WO2020192179A1

WO2020192179A1 - Security detection method, device and system based on ios application

Info

Publication number: WO2020192179A1
Application number: PCT/CN2019/123870
Authority: WO
Inventors: 汪德嘉; 邵根波; 钱潇龄; 孟啸龙
Original assignee: 江苏通付盾信息安全技术有限公司
Priority date: 2019-03-28
Filing date: 2019-12-09
Publication date: 2020-10-01
Also published as: CN110110521A

Abstract

Disclosed are a security detection method, device and system based on an iOS application. The method comprises: obtaining an application symbol table corresponding to a target application, matching an obtained type keyword corresponding to a preset detection type with the application symbol table, and determining a first evaluation result; sending a dynamic test instruction corresponding to a preset function to the target application, and determining a second evaluation result according to a test response result returned by the target application for the dynamic test instruction and at least two pre-configured expected response results corresponding to the dynamic test instruction; and determining whether the target application is secure according to the first evaluation result and the second evaluation result. According to the method, security detection is performed on two aspects of a static code and a dynamic running process of the target application, the first evaluation result aiming at the static code and the second evaluation result aiming at the dynamic running process are obtained, and comprehensive security determination is performed on the target application by integrating the first evaluation result and the second evaluation result.

Description

Safety detection method, device and system based on iOS application

Technical field

The invention relates to the technical field of computer software, in particular to a security detection method, device and system based on iOS applications.

Background technique

With the rapid development of network technology, the number of Internet users has increased exponentially, and the sales of smart phones have increased substantially. In the high-end market, the mobile terminal business of the iOS platform has a large market share. The design of mobile applications based on the iOS platform is becoming increasingly complex, the scale of development is growing, and the quality of applications is becoming more and more important. In particular, the number of payment-related applications is growing rapidly, and the security of payment-related applications is of paramount importance in the entire life cycle of the application.

However, the inventor found in the process of implementing the present invention that the unevenness of the application development technology of the iOS platform results in uneven application security levels. At the same time, due to the high level of self-protection of the iOS platform, and the market’s increasingly sophisticated attack technology for mobile applications on the iOS platform, the methods for jailbreaking iPhone devices are becoming easier and easier, and mobile applications on the iOS platform are increasingly threatened. Big. Therefore, it is required to conduct various security tests on iOS applications, and developers are required to perform various security protections on iOS applications. At this stage, there is a large gap in the security testing market for iOS applications.

It can be seen that there is currently no standard security detection tool for iOS platform applications, and the security detection of applications cannot be automated. At the same time, the detection of iOS applications is mostly static detection, that is, from the perspective of static code. The key string is compared, and the detection is not comprehensive. Therefore, mobile applications on the iOS platform cannot be fully tested for security before being put on the market, and developers cannot modify the functions of mobile applications in a targeted manner in advance, which will cause various problems in subsequent use and seriously harm users’ Use experience.

Summary of the invention

In view of the above problems, the present invention is proposed in order to provide a security detection method, device and system based on iOS applications that overcome the above problems or at least partially solve the above problems.

According to one aspect of the present invention, there is provided a security detection method for iOS applications, including:

Obtain the application symbol table corresponding to the target application, and match the obtained type keyword corresponding to the preset detection type with the application symbol table, according to the number of successfully matched target keywords and/or character weights, Determine the first evaluation result corresponding to the target application;

Send the dynamic test instruction corresponding to the preset function to the target application, and determine the corresponding test response result to the target application according to the test response result returned by the target application for the dynamic test instruction and the pre-configured at least two expected response results corresponding to the dynamic test instruction. The corresponding second evaluation result;

According to the first evaluation result and the second evaluation result, determine whether the target application is safe.

According to one aspect of the present invention, there is provided a security detection device for iOS applications, including:

The first evaluation result determination module obtains the application symbol table corresponding to the target application, and matches the obtained type keyword corresponding to the preset detection type with the application symbol table, and according to the target keywords that are successfully matched Quantity and/or character weight, determine the first evaluation result corresponding to the target application;

The second evaluation result determination module sends the dynamic test instruction corresponding to the preset function to the target application, and according to the test response result returned by the target application for the dynamic test instruction and at least two pre-configured expected responses corresponding to the dynamic test instruction As a result, the second evaluation result corresponding to the target application is determined;

The target application safety judgment module judges whether the target application is safe according to the first evaluation result and the second evaluation result.

According to another aspect of the present invention, there is provided a security detection system for iOS applications, including the above-mentioned security detection device.

According to another aspect of the present invention, there is provided an electronic device including: a processor, a memory, a communication interface, and a communication bus. The processor, the memory, and the communication interface communicate with each other through the communication bus;

The memory is used to store at least one executable instruction, and the executable instruction causes the processor to perform operations corresponding to the above-mentioned fault location method based on multi-level network nodes.

According to another aspect of the present invention, a computer storage medium is provided, and at least one executable instruction is stored in the storage medium. The executable instruction causes a processor to perform operations corresponding to the above-mentioned fault location method based on multi-level network nodes.

In a security detection method, device and system for iOS applications provided by the present invention, an application symbol table corresponding to the target application is acquired, and the acquired type keywords and application symbols corresponding to the preset detection types are obtained According to the number of successfully matched target keywords and/or character weight, the first evaluation result corresponding to the target application is determined; the dynamic test instruction corresponding to the preset function is sent to the target application. Determine the second evaluation result corresponding to the target application based on the test response result returned by the dynamic test instruction and the pre-configured at least two expected response results corresponding to the dynamic test instruction; judge according to the first evaluation result and the second evaluation result Whether the target application is safe, which can improve the accuracy of the evaluation results.

The above description is only an overview of the technical solution of the present invention. In order to understand the technical means of the present invention more clearly, it can be implemented in accordance with the content of the description, and in order to make the above and other objectives, features and advantages of the present invention more obvious and understandable. In the following, specific embodiments of the present invention are specifically cited.

Description of the drawings

By reading the detailed description of the preferred embodiments below, various other advantages and benefits will become clear to those of ordinary skill in the art. The drawings are only used for the purpose of illustrating the preferred embodiments, and are not considered as a limitation to the present invention. Also, throughout the drawings, the same reference symbols are used to denote the same components. In the attached picture:

Fig. 1 shows a flowchart of a security detection method for an iOS application according to the first embodiment;

FIG. 2 shows a flowchart of a security detection method for iOS applications according to the second embodiment;

FIG. 3 shows a structural diagram of an iOS application security detection device according to the third embodiment;

Fig. 4 shows a schematic structural diagram of an electronic device according to an embodiment of the present invention.

detailed description

Hereinafter, exemplary embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

Example one

Fig. 1 shows a flowchart of a method for security detection of a target application according to the first embodiment. As shown in Figure 1, the method includes the following steps:

Step S110: Obtain an application symbol table corresponding to the target application, and match the acquired type keyword corresponding to the preset detection type with the application symbol table, according to the number of successfully matched target keywords and/or The character weight determines the first evaluation result corresponding to the target application.

The execution subject of the present invention can be multiple, for example, it can be a security software client installed inside the mobile terminal where the target application is located, or a security test terminal or security test that can communicate with the mobile terminal where the target application is located. server. Among them, the target application is the application to be detected, and the application is an iOS application.

Specifically, in this step, the application file of the target application is obtained, the application file of the target application is decompiled to obtain the decompiled code, and various types of application symbol tables are extracted from the decompiled code. Wherein, the application symbol table specifically includes: a static symbol table, a dynamic symbol table, and/or a character table.

Get the preset keyword data table in the back-end database, traverse and query the preset keyword data table, get each detection type stored in the keyword data table and the type keyword corresponding to each detection type, and get The type keyword of is matched with the application symbol table. Among them, the preset keyword data table specifically includes: the mapping relationship between the detection type and the type keyword and the priority between the detection types. For example, when the detection type is a leak-proof type, the corresponding type keywords are NSLog, print, printf, write. Obtain the type keywords NSLog, print, printf, and write corresponding to the anti-leakage type stored in the keyword data table, and match the type keywords NSLog, print, printf, and write with the application symbol table.

If the type keyword appears in the application symbol table, the type keyword is extracted as the target keyword and stored in the type collection in the background database. Among them, a corresponding type set is set for each detection type, and each extracted target keyword is stored in a type set corresponding to the detection type of the target keyword. In specific implementation, the type set can be through the list, File, data package, type collection package and other methods are implemented. For example, the type keywords NSLog, print, printf, write corresponding to the leak detection type are obtained, and the type keywords NSLog, print, printf, write are matched with the application symbol table, and the application symbols are found in the type keywords NSLog and print In the table, the type keywords NSLog and print are stored in the type set corresponding to the anti-leak detection type in the background database. Among them, when the type keyword does not appear in the application symbol table, the type set is empty, and the number of type keywords in the type set is 0.

Determine the type evaluation score corresponding to the type set according to the number of target keywords contained in the type set and/or the character weight of the target keywords; according to the type evaluation score corresponding to each type set and the corresponding type set The type weight determines the first evaluation result score of the target application.

The first evaluation result of the target application is divided into 3 levels. When the first evaluation result score of the target application is between 0 and 3 (excluding 3 points), the first evaluation result of the target application is low; When the first evaluation result score of the target application is between 3 and 7 (excluding 7 points), the first evaluation result of the target application is medium; when the first evaluation result score of the target application is between 7 and 1, the target application The first evaluation result is high.

Step S120: Send the dynamic test instruction corresponding to the preset function to the target application, and determine the corresponding test response result according to the test response result returned by the target application for the dynamic test instruction and the pre-configured at least two expected response results corresponding to the dynamic test instruction. The second evaluation result corresponding to the target application.

Among them, the dynamic test instruction is used to configure the preset function of the target application to realize the test of the preset function. Specifically, the specific type and implementation mode of the dynamic test instruction can be flexibly set according to different types of preset functions. For example, the dynamic test instruction may be various instructions such as an anti-reverse test instruction. Correspondingly, the preset reverse test instruction table is obtained from the background database, and the types and/or types of anti-reverse test instructions corresponding to each anti-reverse function and each anti-reverse function stored in the preset reverse test instruction table are The priority between the various anti-reverse test instructions is to send each anti-reverse test instruction stored in the reverse test instruction table to the target application.

The test response result corresponding to each anti-reverse test instruction is obtained, and the test response result is stored in the test response set in the background database. Among them, the test response result specifically includes: the device where the target application is located makes a test response to the operation corresponding to each anti-reverse test instruction. The test response collection can be implemented in various ways such as lists, files, data packets, and test response collections. For example, during specific implementation, the anti-debugging operation corresponding to the anti-debugging and anti-reverse test instruction is executed, and the terminal command line of the device where the target application is located runs "debugserver*: 12349 -a application process number" command, and the device where the target application is located performs the anti-debugging operation Test response.

The expected response result corresponding to the anti-reverse test instruction is pre-stored in the background database, and at least two types of expected response results corresponding to the anti-reverse test instruction are queried. Among them, the corresponding expected response results are set for the anti-reverse test. For example, in specific implementation, when the preset anti-reverse function is the anti-debugging function, the pre-configured at least two expected response results corresponding to the anti-reverse test command include: anti-debugging used to indicate that the target application has the anti-debugging function Class expected response results, and non-anti-debugging expected response results used to indicate that the target application does not have anti-debugging capabilities.

The test response result is matched with at least two expected response results, and the second evaluation result corresponding to the target application is determined according to the matching result. For example, during specific implementation, the test response result is matched with the anti-debugging expected response result indicating that the target application has the anti-debugging function, and the non-anti-debugging expected response result indicating that the target application does not have the anti-debugging function. If the anti-debugging and anti-reverse test response result is an expected anti-debugging response result indicating that the target application has anti-debugging functions, and the target application has anti-debugging anti-reverse functions, the second evaluation result of the target application is high; The reverse test response result is an anti-debugging expected response result indicating that the target application does not have the anti-debugging function, and the second evaluation result of the target application is low.

Step S130: Judging the security level of the target application according to the first evaluation result and the second evaluation result.

Among them, the first evaluation result is used to reflect the static security of the application from the perspective of static testing, and the second evaluation result is used to reflect the dynamic security of the application from the perspective of dynamic testing. The specific connotations and acquisition methods of the first evaluation result and the second evaluation result can be flexibly configured by those skilled in the art. According to the combination of the first evaluation result and the second evaluation result, it is judged whether the target application is safe, and the safety of the application can be more comprehensively evaluated , The result is more accurate. For example, when the first evaluation result and the second evaluation result are both high, the security level of the target application is high; when one of the first evaluation result and the second evaluation result is low, the security level of the target application is low ; In other cases, the security level of the target application is medium.

It can be seen that the first evaluation result corresponding to the static test and the second evaluation result corresponding to the dynamic test in this embodiment can fully evaluate the safety of the application, avoid the drawbacks caused by the single-dimensional evaluation method, and make the evaluation result More accurate.

Example two

Fig. 2 shows a flowchart of a security detection method for iOS applications according to the second embodiment. This embodiment implements comprehensive security detection of the target application from two dimensions of static testing and dynamic testing. At present, the detection types of detection tools for iOS applications on the market are not comprehensive. They do not fully consider the security testing of the target application’s anti-reverse function, data protection level, and application operating environment security. At the same time, security testing is performed purely from the perspective of static code. The test results obtained are not accurate. Therefore, it is necessary to conduct anti-debugging, anti-hooking, anti-injection, data security protection, and security testing of all aspects of operating environment security from both static and dynamic dimensions.

As shown in Figure 2, the method includes the following steps:

Step S210: Obtain an application symbol table corresponding to the target application, so as to match the acquired type keyword corresponding to the preset detection type with the application symbol table.

Specifically, in this step, the application file of the target application is obtained, the application file of the target application is decompiled to obtain the decompiled code, and various types of application symbol tables are extracted from the decompiled code. Wherein, the application symbol table specifically includes: a static symbol table, a dynamic symbol table, and/or a character table. Get the preset keyword data table in the back-end database, traverse and query the preset keyword data table, get each detection type stored in the keyword data table and the type keyword corresponding to each detection type, and get The type keyword of is matched with the application symbol table. Among them, the preset keyword data table specifically includes: the mapping relationship between the detection type and the type keyword and the priority between the detection types.

In this embodiment, the preset detection type is at least one of the following ten types as an example for description:

(1) The first detection type is the leak-proof type:

Specifically, the anti-leakage type is used to detect whether the target application has the function of preventing log leakage. During the process of implementing the present invention, the inventor found that the NSLog, print, printf, and write keywords are used to detect whether the target application has the function of preventing log leakage. There are specific aspects. The keywords NSLog, print, printf, and write all have the meaning of printing logs. The more the NSLog, print, printf, and write keywords appear, the higher the risk of log leakage of the target application, and the worse the function of preventing log leakage of the target application. Therefore, the NSLog, print, printf, and write keywords are preset as type keywords corresponding to the leak-proof type.

(2) The second detection type is the sensitive word type:

Specifically, the sensitive word type is used to detect the function of preventing key information leakage of the target application. In the process of implementing the present invention, the inventor found that the keywords of encrypt, decrypt, login, password, title, and name are used to detect whether the target application is prevented. The functional aspects of key information leakage are targeted. The keywords encrypt, decrypt, login, password, title, and name represent the meanings of encryption, decryption, login, password, title, and name respectively. The more the keywords encrypt, decrypt, login, password, title, and name appear, the higher the risk of key information leakage of the target application and the worse the function of preventing key information leakage of the target application. Therefore, the keywords encrypt, decrypt, login, password, title, and name are preset as the type keywords corresponding to the sensitive word types.

(3) The third detection type is the code obfuscation type:

Specifically, the code obfuscation type is used to detect whether the application file of the target application has code obfuscation. During the process of implementing the present invention, the inventor found that the didFinishLaunchingWithOptions and viewDidLoad keywords are used to detect whether the application file of the target application has code obfuscation. The phenomenon is pertinent. The more the didFinishLaunchingWithOptions and viewDidLoad keywords appear, the greater the possibility of code confusion in the application files of the target application. Therefore, the didFinishLaunchingWithOptions and viewDidLoad keywords are preset as the type keywords corresponding to the code obfuscation type.

(4) The fourth detection type is the jailbreak detection type:

Specifically, the jailbreak detection type is used to detect whether the device where the target application is located is jailbroken. During the process of implementing the present invention, the inventor found that Applications/Cydia.app, /etc/ssh/sshd_config, /usr/libexec/ssh- keysign, /usr/sbin/sshd, /bin/sh, /bin/bash, /etc/apt, /Applications/Cydia.app, /Library/MobileSubstrate/MobileSubstrate.dylib keywords are used to detect whether the device where the target application is The escape situation is targeted. Applications/Cydia.app, /etc/ssh/sshd_config, /usr/libexec/ssh-keysign, /usr/sbin/sshd, /bin/sh, /bin/bash, /etc/apt, /Applications/Cydia.app The more the /Library/MobileSubstrate/MobileSubstrate.dylib keyword appears, the higher the possibility of jailbreaking the device where the target application is located. Therefore, set Applications/Cydia.app, /etc/ssh/sshd_config, /usr/libexec /ssh-keysign, /usr/sbin/sshd, /bin/sh, /bin/bash, /etc/apt, /Applications/Cydia.app, /Library/MobileSubstrate/MobileSubstrate.dylib keywords are preset to the jailbreak detection type The corresponding type keyword.

(5) The fifth detection type is the proxy detection type:

Specifically, the proxy detection type is used to detect whether there is a network proxy during the operation of the target application. In the process of implementing the present invention, the inventor found that the kCFProxyTypeNone keyword is useful in detecting whether there is a network proxy during the operation of the target application. Targeted. The presence of the kCFProxyTypeNone keyword indicates that the network proxy phenomenon is more likely to exist during the operation of the target application. Therefore, the kCFProxyTypeNone keyword is preset as the type keyword corresponding to the proxy detection type.

(6) The sixth detection type is the package protection type:

Specifically, the packaging protection type is used to detect whether the application file of the target application has secondary code packaging. In the process of implementing the present invention, the inventor found that CFBundleIdentifier, com.apple.developer.team-identifier, and application-identifier The keyword is pertinent in detecting whether the application file of the target application has secondary code packaging. The more the CFBundleIdentifier, com.apple.developer.team-identifier, and application-identifier keywords appear, the more likely it is that the target application will have secondary code packaging. Therefore, the CFBundleIdentifier, com.apple.developer.team-identifier, and application-identifier keywords are preset as the type keywords corresponding to the packaging protection type.

(7) The seventh detection type is string protection type:

Specifically, the string protection type is used to detect whether the target application has the phenomenon of string confusion. In the process of implementing the present invention, the inventor found that the keywords encrypt, decrypt, login, password, title, and name are used to detect whether the target application exists The phenomenon of string confusion is pertinent. The keywords encrypt, decrypt, login, password, title, and name represent the meanings of encryption, decryption, login, password, title, and name respectively. The more the keywords encrypt, decrypt, login, password, title, and name appear, the more likely the string is to be changed, and the greater the possibility of string confusion. Therefore, the keywords encrypt, decrypt, login, password, title, and name are preset as the type keywords corresponding to the string protection type.

(8) The eighth detection type is URL matching type:

Specifically, the URL matching type is used to detect the degree of protection of the network address of the device where the target application is located. During the process of implementing the present invention, the inventor found that the keywords http and https are specific in detecting the degree of protection of the network address of the device where the target application is located. . The more the http and https keywords appear, the lower the protection degree of the network address of the device where the target application is located. Therefore, the http and https keywords are preset as the type keywords corresponding to the URL matching type.

(9) The ninth detection type is anti-debugging type:

Specifically, the anti-debugging type is used to detect whether the target application has an anti-debugging function. In the process of implementing the present invention, the inventor found that the ptrace keyword is pertinent in detecting whether the target application has an anti-debugging function. The ptrace keyword appears, indicating that the target application's anti-debugging function is worse. Therefore, the ptrace keyword is preset as the type keyword corresponding to the anti-debugging type.

(10) The tenth detection type is the anti-hook type:

Specifically, the anti-hook type is used to detect whether the target application has an anti-hook function. During the process of implementing the present invention, the inventor found that the keywords libcycript.dylib, libReveal.dylib, and SnoopiTweak.dylib are used to detect whether the target application has an anti-hook function. There are specific aspects. The more the ibcycript.dylib, libReveal.dylib, and SnoopiTweak.dylib keywords appear, the worse the anti-hook function of the target application is. Therefore, libcycript.dylib, libReveal.dylib, SnoopiTweak.dylib keywords are preset as the type keywords corresponding to the anti-hook type.

Step S220: Match the acquired type keyword with the application symbol table.

Specifically, in this step, according to the priority between the detection types, each detection type and the type keyword corresponding to each detection type stored in the preset keyword data table are traversed, and the obtained type The keywords are matched with the application symbol table.

The detection types specifically include 10 detection types, and the priority between the detection types is preset among the 10 detection types. According to the pre-set priority between the detection types, the 10 detection types are arranged from high to low as leak prevention type, sensitive word type, code obfuscation type, jailbreak detection type, proxy detection type, package protection type, string protection Type, URL matching type, anti-debugging type, and/or anti-hooking type. For example, in specific implementation, according to the priority between the detection types, traverse and query the anti-leak detection type stored in the preset keyword data table and the type keywords corresponding to the anti-leak detection type NSLog, print, printf, write , And match the obtained type keywords NSLog, print, printf, write with the application symbol table.

Further, in order to achieve accurate comparison between the type keyword and the application symbol table, and to improve the comparison speed between the type keyword and the application symbol table, for the type keyword to be matched, determine the detection type corresponding to the type keyword. Match the type detection area, extract the target area corresponding to the type detection area from the application symbol table, and match the obtained type keyword with the target area. For example, when the detection type is a sensitive word detection type, for the acquired type keywords encrypt, decrypt, login, password, title, and name, determine the type detection area that matches the detection type corresponding to the type of keyword. Specifically, the type detection area corresponding to the sensitive word detection type includes: a type detection area containing a class name and/or a type detection area containing a method name. According to the determined type detection area containing the class name and/or the type detection area containing the method name, the target area corresponding to the type detection area is extracted from the application symbol table, and the obtained type keyword is matched with the target area.

Step S230: Extract the successfully matched type keywords as target keywords.

Specifically, in this step, the obtained type keyword is matched with the application symbol table. If the type keyword appears in the application symbol table, the type keyword is extracted as the target keyword and stored in the background database In the collection of types. Among them, a corresponding type set is set for each detection type, and each extracted target keyword is stored in a type set corresponding to the detection type of the target keyword. In specific implementation, the type set can be through the list, File, data package, type collection package and other methods are implemented. For example, during specific implementation, the type keywords NSLog, print, printf, and write corresponding to the leak detection type are obtained, and the type keywords NSLog, print, printf, and write are matched with the application symbol table, and the type keywords NSLog, If print appears in the application symbol table, the type keywords NSLog and print are stored in the type set corresponding to the leak detection type in the background database. Among them, when the type keyword does not appear in the application symbol table, the type set is empty, and the number of type keywords in the type set is 0.

Further, in order to ensure the priority detection of important types of detection types, the detection processes for multiple different types can be executed in sequence according to the priority order of each type. For example, according to the priority of the detection type, the next detection type of the anti-leak detection type in the preset keyword data table is the sensitive word detection type. Get the type keyword of the sensitive word detection type in the preset keyword data table, match the obtained type keyword with the application symbol table, extract the successfully matched type keyword as the target keyword, and set the target key The words are stored in the type set corresponding to the sensitive word detection type in the background. Perform the above operations in sequence for code obfuscation type, jailbreak detection type, proxy detection type, packaging protection type, string protection type, URL matching type, anti-debugging type, and anti-hook type.

In addition, in order to improve the detection efficiency, in other embodiments of the present invention, each detection type can also execute the above-mentioned various types of detection processes simultaneously through multiple parallel execution threads. The specific implementation of the multiple types of detection processes in the present invention The order is not limited.

Step S240: Determine the first evaluation result corresponding to the target application according to the number of target keywords and/or character weights that are successfully matched.

Specifically, in this step, the type evaluation score corresponding to the type set is determined according to the number of target keywords contained in the type set and/or the character weight of the target keywords; according to the type corresponding to each type set The evaluation score and the type weight corresponding to each type set determine the first evaluation result score of the target application. During specific implementation, first, the type evaluation score corresponding to the type set is determined according to the number of target keywords contained in the type set and/or the character weight of the target keywords. For example, in a specific implementation, the type evaluation score of any one of the 10 detection types is a total of 10 points. When any keyword corresponding to a certain detection type is detected, 1 point is deducted from the type evaluation score, and the upper limit of deduction is 10 points. Take the leak prevention type as an example, the type keywords corresponding to the leak prevention type are NSLog, print, printf, write, and accordingly, the target keywords contained in the type set corresponding to the leak prevention type are NSLog, print, these two Each target keyword appears once. Among them, the target keyword refers to the keyword that successfully matches the type keyword. When calculating the type evaluation score corresponding to the type set, the calculation is performed according to the number of target keywords. When any keyword corresponding to a certain detection type is detected, 1 point is deducted from the type evaluation score, and the type evaluation score corresponding to the anti-leakage type is 8 points.

Then, after determining the type evaluation score corresponding to each type set, the security evaluation score of the target application is determined according to the type evaluation score corresponding to each type set and the type weight corresponding to each type set. For example, according to the importance of the detection type, the anti-leakage type, sensitive word type, code obfuscation type, jailbreak detection type, proxy detection type, packaging protection type, string protection type, URL matching type, anti-debugging type, anti-hook type The type weight distribution corresponding to the 10 type sets is 0.1, 0.1, 0.1, 0.15, 0.05, 0.1, 0.1, 0.15, 0.05, 0.1. Anti-leakage type, sensitive word type, code obfuscation type, jailbreak detection type, proxy detection type, packaging protection type, string protection type, URL matching type, anti-debugging type, and anti-hook type. The type evaluation scores of the 10 types are respectively 4, 5, 3, 6, 7, 4, 5, 3, 6, 7. When calculating the safety evaluation score of the target application, it is calculated based on the type evaluation score and the type weight. The safety evaluation score of the target application is 0.1*4+0.1*5+0.1*3+0.15*6+0.05*7+0.1*4+0.1*5+0.15*3+0.05*6+0.1*7=4.8.

The total score of the first evaluation result of the target application is 10 points. The higher the first evaluation result score of the target application, the better the first evaluation result of the target application. The first evaluation result of the target application is divided into 3 levels. When the first evaluation result score of the target application is between 0 and 3 (excluding 3 points), the first evaluation result of the target application is low; When the first evaluation result score of the target application is between 3 and 7 (excluding 7 points), the first evaluation result of the target application is medium; when the first evaluation result score of the target application is between 7 and 1, the target application The first evaluation result is high.

Step S250: Send a dynamic test instruction corresponding to the preset function to the target application.

Wherein, the preset function in this embodiment includes an anti-reverse function, and the dynamic test instruction includes an anti-reverse test instruction. Accordingly, an anti-reverse test instruction corresponding to the preset anti-reverse function is sent to the target application. In specific implementation, the preset reverse test instruction table is obtained from the back-end database, and the types and types of anti-reverse test instructions corresponding to each anti-reverse function are stored in the preset reverse test instruction table. / Or the priority between each anti-reverse test instruction, send each anti-reverse test instruction stored in the reverse test instruction table to the target application. Among them, the anti-reverse function specifically includes: anti-debugging function, anti-hook function, and anti-injection function. The reverse test instruction table specifically includes: the mapping relationship between the anti-reverse function and the anti-reverse test command, and the priority between the anti-reverse function and the anti-reverse function. Priority between test instructions. For example, during specific implementation, the anti-reverse functions stored in the reverse test instruction table are sorted from high to low in order of the anti-reverse function priority as anti-debugging function, anti-hook function, and anti-injection function. Obtain the anti-debugging anti-reverse function and the anti-debugging anti-reverse test command corresponding to the anti-debugging anti-reverse function according to the priority of the anti-reverse function, and send the anti-debugging anti-reverse test instruction to the target application. Of course, setting the priority of the anti-reverse function stored in the reverse test instruction table is an optional operation. In specific implementation, the anti-reverse function stored in the reverse test instruction table may not set the priority, that is, the priority of each function They are equal, and accordingly, the anti-debugging function, anti-hook function, and anti-injection function are implemented in parallel.

Further, in order to ensure that the anti-reverse test instructions corresponding to the important anti-reverse functions are sent preferentially, the anti-reverse test instruction sending process corresponding to multiple different types of anti-reverse functions can be executed in sequence according to the priority order of each type. For example, in specific implementation, after sending the anti-debugging anti-reverse test command corresponding to the anti-debugging anti-reverse function to the target application, the anti-reverse function and the anti-reverse function of the anti-hook anti-reverse function are obtained according to the preset priority of the anti-reverse function The corresponding anti-hook anti-reverse test instruction, and the anti-hook anti-reverse test instruction is sent to the target application.

In addition, in order to improve the detection efficiency, in other embodiments of the present invention, each anti-reverse function detection can also simultaneously execute the above-mentioned various anti-reverse function detection processes through multiple parallel execution threads. The specific execution order is not limited.

Further, in order to achieve communication with the target application, the second terminal device wirelessly connected to the first terminal device where the target application is installed is sent to the target application an anti-reverse test instruction corresponding to the preset anti-reverse function; One terminal device and the second terminal device are in the same wireless network. In the specific implementation, the Mac computer device and the iPhone mobile phone device are connected to the same wireless device to make them in the same network segment. The Mac computer device uses ssh to automatically log in to the iPhone mobile device to realize the wireless connection of the Mac computer device to the iPhone mobile device. The device sends an anti-reverse test instruction corresponding to the preset anti-reverse function to the target application on the iPhone mobile device.

Step S260: Determine a second evaluation result corresponding to the target application according to the test response result returned by the target application for the dynamic test instruction and at least two pre-configured expected response results corresponding to the dynamic test instruction.

Specifically, this step includes at least one of the following three implementation manners:

Method 1: In the first implementation of this step, directly based on the test response result returned by the target application for the dynamic test instruction and at least two pre-configured expected response results corresponding to the dynamic test instruction, determine the corresponding The corresponding second evaluation result.

This implementation mode performs security detection on the target application from the perspective of anti-reverse of the target application. At present, debugging of application source code, intercepting application running process, and injecting dynamic libraries are serious. The application of anti-reverse function detection can evaluate the strength of application anti-reverse function and find defects in application anti-reverse function early.

Specifically, the test response result corresponding to each anti-reverse test instruction is obtained, and the test response result is stored in the test response set in the background database. Among them, the test response result specifically includes: the device where the target application is located makes a test response to the operation corresponding to each anti-reverse test instruction. The test response collection can be implemented in various ways such as lists, files, data packets, and test response collections. For example, during specific implementation, the target application receives an anti-debugging anti-reverse test instruction, an anti-hook anti-reverse test instruction, an anti-injection anti-reverse test instruction, and the target application receives an anti-debug anti-reverse test instruction, an anti-hook anti-reverse test instruction, and anti-injection The priority of the anti-reverse test command, the anti-debug operation corresponding to the anti-debug anti-reverse test command is executed first. Run the "debugserver*:12349 -a application process number" command on the terminal command line of the device where the target application is located. The anti-debugging operation makes a test response. According to the priority of the anti-reverse test instruction, the target application executes the anti-hook operation corresponding to the anti-reverse test instruction, and runs the "cycript -p application process number" command on the terminal command line of the device where the target application is located. The device where the target application is located realizes a test response to the anti-hook operation. According to the priority of the anti-reverse test instruction, the target application executes the anti-injection operation corresponding to the anti-reverse test instruction, and run "optool install -c load -p "application dynamic library" -t application in the terminal view of the device where the target application is located Binary file" command. The device where the target application is located realizes the test response to the reverse injection operation.

The expected response results respectively set for the anti-reverse test are pre-stored in the background database, and at least two types of expected response results corresponding to the anti-reverse test instructions are queried. Wherein, when the preset anti-reverse function is the anti-debugging function, the pre-configured at least two expected response results corresponding to the anti-reverse test command include: anti-debugging expected response results used to indicate that the target application has the anti-debugging function , And a non-anti-debugging expected response result used to indicate that the target application does not have the anti-debugging function. Among them, the anti-debugging expected response result includes a preset anti-debugging target field. For example, the preset anti-debugging target field is Segmentation fault: 11. During specific implementation, execute the anti-debugging operation corresponding to the anti-debugging and anti-reverse test command, and run the "debugserver*:12349 -a application process number" command on the terminal command line of the device where the target application is located. If Segmentation fault: 11 appears in the returned message, It means that the target application has anti-debugging anti-reverse function; if Segmentation fault: 11 does not appear in the returned information, it means that the target application has anti-debugging anti-reverse function.

When the preset anti-reverse function is the anti-hook function, the pre-configured at least two expected response results corresponding to the anti-reverse test command include: the anti-hook class expected response result used to indicate that the target application has the anti-hook function, and It is used to indicate the expected response result of the non-anti-hook class that the target application does not have the anti-hook function. Among them, the anti-hook class expected response result contains a preset anti-hook target field. For example, the preset anti-debugging target field is error. In specific implementation, execute the anti-hook operation corresponding to the anti-hook anti-reverse test instruction, and run the "cycript –p application process number" command on the terminal command line of the device where the target application is located. If an error appears in the return message, it means that the target application has a reverse The anti-reverse function of the hook; if there is no error in the returned information, it means that the target application has the anti-reverse function of the anti-hook.

When the preset anti-reverse function is the back-injection function, the pre-configured at least two expected response results corresponding to the anti-reverse test command include: the anti-injection type expected response result used to indicate that the target application has the anti-injection function, and Non-anti-injection expected response results used to indicate that the target application does not have the anti-injection function. Among them, the expected response result of the back injection type includes: the response result of the flashback type. For example, during specific implementation, run "optool install -c load-p"application dynamic library" -t application binary file" command, and then compress the target application and install it. If a response result of the crash type appears, the target application It has the anti-reverse function of back injection; if there is no response result of the flashback type, it means that the target application has the anti-reverse function of back injection.

Match the test response results with at least two expected response results. For example, during specific implementation, the expected response results corresponding to the anti-debugging and anti-reverse function test specifically include the anti-debugging expected response results used to indicate that the target application has anti-debugging functions, and the non-reverse anti-debugging results used to indicate that the target application does not have anti-debugging functions. The expected response result of the debugging class. The test response result is matched with the anti-debugging expected response result used to indicate that the target application has the anti-debugging function, and the non-anti-debugging expected response result used to indicate that the target application does not have the anti-debugging function. If the anti-debugging and anti-reverse test response result is an expected anti-debugging response result indicating that the target application has an anti-debugging function, the target application has anti-debugging anti-reverse function; if the anti-debugging and anti-reverse test response result indicates that the target application does not have anti-reverse function If the anti-debugging type of the debugging function expects the response result, the target application does not have the anti-debugging anti-reverse function.

Determine the strength of the anti-reverse function of the target application according to the matching situation of the three anti-reverse function test response results. Set the anti-reverse function score, and determine whether the target application has the anti-reverse function according to the anti-reverse function score. Among them, different anti-reverse function scores are set for different anti-reverse functions. In specific implementation, if the target application has anti-debugging and anti-reverse functions, the anti-debugging and anti-reverse function scores are 1. If the target application does not have anti-debugging and anti-reverse functions , The score of anti-debugging and anti-reverse function is 0. If the target application has the anti-hook anti-reverse function, the anti-reverse function score of the anti-hook anti-reverse function is 1, and if the target application does not have the anti-hook anti-reverse function, the anti-reverse function score is 0. If the target application has a back-injection and anti-reverse function, the score of the back-injection and anti-reverse function is 1, and if the target application does not have the back-injection and anti-reverse function, the score is 0. The second evaluation result score of the target application is the sum of the anti-debugging and anti-reverse function score, the anti-hook anti-reverse function score, and the anti-injection anti-reverse function score.

The second evaluation result is evaluated according to the second evaluation result score. If the second evaluation result score is 0, the anti-reverse security level of the target application is low, and the second evaluation result is low; if the second evaluation result score is 1, the target application If the second evaluation result score is 2, the anti-reverse security level of the target application is medium-high, and the second evaluation result is medium-high; if the second evaluation result is 3, Then the anti-reverse level of the target application is high, and the second evaluation result is high.

Further, in order to improve the efficiency of anti-reverse function detection, the anti-reverse test instruction corresponding to one anti-reverse function is divided into multiple anti-reverse test instructions according to key fields. The number of anti-reverse test commands corresponding to one anti-reverse function is multiple, and the priority is preset among multiple anti-reverse test commands corresponding to one anti-reverse function. For example, the anti-reverse test instructions corresponding to the anti-debug and anti-reverse function are divided into anti-debug anti-reverse test instructions 1, anti-debug anti-reverse test instructions 2, and anti-debug anti-reverse test instructions 3 according to key fields. Arrange the anti-debugging and anti-reverse test instructions into anti-debugging and anti-reverse test instructions 1, anti-debugging and anti-reverse test instructions 2, and anti-debugging and anti-reverse test instructions 3 according to the preset priority from high to low. During specific implementation, the device where the target application is located sequentially executes the commands corresponding to the anti-debugging and anti-reverse test instructions 1, the anti-debugging and anti-reverse test instructions 2, and the anti-debugging and anti-reverse test instructions 3.

Through the above steps, obtain the program startup page of the target application in the application runtime environment, and compare the program startup page with the preset environment startup page to determine whether the target application starts normally in the application runtime environment, so as to achieve the target Security detection of application operating environment. For ease of understanding, the following takes a specific example as an example to introduce in detail the specific implementation of the above method in this manner:

Step 1: Mac computer equipment integrates ideviceinstaller (device installation) tool to allow Mac computer equipment to connect to iPhone mobile device remotely, enabling Mac computer equipment to manage iPhone mobile device.

Specifically, the Mac computer device integrates the ideviceinstaller tool to realize remote connection to the iPhone mobile device, and manage and operate the iOS application on the iPhone mobile device. Enter the "ideviceinstaller -i xxx.ipa" command in the terminal of the Mac computer device and run it, where "xxx.ipa" is the IPA (Apple Program Application File) file name of the target application.

Step 2: The remotely connected iPhone device integrates the frida environment, so that it can call the application program inside the iPhone.

Specifically, enter the "python xxx.py bundleId" command on the terminal of the Mac computer device and run it, where "xxx" is the name of the target application. The remotely connected iPhone device starts automatically.

Step 3: Compare the home page of the application after startup and the home page when the application is normally opened. If the home page is the same, the application starts normally in the operating environment; if the application crashes or fails to load, the application starts in the operating environment unusual.

Step 4: Use the ideviceinstaller tool to uninstall the installed applications.

Specifically, enter and run the "ideviceinstaller-U bundleId" command in the terminal of the Mac computer device, where "xxx" is the name of the target application. The remotely connected iPhone device is automatically uninstalled.

In summary, in this method, the target application on the iPhone device side can be automatically installed, started, and uninstalled without manual installation, startup, and uninstallation. It gets rid of the traditional security detection method, realizes automatic security detection, and can more quickly Realize security detection in various operating environments, greatly improving the efficiency of security detection, and meet the increasing demand for iOS security detection.

Method 2: In the second implementation of this step, decompile the obtained binary file of the target application to obtain the decompiled code corresponding to the target application obtained after decompilation; extract the decompiled code The included target code corresponding to the preset target area is determined, whether the target code contains content that matches the preset obfuscated identifier, and the second evaluation result corresponding to the target application is determined based on the determination result.

The implementation manner determines the second evaluation result corresponding to the target application according to the combination of the two types of judgment results, the anti-reverse security level of the target application and the data security level of the target application.

This implementation mode performs security detection on the target application from the data security perspective of the target application. At present, in view of the serious tampering of the application program code and program characters, the data protection safety inspection of the target application can detect the defects of the target application data protection function as soon as possible.

Specifically, a decompilation tool is used to decompile the obtained binary file of the target application. Among them, the decompilation tool specifically includes: a first decompilation tool and a second decompilation tool. During specific implementation, the obtained binary file of the target application is decompiled through the first decompilation tool to obtain the first decompiled code; and/or the obtained binary file of the target application is obtained through the second decompilation tool Perform decompilation to obtain the second decompiled code. The first decompilation tool and the second decompilation tool can be used at the same time, or one of them can be used. For example, the first decompilation tool is MachOView decompilation tool; the second decompilation tool is Hopper Disassembler decompilation tool.

Different types of decompiled codes are preset with priorities, and the decompiled codes are obtained according to the priority of the decompiled codes. For example, the first decompiled code is better than the second decompiled code, where the first decompiled code is the MachOView decompiled code, and the second decompiled code is the Hopper Disassembler decompiled code. During the specific implementation, the MachOView decompiled code is given priority.

The decompiled code specifically includes: a first decompiled code and a second decompiled code; the target code corresponding to the preset target area contained in the first decompiled code includes: dynamic library information and/or header files Information; the target code corresponding to the preset target area contained in the second decompiled code includes: a preset function and/or a preset character. Among them, the first decompiled code is MachOView decompiled code, and the second decompiled code is Hopper Disassembler decompiled code.

During specific implementation, the dynamic library information and/or header file information is set for the first reverse compiled code, the first reverse compiled code and dynamic library information and/or header file information are obtained from the background database, and the dynamic library information and/or Or compare the header file information with the first decompiled code, extract the object code containing dynamic library information and/or header file information in the decompiled code, and store the object code containing dynamic library information and/or header file information In the background database. For example, the first decompiled code is MachOView decompiled code. The MachOView decompilation tool analyzes the structure of the target application, and can see the dynamic library information and header file information in the target application binary file. Set dynamic library information and/or header file information for MachOView decompiled code, obtain MachOView decompiled code and dynamic library information and/or header file information from the background database, and combine dynamic library information and/or header file information with MachOView Reverse compiled code comparison, extract the object code containing dynamic library information and/or header file information in the reverse compiled code, and store the object code containing dynamic library information and/or header file information in the backend database. And/or set a preset function and/or preset character for the second decompiled code, obtain the second decompiled code and preset function and/or preset character from the background database, and set the preset function and/or The preset character is compared with the second decompiled code, the decompiled code contains the object code of the preset function and/or the preset character, and the object code containing the preset function and/or the preset character is stored in In the background database. For example, the second decompiled code is Hopper Disassembler decompiled code. The Hopper Disassembler decompilation tool can see the functions and characters in the target application binary file and the logic code in the method. Set preset functions and/or preset characters for Hopper Disassembler reverse compiled code. During specific implementation, obtain the decompiled code and preset function and/or preset character corresponding to the Hopper Disassembler decompilation tool from the backend database, and compare the preset function and/or preset character with the decompiled code , Extract the target code containing the preset function and/or preset character in the reverse compiled code, and store the target code containing the preset function and/or preset character in the background database.

Match the first decompiled code with the preset obfuscated identifier, and determine whether the target code corresponding to the preset target area contained in the first decompiled code contains content that matches the preset obfuscated identifier , Obtain the first judgment result; match the second decompiled code with the preset obfuscated identifier, and judge whether the target code corresponding to the preset target area contained in the second decompiled code contains the preset The content matched by the identifier is confused, and the second judgment result is obtained. Among them, the first decompiled code is MachOView decompiled code, and the second decompiled code is Hopper Disassembler decompiled code. For example, in specific implementation, put the binary file of the target application into the MachOView decompilation tool, check the Objc CFStrings character table, and match the decompiled code corresponding to the Objc CFStrings character table with the preset obfuscated identifier. If Objc CFStrings characters If the decompiled code of the table is displayed as an identifier, it means that the program characters of the target application are confused. If the decompiled code of the Objc CFStrings character table normally displays the character string of the target application, it means that the program characters of the target application are not confused. And/or during specific implementation, put the binary file of the target application into the Hopper Disassembler v4 decompilation tool, randomly select a method function, and match the decompiled code corresponding to the method function with the preset obfuscation identifier. If the method function If garbled codes appear in the decompiled code of the method, it means that the program code of the target application has been obfuscated. If there are no garbled codes in the decompiled code of the method function, it means that the program code of the target application is not obfuscated.

Pre-set the weights of the first judgment result and the second judgment result according to the importance of the first judgment result and the second judgment result, and calculate the weight according to the first judgment result and the second judgment result and the weight of the first judgment result and the second judgment result The data protection security score of the target application. For example, in specific implementation, if the first judgment result is that the first decompiled code contains the preset obfuscated identifier, the first judgment result is recorded as 0, and if the first judgment result is that the first decompiled code If the preset obfuscated identifier is not included, the first judgment result is recorded as 1; if the second judgment result is that the second decompiled code contains the preset obfuscated identifier, the second judgment result is recorded as 0, If the second judgment result is that the second decompiled code does not contain the preset obfuscated identifier, the second judgment result is recorded as 1. Specifically in this example, weights are assigned to the first judgment result and the second judgment result respectively. The weight of the first judgment result is 0.5, the weight of the second judgment result is 0.5, the first judgment result is 0, and the second judgment result is 1. The data protection security score of the target application is 0*0.5+1*0.5=0.5.

Specifically, the data protection security level of the target application is divided into four levels. If the data protection security score of the target application is 0, the data protection security level of the target application is low; if the data protection security score of the target application is 1, The data protection security level of the target application is high; if the data protection security score of the target application is 0-0.5 (excluding 0 and 0.5), the data protection security level of the target application is medium-low; if the data protection security score of the target application If it is 0.5 to 1 (not including 1), the data protection security level of the target application is medium to high. Specifically in this example, the data protection security score of the target application is 0.5, and the data protection security level of the target application is medium to high.

Optionally, in this step, different types of decompiled codes are preset with priority, and the target code of the decompiled code is obtained according to the priority of the decompiled code.

Further, in order to select the target code including logical operators, use the decompilation tool to the greatest extent to obtain each method function contained in the decompiled code, and extract the method function containing the logical operator from each method function as the target function. The code corresponding to the target function is determined to be the target code corresponding to the preset target area.

Comprehensively consider the anti-reverse security level of the target application in mode one and the data protection security level in mode two. When the anti-reverse security level and data protection security level are both high, the second evaluation result of the target application is high; anti-reverse When one of the security level and the data protection security level is low, the second evaluation result of the target application is low; in other cases, the second evaluation result of the target application is medium.

Method 3: In the third implementation method of this step, when a startup instruction corresponding to the target application is detected, the application operating environment corresponding to the target application is determined according to the startup instruction; the target application is obtained to start in the application operating environment After the program startup page is displayed; query the preset environment startup page associated with the application operating environment corresponding to the target application; determine whether the program startup page matches the environment startup page, and determine the second corresponding to the target application based on the judgment result Evaluation results.

The implementation manner determines the second evaluation result corresponding to the target application according to the combination of the two types of judgment results, the anti-reverse security level of the target application and the application operating environment security of the target application. This implementation mode performs security detection on the target application from the perspective of the operating environment of the target application. Since iOS applications can run on a variety of different iOS systems and different iPhone devices, but the iOS system version of iOS applications and different iPhone device models are updated quickly, it is necessary to ensure that iOS applications can run normally in various operating environments.

Specifically, the startup instruction sent by the target application is received, the environment field contained in the startup instruction contains the current operating environment of the target application, the startup instruction is parsed, the environment field in the startup instruction is extracted, and the environment included in the startup instruction is The field determines the application operating environment corresponding to the target application. For example, the target application A is launched in the iOS system C of the iPhone device B. During the specific implementation, the startup instruction is received and the startup instruction is analyzed. The environment field in the parsed startup instruction includes the iPhone device model and the iOS system Category keywords, directly read the iPhone device model and iOS system category keywords and the iPhone device model and iOS system category information under the keyword list.

Specifically, the startup instruction sent by the target application is received, and the startup instruction is analyzed. According to the parsed instruction format of the startup instruction and/or the instruction rule corresponding to the instruction, the application operating environment corresponding to the target application is determined. For example, the structure of the parsed instruction format of the startup instruction includes a first part and a second part. The first part represents the iPhone device model in the application running environment, and the second part represents the iOS system version in the application running environment. The iPhone device model is indicated by different device identification codes, and the iOS system version is indicated by different version identification codes. The startup instruction is analyzed, the identification codes of the first part and the second part are obtained from the analysis instruction, and the iPhone device model and iOS system version category corresponding to the identification code are determined according to the instruction rules. Among them, the instruction rules specifically include: the mapping relationship between the iPhone device model and the model identification code, and the mapping relationship between the iOS system version and the version identification code.

After the target application is launched in the current operating environment, the program launch page will be displayed after a preset time. Specifically, in this step, the program startup page displayed after a preset time after the target application is started in the application execution environment is acquired.

Obtain the program startup page displayed after the target application is started in the application running environment, retrieve the startup environment matching table from the background database, and query the startup environment matching table for the environment startup page of the application running environment corresponding to the target application. Among them, the startup environment matching table specifically includes: the mapping relationship between the target application, the application running environment, and the environment startup page.

The program startup page that is displayed after the target application is started in the application operating environment sent by the target application is acquired, and the environment startup page associated with the application operating environment corresponding to the target application is queried from the startup environment matching table. Compare the program startup page with the environment startup page to determine the difference between the program startup page and the environment startup page. If there is no difference between the program startup page and the environment startup page, that is, the two match, the target application is safe in the running environment; if there is a difference between the program startup page and the environment startup page, the two do not match , The target application is not safe in the operating environment.

Further, in order to evaluate the operating environment security of the target application when running the preset function, obtain the program function page displayed after the target application runs the preset function in the application operating environment; query the preset application operating environment corresponding to the target application Associated environment function page; judge whether the program function page matches the environment function page, and determine whether the target application is safe in the preset operating environment according to the judgment result.

Among them, the environment function page specifically includes: for each type of application operating environment, obtain the corresponding operating interface when the target application runs the preset function in this type of application operating environment and the operating result is successful, and will obtain The running interface is stored in a preset function environment matching table as an environment function page associated with this type of application running environment. The function environment matching table specifically includes: target application, application running environment, preset function, and environment function page The four mapping relationships and the priority of the preset functions corresponding to each environmental function page.

Specifically, in this step, according to the priority of the preset function corresponding to each environmental function page stored in the preset environment matching table, the target application is obtained after running various types of preset functions in the application running environment. The program function page displayed, obtains the environment function page associated with the target application, application operating environment and preset functions from the function environment matching table, overlaps the program function page with the environment function page, and compares the program function page with the environment function The difference between the two pages. If there is no difference between the program function page and the environmental function page, the target application has preset function operation safety in the operating environment, and the operating environment security level of the target application preset function is high; if the program function page and the environmental function page There is a difference between the two, the target application is not safe to operate in the operating environment, and the operating environment of the target application has a low security level.

Comprehensively consider the anti-reverse security level of the target application in mode one and the operating environment security level in mode three. When the anti-reverse security level and the operating environment security level are both high, the second evaluation result of the target application is high; anti-reverse When one of the safety level and the operating environment safety level is low, the second evaluation result of the target application is low; in other cases, the second evaluation result of the target application is medium. Optionally, in order to ensure that important preset functions are prioritized for operating environment security testing, the functions corresponding to the target application in various types of application operating environments are determined in advance. The number of preset functions is multiple, and each preset function There is a priority between. The priority between each preset function is stored in the function environment matching table. For example, during specific implementation, the priority of the preset functions in the function environment matching table is sorted from high to low, and the order of each preset function is preset function 1, preset function 2, preset function 3. The target application runs the preset function 1 in the application running environment, obtains the program function page of the preset function 1 and the environment function page, and compares the program function page of the preset function 1 with the environment function page. Perform the above operations on preset function 2 and preset function 3 in sequence.

In addition, in order to improve the detection efficiency, in other embodiments of the present invention, the operating environment security detection process of each preset function may also be executed simultaneously through multiple parallel execution threads. The present invention does not limit the specific execution sequence of the operating environment safety detection process of each preset function.

Step 4: Use the ideviceinstaller tool to uninstall the installed applications.

In summary, the target application on the iPhone device side in this embodiment can be automatically installed, started, and uninstalled, without manual installation, startup, and uninstallation. It gets rid of the traditional security detection method, realizes automatic security detection, and can be faster Realize security detection in various operating environments, greatly improving the efficiency of security detection, and meeting the increasing demand for iOS security detection.

In specific implementation, the above three implementation methods can be used alone or in combination. In this embodiment, in order to improve accuracy, the three implementation methods are combined to determine the second evaluation result, that is, the second evaluation result is based on the target application. The combination of the three aspects of the anti-reverse functional security level, the data protection security level of the target application, and the operating environment security of the target application are determined.

Step S270: Determine the security level of the target application according to the first evaluation result and the second evaluation result.

According to the first evaluation result and the second evaluation result, the security level of the target application is judged. Specifically, when the first evaluation result and the second evaluation result are both high, the security level of the target application is high; when one of the first evaluation result and the second evaluation result is low, the security level of the target application is Low; In other cases, the security level of the target application is medium. Wherein, the second evaluation result in this embodiment is determined based on the combination of the judgment results of the three implementation modes. The second evaluation result is determined based on the combination of the anti-reverse security level of the target application and the data protection security level. When the anti-reverse security level and the data protection security level are both high, the second evaluation result of the target application is high; the anti-reverse security level and When one of the data protection security levels is low, the second evaluation result of the target application is low; in other cases, the second evaluation result of the target application is medium. And/or the second evaluation result is determined based on the combination of the anti-reverse security level of the target application and the operating environment security level. When the anti-reverse security level and the operating environment security level are both high, the second evaluation result of the target application is high; When one of the safety level and the operating environment safety level is low, the second evaluation result of the target application is low; in other cases, the second evaluation result of the target application is medium.

This embodiment comprehensively utilizes the first evaluation result reflecting the static test result of the target application and the second evaluation result reflecting the dynamic test result of the target application to comprehensively evaluate the safety of the application, avoid the drawbacks caused by the single-dimensional evaluation method, and make The evaluation result is more accurate. Among them, the static test mainly evaluates the application installation files of the target application, using the type keywords commonly used in the iOS application development process to achieve specific functions, and fuzzy matching the type keywords corresponding to each detection type with the application symbol table. Taking into account the weight of each detection type and each type of keyword, the security of the target application is quantitatively evaluated, and a comprehensive and intuitive static detection of the target application is performed. There are 10 detection types, namely: anti-leakage type, sensitive word type, code obfuscation type, jailbreak detection type, proxy detection type, packaging protection type, string protection type, URL matching type, anti-debugging type, and/or Anti-hook type.

Dynamic testing evaluates the security of the target application from the perspective of anti-reverse security, data protection security, and operating environment security of the target application's dynamic running process. The anti-reverse function test in the dynamic test comprehensively evaluates the anti-reverse function of the target application from three aspects: anti-debugging, anti-hook, and anti-injection. The test response result is matched with at least two expected response results, and the target application anti-reverse function is determined according to the matching result. Reverse functional level; the data protection security test compares the target code with the preset obfuscated identifier, and determines whether the program code and program characters in the target application are obfuscated according to the comparison result, so as to realize the detection of the degree of data security protection of the target application; The environmental security test obtains the program startup page of the target application in the application runtime environment, and compares the program startup page with the preset environment startup page to determine whether the target application starts normally in the application runtime environment, so as to achieve the target application Safety inspection of operating environment.

Through the combination of static testing and dynamic testing, the target application is comprehensively tested from both static and dynamic dimensions, fully considering the static code of the target application and the anti-reverse, data protection and security of the operating environment during the dynamic operation. Find out the defects of the target application early, and help developers modify the target application in a targeted manner before the target application is put on the market.

Example three

Fig. 3 shows a structural diagram of an iOS application security detection device according to the third embodiment, the device includes:

The first evaluation result determining module 31 obtains the application symbol table corresponding to the target application, and matches the obtained type keyword corresponding to the preset detection type with the application symbol table, and according to the successfully matched target keyword The number and/or character weight of the characters to determine the first evaluation result corresponding to the target application;

The second evaluation result determination module 32 sends a dynamic test instruction corresponding to the preset function to the target application, and according to the test response result returned by the target application for the dynamic test instruction and at least two pre-configured expectations corresponding to the dynamic test instruction In response to the results, determine the second evaluation result corresponding to the target application;

The target application safety judgment module 33 judges whether the target application is safe according to the first evaluation result and the second evaluation result.

Optionally, when the first evaluation result determining module 31 is adapted to:

Set a corresponding type set for each detection type, and store each extracted target keyword in a type set corresponding to the detection type of the target keyword;

Then, according to the number of successfully matched target keywords and/or character weights, determining the first evaluation result corresponding to the target application includes:

For each type set, determine the type evaluation score corresponding to the type set according to the number of target keywords contained in the type set and/or the character weight of the target keywords;

According to the type evaluation score corresponding to each type set and the type weight corresponding to each type set, the first evaluation result corresponding to the target application is determined.

Optionally, the first evaluation result determining module 31 is adapted to:

For the type keyword to be matched, determine the type detection area that matches the detection type corresponding to the type keyword;

The target area corresponding to the type detection area is extracted from the application symbol table, and the obtained type keyword is matched with the target area.

Optionally, the first evaluation result determining module 31 is adapted to:

Obtain the application file of the target application;

Decompile the application file to obtain the application symbol table corresponding to the target application;

Wherein, the application symbol table further includes: a static symbol table, a dynamic symbol table, and/or a character table.

Optionally, the second evaluation result determining module 32 is adapted to:

Send the anti-reverse test instruction corresponding to the preset anti-reverse function to the target application.

Optionally, the second evaluation result determining module 32 is adapted to:

Send to the target application according to each anti-reverse function stored in the preset reverse test instruction table and the type of each anti-reverse test instruction corresponding to each anti-reverse function and/or the priority information between each anti-reverse test instruction Each anti-reverse test instruction stored in the reverse test instruction table.

Optionally, the second evaluation result determining module 32 is adapted to:

Decompile the obtained binary file of the target application, and obtain the decompiled code corresponding to the target application obtained after decompilation;

Extract the target code corresponding to the preset target area contained in the decompiled code,

It is determined whether the target code contains content that matches the preset obfuscated identifier, and the second evaluation result corresponding to the target application is determined in combination with the determination result.

Optionally, the second evaluation result determining module 32 is adapted to:

When the startup instruction corresponding to the target application is detected, the application operating environment corresponding to the target application is determined according to the startup instruction;

Obtain the program startup page displayed after the target application is started in the application runtime environment;

Query the preset environment startup page associated with the application operating environment corresponding to the target application;

It is determined whether the program startup page matches the environment startup page, and the second evaluation result corresponding to the target application is determined based on the determination result.

The embodiment of the present application provides a non-volatile computer storage medium, the computer storage medium stores at least one executable instruction, and the computer executable instruction can execute any of the above-mentioned method embodiments, an iOS application-based security detection method .

FIG. 4 shows a schematic structural diagram of an electronic device according to an embodiment of the present invention, and the specific embodiment of the present invention does not limit the specific implementation of the electronic device.

As shown in FIG. 4, the electronic device may include: a processor (processor) 402, a communication interface (Communications Interface) 404, a memory (memory) 406, and a communication bus 408.

among them:

The processor 402, the communication interface 404, and the memory 406 communicate with each other through the communication bus 408.

The communication interface 404 is used to communicate with network elements of other devices, such as clients or other servers.

The processor 402 is configured to execute the program 410, and specifically can execute the relevant steps in the foregoing embodiment of the fault location method based on multi-level network nodes.

Specifically, the program 410 may include program code, and the program code includes computer operation instructions.

The processor 402 may be a central processing unit CPU, or an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the electronic device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

The program 410 may be specifically used to enable the processor 402 to perform various operations in the foregoing method embodiments.

The algorithms and displays provided here are not inherently related to any particular computer, virtual system or other equipment. Various general-purpose systems can also be used with the teaching based on this. From the above description, the structure required to construct this type of system is obvious. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of a specific language is to disclose the best embodiment of the present invention.

In the instructions provided here, a lot of specific details are explained. However, it can be understood that the embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and technologies are not shown in detail, so as not to obscure the understanding of this specification.

Similarly, it should be understood that in order to simplify the present disclosure and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, Figure, or its description. However, the disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly stated in each claim. More precisely, as reflected in the following claims, the inventive aspect lies in less than all the features of a single embodiment disclosed previously. Therefore, the claims following the specific embodiment are thus explicitly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present invention.

Those skilled in the art can understand that it is possible to adaptively change the modules in the device in the embodiment and set them in one or more devices different from the embodiment. The modules or units or components in the embodiments can be combined into one module or unit or component, and in addition, they can be divided into multiple sub-modules or sub-units or sub-components. Except that at least some of such features and/or processes or units are mutually exclusive, any combination can be used to compare all features disclosed in this specification (including the accompanying claims, abstract and drawings) and any method or methods disclosed in this manner or All the processes or units of the equipment are combined. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract and drawings) may be replaced by providing the same, equivalent or similar items, alternative features.

In addition, those skilled in the art can understand that although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments means that they fall within the scope of the present invention. And form different embodiments. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented by hardware, or by software modules running on one or more processors, or by their combination. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all components in the device according to the embodiments of the present invention. The present invention can also be implemented as a device or device program (for example, a computer program and a computer program product) for executing part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may have the form of one or more signals. Such signals can be downloaded from Internet websites, or provided on carrier signals, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate the present invention rather than limit the present invention, and those skilled in the art can design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be constructed as a limitation to the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of multiple such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. do not indicate any order. These words can be interpreted as names.

Claims

A security detection method for iOS applications, including:

Obtain the application symbol table corresponding to the target application, and match the obtained type keywords corresponding to the preset detection type with the application symbol table, according to the number and/or characters of the target keywords that are successfully matched Weight, determining the first evaluation result corresponding to the target application;

Send a dynamic test instruction corresponding to a preset function to the target application, and according to the test response result returned by the target application for the dynamic test instruction and at least two pre-configured expectations corresponding to the dynamic test instruction In response to the result, determine a second evaluation result corresponding to the target application;

According to the first evaluation result and the second evaluation result, it is determined whether the target application is safe.
The method according to claim 1, wherein, when the preset detection types include multiple, the acquired type keywords corresponding to the preset detection types are matched with the application symbol table Specifically:

Set a corresponding type set for each detection type, and store each extracted target keyword in a type set corresponding to the detection type of the target keyword;

Then, determining the first evaluation result corresponding to the target application according to the number of successfully matched target keywords and/or character weight includes:

For each type set, determine the type evaluation score corresponding to the type set according to the number of target keywords contained in the type set and/or the character weight of the target keywords;

According to the type evaluation score corresponding to each type set and the type weight corresponding to each type set, the first evaluation result corresponding to the target application is determined.
The method according to claim 1, wherein the matching the acquired type keyword corresponding to the preset detection type with the application symbol table comprises:

For the type keyword to be matched, determine the type detection area that matches the detection type corresponding to the type keyword;

Extracting a target area corresponding to the type detection area from the application symbol table, and matching the obtained type keyword with the target area.
The method according to claim 1, wherein said obtaining the application symbol table corresponding to the target application comprises:

Obtaining the application file of the target application;

Decompiling the application file to obtain the application symbol table corresponding to the target application;

Wherein, the application symbol table further includes: a static symbol table, a dynamic symbol table, and/or a character table.
The method according to claim 1, wherein the preset function includes an anti-reverse function, and the dynamic test instruction includes an anti-reverse test instruction, then the dynamic test instruction corresponding to the preset function is sent to the target application include:

Send the anti-reverse test instruction corresponding to the preset anti-reverse function to the target application.
The method according to claim 5, wherein the sending an anti-reverse test instruction corresponding to a preset anti-reverse function to the target application comprises:

Send to the target application according to each anti-reverse function stored in the preset reverse test instruction table and the type of each anti-reverse test instruction corresponding to each anti-reverse function and/or the priority information between each anti-reverse test instruction Each anti-reverse test instruction stored in the reverse test instruction table.
The method according to claim 1, wherein the determining the second evaluation result corresponding to the target application specifically comprises:

Decompile the obtained binary file of the target application, and obtain the decompiled decompiled code corresponding to the target application;

Extracting the target code corresponding to the preset target area contained in the reverse compiled code;

It is determined whether the target code contains content that matches the preset confusion identifier, and the second evaluation result corresponding to the target application is determined in combination with the determination result.
The method according to claim 1, wherein the determining the second evaluation result corresponding to the target application specifically comprises:

When a startup instruction corresponding to the target application is detected, determine an application running environment corresponding to the target application according to the startup instruction;

Acquiring a program startup page displayed after the target application is started in the application running environment;

Query a preset environment startup page associated with the application running environment corresponding to the target application;

It is determined whether the program startup page matches the environment startup page, and the second evaluation result corresponding to the target application is determined in combination with the determination result.
A security detection device for iOS applications, including:

The first evaluation result determination module obtains the application symbol table corresponding to the target application, and matches the obtained type keyword corresponding to the preset detection type with the application symbol table, according to the target key of successful matching The number of words and/or the weight of the characters determine the first evaluation result corresponding to the target application;

The second evaluation result determination module sends a dynamic test instruction corresponding to a preset function to the target application, and according to the test response result returned by the target application for the dynamic test instruction and a pre-configured dynamic test instruction Corresponding to at least two expected response results, determining a second evaluation result corresponding to the target application;

The target application safety judgment module judges whether the target application is safe according to the first evaluation result and the second evaluation result.
The device according to claim 9, wherein when the first evaluation result determining module is adapted to:

Set a corresponding type set for each detection type, and store each extracted target keyword in a type set corresponding to the detection type of the target keyword;

Then, determining the first evaluation result corresponding to the target application according to the number of successfully matched target keywords and/or character weight includes:

For each type set, determine the type evaluation score corresponding to the type set according to the number of target keywords contained in the type set and/or the character weight of the target keywords;

According to the type evaluation score corresponding to each type set and the type weight corresponding to each type set, the first evaluation result corresponding to the target application is determined.
The device according to claim 9, wherein the first evaluation result determining module is adapted to:

For the type keyword to be matched, determine the type detection area that matches the detection type corresponding to the type keyword;

Extracting a target area corresponding to the type detection area from the application symbol table, and matching the obtained type keyword with the target area.
The device according to claim 9, wherein the first evaluation result determining module is adapted to:

Obtaining the application file of the target application;

Decompiling the application file to obtain the application symbol table corresponding to the target application;

Wherein, the application symbol table further includes: a static symbol table, a dynamic symbol table, and/or a character table.
The device according to claim 9, wherein the second evaluation result determining module is adapted to:

Send the anti-reverse test instruction corresponding to the preset anti-reverse function to the target application.
The device according to claim 13, wherein the second evaluation result determining module is adapted to:

Send to the target application according to each anti-reverse function stored in the preset reverse test instruction table and the type of each anti-reverse test instruction corresponding to each anti-reverse function and/or the priority information between each anti-reverse test instruction Each anti-reverse test instruction stored in the reverse test instruction table.
The device according to claim 9, wherein the second evaluation result determining module is adapted to:

Decompile the obtained binary file of the target application, and obtain the decompiled code corresponding to the target application obtained after decompilation;

Extracting the target code corresponding to the preset target area contained in the reverse compiled code;

It is determined whether the target code contains content that matches the preset confusion identifier, and the second evaluation result corresponding to the target application is determined in combination with the determination result.
The device according to claim 9, wherein the second evaluation result determining module is adapted to:

When a startup instruction corresponding to the target application is detected, determine an application running environment corresponding to the target application according to the startup instruction;

Acquiring a program startup page displayed after the target application is started in the application running environment;

Query a preset environment startup page associated with the application running environment corresponding to the target application;

It is determined whether the program startup page matches the environment startup page, and the second evaluation result corresponding to the target application is determined in combination with the determination result.
A security detection system for iOS applications, characterized in that it comprises the security detection device according to any one of claims 9-16.
An electronic device, comprising: a processor, a memory, a communication interface, and a communication bus. The processor, the memory, and the communication interface communicate with each other through the communication bus;

The memory is used to store at least one executable instruction, and the executable instruction causes the processor to perform an operation corresponding to an iOS application-based security detection method according to any one of claims 1-8.
A computer storage medium in which at least one executable instruction is stored, and the executable instruction causes a processor to execute the security detection method based on an iOS application according to any one of claims 1-8 The corresponding operation.