the processor 222 manages detection patterns in accordance with the control commands described above.

In step 1610, the detection pattern management unit 1510 determines whether or not a predetermined detection pattern for diagnosing the vulnerability of the application is detected in association with at least one of the files included in the package file for installation and operation of the application, Can be managed. It should be understood by those skilled in the art that the above detailed embodiments of the detection patterns have been described and that various embodiments can be derived according to the vulnerability.

At this time, the detection pattern management unit 1510 provides an editor function for registering a new detection pattern or editing a registered detection pattern in step 1610, and provides information on the registered or edited detection pattern through the provided editor function Stored and managed. The editor function can be provided to the administrator or user of the vulnerability detection system in the form of a specific web page or a specific application, for example. For example, an administrator terminal and a vulnerability detection system can communicate with each other through a specific application installed in an administrator's terminal, and information about a detection pattern registered or edited in a specific application can be transmitted to the vulnerability detection system through the network have. At this time, the detection pattern management unit 1510 can register a new detection pattern or update the edited detection pattern.

In the foregoing embodiments, it has been described that the parameters of the factors included in the patterns may be preset, but may be dynamically determined as necessary, and the detection patterns may be implemented in a more various ways as the parameters can be dynamically determined .

In step 1620, the package file registration unit 1520 may register a package file to be distributed to users for installation and operation of the application. The server 150 may be implemented in a form including a vulnerability detection system as described above. For example, the server 150 may be implemented as a combination of an application publisher system and a vulnerability detection system. At this time, the package file can be registered and received from the developer side for distributing to the users by the application publisher.

At this time, each file can be identified in the registered package file, and classes and methods can be identified. In addition, each of the methods may be classified in the form of an instruction mass based on a branch instruction (branch statement), and a call relationship between instruction masses and / or a call relation between methods may be stored in the form of a data structure such as a tree structure And managed. Information about this call relationship can be used to trace arguments, retrieve APIs, and so on.

In step 1630, the vulnerability information detection unit 1530 may analyze the registered package file according to at least one detection pattern among the detection patterns to detect vulnerability information according to at least one detection pattern. Detection of such vulnerability information has been described in detail in various embodiments above. At this time, the vulnerability information detection unit 1530 combines the plurality of detection patterns and dynamically changes the first information detected in the package file registered according to the first detection pattern to a parameter of the factor including the second detection pattern And detect the vulnerability information in the registered package file according to the second detection pattern including the fact that the detected first information is set as a parameter.

The detection pattern may include a pattern for retrieving a specific string from at least one of the files included in the registered package file. For example, Pattern 1, Pattern 14, and Pattern 16 described above describe a pattern for retrieving a specific string (or string) in a file. In particular, Pattern 1 explained that a registered package file includes a factor for designating a specific type of file to be included.

In addition, the detection pattern may include a pattern for searching at least one of a file of a specific type and a file of a specific file name among the files included in the registered package file. For example, pattern 2 described above describes a pattern for searching a file of a specified type and / or a file of a specified filename.

In addition, the detection pattern includes a pattern for searching for permission in the Android manifest file included in the APK (Android application package), a pattern for searching for activity, an SDK (Application Development Programming) API, At least one of a pattern for searching a version, a pattern for searching a main application, a pattern for searching for a service, a pattern for searching for a receiver, and a pattern for searching for a provider Pattern. &Lt; / RTI &gt; These patterns have been described in detail in Patterns 3 to 10.

The detection pattern may also include a pattern for retrieving an API called from at least one of a specified class and a specified method. At this time, the pattern for searching the called API includes a factor specifying at least one of a class and a method, a factor specifying at least one of an index and a type of the argument to track an argument of the specified method, A factor specifying at least one of an API, a field, and a null to detect an argument passed from at least one of an API specified for the argument, a specified field, and a null . These patterns are described in detail in Pattern 11.

The detection pattern may also include a pattern that retrieves the specified instruction from the specified method. At this time, the pattern for searching for a specific instruction may include a factor for specifying an instruction to be searched, a factor for specifying a type of an instruction to be searched, and a factor for specifying a class and a method to be searched by the instruction to be searched. have. These patterns are described in detail in Pattern 12.

In addition, the detection pattern may include a pattern for searching a child class of a designated class and / or a pattern for searching an API in at least one of the files included in the registered package file. These patterns have been described in detail through Patterns 13 and 15.

As described above, according to the embodiments of the present invention, a search pattern for diagnosing the vulnerability of an application is set in advance, and a vulnerability of a package file of an application registered for distribution based on a set detection pattern It can detect.

The system or apparatus described above may be implemented as a hardware component, a software component or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device As shown in FIG. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Such a recording medium may be a variety of recording means or storage means in the form of a single or a plurality of hardware combined and is not limited to a medium directly connected to any computer system but may be dispersed on a network. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI &gt; or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (19)

1. In a method for detecting an application vulnerability,

   Managing predetermined detection patterns for diagnosing a vulnerability of the application with respect to at least one of files included in a package file for installing and running an application and codes included in the files;

   Registering a package file for distribution to users for installation and operation of an application; And

   Analyzing the registered package file according to at least one detection pattern of the detection patterns and detecting the vulnerability information according to the at least one detection pattern

   The vulnerability detection method comprising the steps of:
2. The method according to claim 1,

   Wherein the managing of the predetermined detection patterns comprises:

   An editor function for registering a new detection pattern or editing a registered detection pattern, and storing and managing information about a detection pattern registered or edited through the provided editor function.
3. The method according to claim 1,

   The step of detecting vulnerability information for each of the at least one detection pattern comprises:

   The method comprising: combining a plurality of detection patterns to dynamically set first information detected in the registered package file according to a first detection pattern as a parameter of a factor including a second detection pattern; Detecting vulnerability information in the registered package file according to the second detection pattern including a factor set as a parameter.
4. The method according to claim 1,

   Wherein the detection pattern includes a pattern for searching for a specific character string from at least one file among the files included in the registered package file.
5. 5. The method of claim 4,

   Wherein the pattern for searching the specific character string includes a factor for specifying a specific type of file among the files included in the registered package file.
6. The method according to claim 1,

   Wherein the detection pattern includes a pattern for searching at least one of a file of a specified type and a file of a specified file name among the files included in the registered package file.
7. The method according to claim 1,

   The detection pattern includes a pattern for searching permission in an Android manifest file included in an APK (Android application package), a pattern for searching for an activity, a SDK (Software Development Kit) API (Application Programming Interface) version At least one of a pattern for searching a main application, a pattern for searching a main application, a pattern for searching for a service, a pattern for searching for a receiver, and a pattern for searching for a provider And detecting a vulnerability of the vulnerability.
8. The method according to claim 1,

   Wherein the detection pattern includes a pattern for searching an API called in at least one of a specified class and a specified method.
9. 9. The method of claim 8,

   Wherein the pattern for searching the called API includes a factor for specifying at least one of a class and a method.
10. 9. The method of claim 8,

    Wherein the pattern for searching the called API includes a factor for specifying at least one of an index and a type of the argument in order to track an argument of the specified method.
11. 9. The method of claim 8,

    Wherein the pattern for retrieving the called API includes at least one of an API, a field, and a null to detect an argument passed from at least one of an API specified for the argument of the specified method, The vulnerability detection method comprising the steps of:
12. The method according to claim 1,

    Wherein the detection pattern includes a pattern for searching for a specified instruction from a specified method.
13. 13. The method of claim 12,

    Wherein the pattern for searching for the specific instruction includes at least one of a factor designating an instruction to be searched, a factor specifying a type of instruction to be searched, a class called by an instruction to be searched, and a factor specifying a method Vulnerability detection method.
14. The method according to claim 1,

    Wherein the detection pattern includes a pattern for searching a child class of a designated class.
15. The method according to claim 1,

    Wherein the detection pattern includes a pattern for searching an API in at least one file among the files included in the registered package file.
16. A computer-readable recording medium having recorded thereon a computer program for causing a computer to execute the method of any one of claims 1 to 15.
17. A system for detecting an application vulnerability,

    At least one processor configured to execute computer readable instructions,

    Lt; / RTI &gt;

    Wherein the at least one processor comprises:

    Managing preset detection patterns for diagnosing a vulnerability of the application in association with at least one of files included in a package file for installing and running an application and codes included in the files,

    A package file to be distributed to users is registered for installing and running the application,

    And analyzing the registered package file according to at least one detection pattern of the detection patterns to detect vulnerability information for each of the at least one detection pattern

    A vulnerability detection system.
18. 18. The method of claim 17,

    Wherein the at least one processor is further configured to:

    Providing an editor function for registering a new detection pattern or editing a registered detection pattern, and storing and managing information about a detection pattern registered or edited through the provided editor function

    A vulnerability detection system.
19. 18. The method of claim 17,

    Wherein the at least one processor is configured to detect vulnerability information for each of the at least one detection pattern,

    The method comprising: combining a plurality of detection patterns to dynamically set first information detected in the registered package file according to a first detection pattern as a parameter of a factor including a second detection pattern; Detecting vulnerability information in the registered package file according to the second detection pattern including a factor set as a parameter

    A vulnerability detection system.

Images