WO2021226961A1 - 应用程序安全检测方法、装置、存储介质及电子设备 - Google Patents

应用程序安全检测方法、装置、存储介质及电子设备 Download PDF

Info

Publication number
WO2021226961A1
WO2021226961A1 PCT/CN2020/090351 CN2020090351W WO2021226961A1 WO 2021226961 A1 WO2021226961 A1 WO 2021226961A1 CN 2020090351 W CN2020090351 W CN 2020090351W WO 2021226961 A1 WO2021226961 A1 WO 2021226961A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
ssl
tested
control flow
code
Prior art date
Application number
PCT/CN2020/090351
Other languages
English (en)
French (fr)
Inventor
陈文波
刘波
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to CN202080100517.1A priority Critical patent/CN115485685A/zh
Priority to PCT/CN2020/090351 priority patent/WO2021226961A1/zh
Publication of WO2021226961A1 publication Critical patent/WO2021226961A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Definitions

  • the present disclosure relates to the field of computer technology, and in particular to an application security detection method, an application security detection device, a computer-readable storage medium, and electronic equipment.
  • the present disclosure provides an application program safety detection method, an application program safety detection device, a computer-readable storage medium and an electronic device, thereby improving the safety of the application program at least to a certain extent.
  • an application security detection method including: parsing the code of the application to be detected, generating a control flow graph of the application to be detected; Detecting webpage view objects in the application; extracting rewritten class information from the webpage view objects; detecting setting information about secure socket layer protocol SSL errors in the rewritten class information to determine whether there is SSL risk.
  • an application security detection device including: a code analysis module, used to parse the code of the application to be detected, and generate a control flow graph of the application to be detected; and an object search module to use In the control flow diagram, the web view object in the application to be detected is searched; an information extraction module is used to extract rewritten class information from the web view object; a risk determination module is used to detect all The setting information about the SSL error of the secure socket layer protocol in the rewritten class information to determine whether there is an SSL risk.
  • a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the foregoing application security detection method is implemented.
  • an electronic device including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the executable instructions Perform the above-mentioned application security detection method.
  • the control flow diagram of the application to be detected is generated by parsing the code of the application to be detected; search for the application to be detected in the control flow diagram
  • the web view object in the application extract the rewritten class information from the web view object; detect the setting information about the secure socket layer protocol SSL error in the rewritten class information to determine whether there is an SSL risk.
  • the security of the application can be detected.
  • the application can be protected according to the detection result to prevent the application from being attacked and causing damage to the user.
  • this exemplary embodiment generates a control flow graph, determines web view objects, and extracts class information from them, and further performs risk detection on the application, which can accurately locate the location of the risk code. It is helpful for developers to quickly locate the problematic code that is at risk, so that it can be updated or modified in time, and the positioning accuracy is high, which provides a security guarantee for the application.
  • FIG. 1 shows a schematic diagram of the electronic device of this exemplary embodiment
  • Fig. 2 shows a flowchart of an application security detection method of this exemplary embodiment
  • Fig. 3 shows a sub-flow chart of an application security detection method of this exemplary embodiment
  • FIG. 4 shows a sub-flow chart of an application security detection method of this exemplary embodiment
  • FIG. 5 shows a flowchart of another application security detection method of this exemplary embodiment
  • FIG. 6 shows a sub-flow chart of another application security detection method of this exemplary embodiment
  • Fig. 7 shows a structural block diagram of an application security detection device of this exemplary embodiment.
  • Exemplary embodiments of the present disclosure provide an electronic device for implementing an application security detection method.
  • the electronic device at least includes a processor and a memory, the memory is used to store executable instructions of the processor, and the processor is configured to execute the application security detection method by executing the executable instructions.
  • Electronic devices can be implemented in various forms, such as mobile phones, tablet computers, notebook computers, personal digital assistants (PDAs), navigation devices, wearable devices, drones and other mobile devices, as well as desktop computers, Fixed equipment such as smart TVs.
  • PDAs personal digital assistants
  • FIG. 1 the structure of the electronic device will be exemplarily described below.
  • the configuration in FIG. 1 can also be applied to fixed-type equipment.
  • the mobile terminal 100 may include more or fewer components than shown, or combine certain components, or split certain components, or arrange different components.
  • the illustrated components can be implemented in hardware, software, or a combination of software and hardware.
  • the interface connection relationship between the components is only schematically shown, and does not constitute a structural limitation of the mobile terminal 100.
  • the mobile terminal 100 may also adopt a different interface connection manner from that in FIG. 1, or a combination of multiple interface connection manners.
  • the mobile terminal 100 may specifically include: a processor 110, an internal memory 121, an external memory interface 122, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, Battery 142, antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, speaker 171, receiver 172, microphone 173, earphone interface 174, sensor module 180, display screen 190, camera module 191, indicator 192, motor 193, button 194, Subscriber Identification Module (SIM) card interface 195, etc.
  • the sensor module 180 may include a depth sensor 1801, a pressure sensor 1802, a gyroscope sensor 1803, an air pressure sensor 1804, and the like.
  • the processor 110 may include one or more processing units.
  • the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), and an image signal processor. (Image Signal Processor, ISP), controller, video codec, digital signal processor (Digital Signal Processor, DSP), baseband processor and/or Neural-Network Processing Unit (NPU), etc.
  • AP application processor
  • modem processor GPU
  • image signal processor ISP
  • controller Video codec
  • DSP Digital Signal Processor
  • NPU Neural-Network Processing Unit
  • the different processing units may be independent devices or integrated in one or more processors.
  • the controller can generate operation control signals according to the instruction operation code and timing signals to complete the control of reading instructions and executing instructions.
  • a memory may also be provided in the processor 110 to store instructions and data.
  • the memory can store instructions for implementing six modular functions: detection instructions, connection instructions, information management instructions, analysis instructions, data transmission instructions, and notification instructions, and the processor 110 controls the execution.
  • the memory in the processor 110 is a cache memory.
  • the memory can store instructions or data that have just been used or recycled by the processor 110. If the processor 110 needs to use the instruction or data again, it can be directly called from the memory. Repeated accesses are avoided, the waiting time of the processor 110 is reduced, and the efficiency of the system is improved.
  • the processor 110 may include one or more interfaces.
  • Interfaces can include integrated circuit (Inter-Integrated Circuit, I2C) interface, integrated circuit built-in audio (Inter-Integrated Circuit Sound, I2S) interface, pulse code modulation (Pulse Code Modulation, PCM) interface, universal asynchronous transceiver (Universal Asynchronous) Receiver/Transmitter, UART) interface, Mobile Industry Processor Interface (MIPI), General-Purpose Input/Output (GPIO) interface, Subscriber Identity Module (SIM) interface and/ Or Universal Serial Bus (Universal Serial Bus, USB) interface, etc. Connections are formed with other components of the mobile terminal 100 through different interfaces.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • PCM Pulse Code Modulation
  • UART Universal Asynchronous transceiver
  • MIPI Mobile Industry Processor Interface
  • GPIO General-Purpose Input/Output
  • SIM Subscriber Identity Module
  • USB Universal Serial Bus
  • the USB interface 130 is an interface that complies with the USB standard specification, and specifically may be a MiniUSB interface, a MicroUSB interface, a USBTypeC interface, and the like.
  • the USB interface 130 can be used to connect a charger to charge the mobile terminal 100, can also connect to earphones to play audio through the earphones, and can also be used to connect the mobile terminal 100 to other electronic devices, such as computers, peripherals, and the like.
  • the charging management module 140 is used to receive charging input from the charger.
  • the charger can be a wireless charger or a wired charger.
  • the charging management module 140 may receive the charging input of the wired charger through the USB interface 130.
  • the charging management module 140 may receive the wireless charging input through the wireless charging coil of the mobile terminal 100. While the charging management module 140 charges the battery 142, it can also supply power to the electronic device through the power management module 141.
  • the power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110.
  • the power management module 141 receives input from the battery 142 and/or the charging management module 140, and supplies power to the processor 110, the internal memory 121, the display screen 190, the camera module 191, and the wireless communication module 160.
  • the power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle times, and battery health status (leakage, impedance). In some other implementation manners, the power management module 141 may also be provided in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 may also be provided in the same device.
  • the wireless communication function of the mobile terminal 100 can be implemented by the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor, and the baseband processor.
  • the antenna 1 and the antenna 2 are used to transmit and receive electromagnetic wave signals.
  • Each antenna in the mobile terminal 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.
  • Antenna 1 can be multiplexed as a diversity antenna of a wireless local area network.
  • the antenna can be used in combination with a tuning switch.
  • the mobile communication module 150 may provide a wireless communication solution including 2G/3G/4G/5G and the like applied to the mobile terminal 100.
  • the mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), and the like.
  • the mobile communication module 150 can receive electromagnetic waves by the antenna 1, filter, amplify, etc. the received electromagnetic waves, and transmit them to the modem processor for demodulation.
  • the mobile communication module 150 can also amplify the signal modulated by the modem processor, and convert it into electromagnetic waves for radiation via the antenna 1.
  • at least part of the functional modules of the mobile communication module 150 may be provided in the processor 110.
  • at least part of the functional modules of the mobile communication module 150 and at least part of the modules of the processor 110 may be provided in the same device.
  • the modem processor may include a modulator and a demodulator.
  • the modulator is used to modulate the low frequency baseband signal to be sent into a medium and high frequency signal.
  • the demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal.
  • the demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing.
  • the application processor outputs a sound signal through an audio device (not limited to the speaker 171, the receiver 172, etc.), or displays an image or video through the display screen 190.
  • the modem processor may be an independent device.
  • the modem processor may be independent of the processor 110 and be provided in the same device as the mobile communication module 150 or other functional modules.
  • the wireless communication module 160 can provide applications on the mobile terminal 100 including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), and global navigation satellites. System (Global Navigation Satellite System, GNSS), Frequency Modulation (FM), Near Field Communication (NFC), Infrared Technology (Infrared, IR) and other wireless communication solutions.
  • the wireless communication module 160 may be one or more devices integrating at least one communication processing module.
  • the wireless communication module 160 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110.
  • the wireless communication module 160 may also receive a signal to be sent from the processor 110, perform frequency modulation, amplify, and convert it into electromagnetic waves to radiate through the antenna 2.
  • the antenna 1 of the mobile terminal 100 is coupled with the mobile communication module 150, and the antenna 2 is coupled with the wireless communication module 160, so that the mobile terminal 100 can communicate with the network and other devices through wireless communication technology.
  • Wireless communication technologies can include Global System for Mobile communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), and broadband code division. Multiple Access (Wideband Code Division Multiple Access, WCDMA), Time Division Code Division Multiple Access (Time Division-Synchronous Code Division Multiple Access, TD-SCDMA), Long Term Evolution (LTE), New Radio (NR) , BT, GNSS, WLAN, NFC, FM, and/or IR technology, etc.
  • GSM Global System for Mobile communications
  • GPRS General Packet Radio Service
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • TD-SCDMA Time Division Code Division Multiple Access
  • LTE Long Term Evolution
  • NR New Radio
  • GNSS can include Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), Beidou Navigation Satellite System (BDS), Quasi-Zenith Satellite System (Quasi-Zenith Satellite System, QZSS) and/or Satellite Based Augmentation Systems (SBAS).
  • GPS Global Positioning System
  • GLONASS Global Navigation Satellite System
  • BDS Beidou Navigation Satellite System
  • QZSS Quasi-Zenith Satellite System
  • SBAS Satellite Based Augmentation Systems
  • the mobile terminal 100 implements a display function through a GPU, a display screen 190, an application processor, and the like.
  • the GPU is an image processing microprocessor, which is connected to the display screen 190 and the application processor.
  • the GPU is used to perform mathematical and geometric calculations and is used for graphics rendering.
  • the processor 110 may include one or more GPUs that execute program instructions to generate or change display information.
  • the display screen 190 is used to display images, videos, and the like.
  • the display screen 190 includes a display panel.
  • the display panel can be a Liquid Crystal Display (LCD), Organic Light-Emitting Diode (OLED), Active-Matrix Organic Light-Emitting Diode, or Active-Matrix Organic Light-Emitting Diode (Active-Matrix Organic Light-Emitting Diode).
  • Emitting Diode, AMOLED Flexible Light Emitting Diode (Flexlight-Emitting Diode, FLED), Miniled, MicroLed, Micro-oLed, Quantum Dot Light Emitting Diodes (QLED), etc.
  • the mobile terminal 100 may include one or N display screens 190, and N is a positive integer greater than one.
  • the mobile terminal 100 may implement a shooting function through an ISP, a camera module 191, a video codec, a GPU, a display screen 190, and an application processor.
  • the ISP is used to process the data fed back from the camera module 191. For example, when taking a picture, the shutter is opened, and the light is transmitted to the photosensitive element of the camera through the lens, the light signal is converted into an electrical signal, and the photosensitive element of the camera transmits the electrical signal to the ISP for processing, which is converted into an image visible to the naked eye.
  • ISP can also optimize the image noise, brightness, and skin color. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene.
  • the ISP may be provided in the camera module 191.
  • the camera module 191 is used to capture still images or videos.
  • the object generates an optical image through the lens and is projected to the photosensitive element.
  • the photosensitive element may be a Charge Coupled Device (CCD) or a Complementary Metal-Oxide-Semiconductor (CMOS) phototransistor.
  • CCD Charge Coupled Device
  • CMOS Complementary Metal-Oxide-Semiconductor
  • the photosensitive element converts the optical signal into an electrical signal, and then transfers the electrical signal to the ISP to convert it into a digital image signal.
  • ISP outputs digital image signals to DSP for processing.
  • DSP converts digital image signals into standard RGB, YUV and other formats of image signals.
  • the mobile terminal 100 may include 1 or N camera modules 191, and N is a positive integer greater than 1. If the mobile terminal 100 includes N cameras, one of the N cameras is the main camera.
  • Digital signal processors are used to process digital signals. In addition to digital image signals, they can also process other digital signals. For example, when the mobile terminal 100 selects the frequency point, the digital signal processor is used to perform Fourier transform on the energy of the frequency point.
  • Video codecs are used to compress or decompress digital video.
  • the mobile terminal 100 may support one or more video codecs. In this way, the mobile terminal 100 can play or record videos in multiple encoding formats, such as: Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, and so on.
  • MPEG Moving Picture Experts Group
  • MPEG2 MPEG2, MPEG3, MPEG4, and so on.
  • the external memory interface 122 may be used to connect an external memory card, such as a Micro SD card, so as to expand the storage capacity of the mobile terminal 100.
  • the external memory card communicates with the processor 110 through the external memory interface 122 to realize the data storage function. For example, save music, video and other files in an external memory card.
  • the internal memory 121 may be used to store computer executable program code, and the executable program code includes instructions.
  • the internal memory 121 may include a storage program area and a storage data area.
  • the storage program area can store an operating system, an application program (such as a sound playback function, an image playback function, etc.) required by at least one function, and the like.
  • the data storage area can store data (such as audio data, phone book, etc.) created during the use of the mobile terminal 100.
  • the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, a universal flash storage (Universal Flash Storage, UFS), and the like.
  • the processor 110 executes various functional applications and data processing of the mobile terminal 100 by running instructions stored in the internal memory 121 and/or instructions stored in a memory provided in the processor.
  • the mobile terminal 100 can implement audio functions through the audio module 170, the speaker 171, the receiver 172, the microphone 173, the earphone interface 174, and an application processor. For example, music playback, recording, etc.
  • the audio module 170 is used to convert digital audio information into an analog audio signal for output, and is also used to convert an analog audio input into a digital audio signal.
  • the audio module 170 can also be used to encode and decode audio signals.
  • the audio module 170 may be provided in the processor 110, or part of the functional modules of the audio module 170 may be provided in the processor 110.
  • the speaker 171 also called “speaker” is used to convert audio electrical signals into sound signals.
  • the mobile terminal 100 can listen to music through the speaker 171, or listen to a hands-free call.
  • the receiver 172 also called “earpiece” is used to convert audio electrical signals into sound signals.
  • the mobile terminal 100 answers a call or voice message, it can receive the voice by bringing the receiver 172 close to the human ear.
  • the microphone 173, also called “microphone” or “microphone”, is used to convert sound signals into electrical signals.
  • the user can approach the microphone 173 through the mouth to make a sound, and input the sound signal to the microphone 173.
  • the mobile terminal 100 may be provided with at least one microphone 173.
  • the mobile terminal 100 may be provided with two microphones 173, which can implement noise reduction functions in addition to collecting sound signals.
  • the mobile terminal 100 may also be provided with three, four or more microphones 173 to collect sound signals, reduce noise, identify sound sources, and realize directional recording functions.
  • the earphone interface 174 is used to connect wired earphones.
  • the earphone interface 174 may be a USB interface 130, or a 3.5mm Open Mobile Terminal Platform (OMTP) standard interface, or a Cellular Telecommunications Industry Association (Cellular Telecommunications Industry Association of the USA, CTIA) standard interface.
  • OMTP Open Mobile Terminal Platform
  • CTIA Cellular Telecommunications Industry Association
  • the depth sensor 1801 is used to obtain depth information of the scene.
  • the depth sensor may be provided in the camera module 191.
  • the pressure sensor 1802 is used to sense pressure signals and can convert the pressure signals into electrical signals.
  • the pressure sensor 1802 may be provided on the display screen 190.
  • the gyro sensor 1803 may be used to determine the movement posture of the mobile terminal 100.
  • the angular velocity of the mobile terminal 100 around three axes ie, x, y, and z axes
  • the gyro sensor 1803 can be used for image stabilization.
  • the gyroscope sensor 1803 detects the shake angle of the mobile terminal 100, calculates the distance that the lens module needs to compensate according to the angle, and allows the lens to counteract the shake of the mobile terminal 100 through reverse movement to achieve anti-shake.
  • the gyro sensor 1803 can also be used for navigation and somatosensory game scenes.
  • the air pressure sensor 1804 is used to measure air pressure. In some embodiments, the mobile terminal 100 calculates the altitude based on the air pressure value measured by the air pressure sensor 1804 to assist positioning and navigation.
  • sensors with other functions can be set in the sensor module 180, such as magnetic sensors, acceleration sensors, distance sensors, proximity light sensors, fingerprint sensors, temperature sensors, touch sensors, ambient light sensors, bone conduction sensors, etc. Wait.
  • the button 194 includes a power button, a volume button, and so on.
  • the button 194 may be a mechanical button. It can also be a touch button.
  • the mobile terminal 100 may receive key input, and generate key signal input related to user settings and function control of the mobile terminal 100.
  • the motor 193 can generate vibration prompts, such as vibration prompts for incoming calls, alarms, receiving messages, etc., and can also be used for touch vibration feedback, such as touch operations for different applications (such as photography, games, audio playback, etc.), or for display Touch operations in different areas of the screen 190 can correspond to different vibration feedback effects.
  • the touch vibration feedback effect can support customization.
  • the indicator 192 may be an indicator light, which may be used to indicate the charging status, power change, or to indicate messages, missed calls, notifications, and so on.
  • the SIM card interface 195 is used to connect to the SIM card.
  • the SIM card can be inserted into the SIM card interface 195 or pulled out from the SIM card interface 195 to achieve contact and separation with the mobile terminal 100.
  • the mobile terminal 100 may support 1 or N SIM card interfaces, and N is a positive integer greater than 1.
  • the SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, etc.
  • the same SIM card interface 195 can insert multiple cards at the same time. The types of multiple cards can be the same or different.
  • the SIM card interface 195 can also be compatible with different types of SIM cards.
  • the SIM card interface 195 may also be compatible with external memory cards.
  • the mobile terminal 100 interacts with the network through the SIM card to implement functions such as call and data communication.
  • the mobile terminal 100 adopts an eSIM, that is, an embedded SIM card.
  • the eSIM card can be embedded in the mobile terminal 100 and cannot be separated from the mobile terminal 100.
  • Fig. 2 shows the flow of an application security detection method in this exemplary embodiment, including the following steps S210 to S240:
  • step S210 the code of the application to be detected is parsed, and a control flow graph of the application to be detected is generated.
  • the application program to be detected is an application program that requires security detection, and it may include multiple types of application programs.
  • applications may include native applications, Web (Woeld Wide Web, global wide area network) applications, and hybrid applications.
  • native applications refer to applications that can be directly executed on the terminal device, which can use the hardware functions of the terminal device (such as speakers, acceleration sensors, cameras, etc.); Web applications are the opposite of native applications.
  • hybrid applications refer to applications that are between web applications and native applications, using native applications Part of the web application, as well as part of the web application, is usually embedded in the browser in the native application. Therefore, hybrid applications can be partly executed on the terminal device and partly executed on the Web.
  • Hybrid applications developed based on WebView components have gradually become a popular cross-platform solution for mobile applications.
  • developers customize WebView-related attributes they often threaten the security of the application due to certain settings.
  • this exemplary embodiment can perform security detection on different application programs, and in particular, it can be aimed at hybrid applications, and has a wider scope of application.
  • the application program to be detected can be parsed to obtain the corresponding program code, and then the control flow graph of the application program to be detected can be generated according to the code obtained by the analysis.
  • the control flow graph is an abstract data structure diagram, which can abstractly reflect the program or process, representing all the paths traversed during the execution of the program, and it can also reflect the real-time execution process of a process.
  • the compiler internally Perform maintenance.
  • the code of the application to be detected above may be obtained in the following manner:
  • the Smali code and/or the XML code of the extensible markup language of the application to be tested are obtained.
  • Smali refers to an assembler of ".dex" format files used by the Java virtual machine in the operating system (such as Android);
  • XML Extensible Markup Language, Extensible Markup Language
  • apk Android Package, Android application package
  • the Smali code and XML code of the hybrid application can be obtained.
  • step S210 may include the following steps:
  • Step S310 Perform control flow analysis on the code of the application to be tested to generate a control flow graph of the application to be tested;
  • Step S320 Perform function call analysis on the code of the application to be tested, and generate a function call graph of the application to be tested;
  • Step S330 Perform life cycle analysis on the components of the application to be tested, and combine the control flow graph and the function call graph to generate an inter-process control flow graph of the application to be tested.
  • CFG Control Flow Graph
  • Each node in the CFG can represent a basic block of the program (a group of continuous program instructions), and a directed edge indicates that two basic blocks can jump from the previous basic block to the next basic block.
  • control flow analysis can be performed based on the Smali code obtained by decompilation, and a control flow graph of the application to be tested can be generated to represent the execution process of the program.
  • Function call graph refers to a directed graph that can represent the calling relationship between functions in a program, where each node can correspond to a function, and the edge can represent the calling relationship of one function to another function, for example, the edge (p1, p2) represents Function p1 can call function p2.
  • the corresponding function call graph can be generated by performing function call analysis on the XML code obtained by decompilation of the application to be tested.
  • the iCFG Inter-procedural Control-Flow Graph
  • CFG represents the structure of a single method
  • iCFG can represent the structure of the entire program.
  • iCFG can combine the characteristics of CFG and function call graphs, and has higher analysis accuracy, which helps to improve the accuracy of subsequent application security testing.
  • Step S220 Search the web view object in the application to be detected in the control flow graph.
  • WebView is a control used to display web pages.
  • the web view object is a component provided by the system and used to display web content in an application.
  • the web view object can be a WebView object, which can be a variable, a data structure, or a function.
  • an object has a unique identifier, which can include attributes and methods. Among them, attributes are information that needs to be remembered, and methods are services that the object can provide.
  • attributes are information that needs to be remembered, and methods are services that the object can provide.
  • object-oriented software an object is an instance of a certain class.
  • WebView generally includes multiple classes, such as WebViewClient, which can be used to process various notifications and request events; WebChromeClient, which can be used to assist WebView in processing Javascript dialog boxes, website icons, or website titles, etc. And each class can include multiple objects.
  • WebViewClient can include, onPageStartedonPageFinished, which is used to call when the page is loaded and when the page is loaded; onLoadResource, which is used to call when the page loads resources, each time a resource is loaded (such as Picture), just call once; onReceivedSslError, when rewriting this method, you can let WebView handle https (Hyper Text Transfer Protocol over SecureSocket Layer, Hypertext Transfer Security Protocol) requests and so on.
  • onPageStartedonPageFinished which is used to call when the page is loaded and when the page is loaded
  • onLoadResource which is used to call when the page loads resources, each time a resource is loaded (such as Picture), just call once
  • onReceivedSslError when rewriting this method, you can let WebView handle https (Hyper Text Transfer Protocol over SecureSocket Layer, Hypertext Transfer Security Protocol) requests and so on.
  • the web view object of the application to be detected can be searched in the control flow graph in a variety of ways, for example, traversal or table lookup can be used, and regular expressions can also be used to filter out nodes that meet specific rules, etc. Etc., the present disclosure does not specifically limit this.
  • step S220 may include the following steps:
  • the web view object of the application to be detected can be found by traversing the inter-process control flow graph. Specifically, starting from the first node of the inter-process control flow graph, each node is searched one by one, and it is determined whether it is a node in the WebView object list, and if it is, it can be determined as a web view object.
  • Step S230 Extract rewritten class information from the web page view object.
  • Step S240 detecting the setting information about the SSL error of the secure socket layer protocol in the rewritten class information to determine whether there is an SSL risk.
  • SSL refers to a security protocol that provides security and data integrity for network communication. It can be used with TLS (Transport Layer Security) to encrypt network connections between the transport layer and the application layer.
  • TLS Transport Layer Security
  • MITM Man-in-the- MiddleAttack, man-in-the-middle attack
  • this exemplary embodiment can extract specific class information from the determined web view object, such as the WebViewClient class, by analyzing whether the WebViewClient class has been rewritten, and detecting the SSL error setting information therein, and then determining the Check whether the application has SSL risks.
  • the SSL error setting information may include information about whether to set to ignore the error SSL, or whether to set to send an error prompt message to the user, and so on.
  • the Java class, Java method, or code location where the risk code is located can also be printed according to the detection result, so that developers can optimize the application to be detected in time Or change etc.
  • step S230 may include the following steps:
  • Step S410 when it is detected that the WebViewClient class in the web view object has been rewritten, obtain the setting information about the SSL error in the WebViewClient class;
  • Step S420 When it is detected that the WebViewClient class in the webpage view object has not been rewritten, it is determined that there is no SSL risk.
  • this exemplary embodiment can determine whether there is an SSL risk by detecting whether the WebViewClient class has been rewritten. When it is detected that the WebViewClient class in the web view object has not been rewritten, it can be determined that there is no SSL risk in the application to be detected; and when it is detected that the WebViewClient class in the web view object has been rewritten, you need to obtain the information in the WebViewClient class SSL error setting information to further determine whether the application to be tested has SSL risk.
  • the foregoing step S240 may include:
  • the onReceivedSslError method When detecting that the WebViewClient class overloads the onReceivedSslError method, it is determined whether the onReceivedSslError method includes the setting information of choosing to ignore the error SSL to determine whether there is an SSL risk.
  • WebViewClient As a class for processing various notifications and request time, WebViewClient includes a variety of methods. Among them, the onReceivedSslError method is used to call back when an error occurs (such as when a 404 page occurs) on the server that loads the page. In this exemplary embodiment, after detecting that the WebViewClient class in the web view object has been rewritten, it can be further detected whether the WebViewClient class has overloaded the onReceivedSslError method.
  • the onReceivedSslError method can be determined by Whether to include the setting information of choosing to ignore the wrong SSL, determine whether there is an SSL risk.
  • Figure 5 shows another application security detection method in this exemplary embodiment, which may specifically include the following steps:
  • Step S502 parse the code of the application to be tested to obtain the Smali code and extensible markup language XML code of the application to be tested;
  • Step S504 Perform control flow analysis according to the Smali code of the application to be tested to generate a control flow graph of the application to be tested;
  • Step S506 Perform function call analysis according to the extensible markup language XML code of the application to be tested, and generate a function call graph of the application to be tested;
  • Step S508 Perform life cycle analysis on the components of the application to be tested, and combine the control flow graph and the function call graph to generate an inter-process control flow graph of the application to be tested.
  • Step S510 traverse the nodes in the inter-process control flow graph to find the web page view object in the application to be detected;
  • Step S512 detecting whether the WebViewClient class in the web page view object has been rewritten
  • step S514 is executed to determine that there is no SSL risk in the application to be detected;
  • step S516 is executed to check whether the onReceivedSslError method is overloaded by the WebViewClient class;
  • step S514 is executed to determine that the application to be detected does not have an SSL risk
  • step S518 is executed to determine whether the onReceivedSslError method includes the setting information of choosing to ignore the error SSL;
  • step S520 is executed to determine that the application to be detected has an SSL risk
  • step S514 is executed to determine that the application to be detected does not have an SSL risk.
  • the above determining whether the onReceivedSslError method includes setting information of selecting to ignore the error SSL to determine whether there is an SSL risk may include the following steps:
  • Step S610 detecting whether the proceed statement of the SslErrorHandler class is called in the onReceivedSslError method
  • step S620 it is determined that there is no SSL risk in the application to be detected.
  • Step S630 It is judged whether the proceed statement is in the if statement, and whether the judgment condition of the if statement is determined by the user's input information;
  • step S620 is executed to determine that the application to be detected does not have an SSL risk.
  • step S640 it is determined that the application to be detected has an SSL risk.
  • the onReceivedSslError method when analyzing the onReceivedSslError method, it is possible to first detect whether the onReceivedSslError method calls the proceed statement of the SslErrorHandler class. If it is called, it is considered that the application to be tested may have SSL risk, and it is necessary to further check whether the proceed statement is in Within the if statement, and whether the judgment condition of the if statement is determined by the user's input information.
  • the user's input information may refer to the user's selection of ignoring, denying, and continuing access option information in a specific pop-up window, prompting the user, and determining whether to ignore the wrong SSL according to the user's operation.
  • the control flow graph of the application to be detected is generated by parsing the code of the application to be detected; the web view object in the application to be detected is searched in the control flow graph; from the web view object Extract the rewritten class information; detect the setting information about the secure socket layer protocol SSL error in the rewritten class information to determine whether there is an SSL risk.
  • the security of the application can be detected.
  • the application can be protected according to the detection result to prevent the application from being attacked and causing damage to the user.
  • this exemplary embodiment generates a control flow graph, determines web view objects, and extracts class information from them, and further performs risk detection on the application, which can accurately locate the location of the risk code. It is helpful for developers to quickly locate the problematic code that is at risk, so that it can be updated or modified in time, and the positioning accuracy is high, which provides a security guarantee for the application.
  • the application security detection device 700 may include: a code analysis module 710, used to parse the code of the application to be detected, and generate a control flow graph of the application to be detected; an object search module 720, used to control the Search the web view object in the application to be detected in the flow graph; the information extraction module 730 is used to extract the rewritten class information from the web view object; the risk determination module 740 is used to detect the rewritten class information The setting information of the secure socket layer protocol SSL error to determine whether there is an SSL risk.
  • a code analysis module 710 used to parse the code of the application to be detected, and generate a control flow graph of the application to be detected
  • an object search module 720 used to control the Search the web view object in the application to be detected in the flow graph
  • the information extraction module 730 is used to extract the rewritten class information from the web view object
  • the risk determination module 740 is used to detect the rewritten class information
  • the setting information of the secure socket layer protocol SSL error to determine whether there is an SSL
  • the code of the application to be tested is obtained by a decompilation unit.
  • the decompilation unit is used to decompile the files of the application to be tested to obtain the Smali code and/or the XML code of the extensible markup language of the application to be tested.
  • the code analysis module includes: a first image generation unit for performing control flow analysis on the code of the application to be detected to generate a control flow graph of the application to be detected; and a second image generation unit for Perform function call analysis on the code of the application to be tested to generate a function call graph of the application to be tested; the third image generation unit is used for life cycle analysis of the components of the application to be tested, and combines the control flow graph and the function call graph, Generate the inter-process control flow diagram of the application to be tested.
  • the object search module includes: a node traversal unit, configured to traverse nodes in the inter-process control flow graph to find web view objects in the application to be detected.
  • the information extraction module includes: a detection unit configured to obtain setting information about SSL errors in the WebViewClient class when detecting that the WebViewClient class in the web page view object has been rewritten; and when detecting the setting information in the WebViewClient class When the WebViewClient class has not been rewritten, it is determined that there is no SSL risk.
  • the risk determination module includes: a setting information determining unit, which is used to determine whether the onReceivedSslError method includes setting information to choose to ignore the error SSL when detecting that the WebViewClient class overloads the onReceivedSslError method, so as to determine whether there is an SSL risk .
  • the setting information judging unit includes: a statement judging subunit, used for judging whether the proceed statement is in an if statement when it is detected that the proceed statement of the SslErrorHandler class is called in the onReceivedSslError method, and the judgment of the if statement Whether the condition is determined by the user's input information; if the proceed statement is in the if statement, and the judgment condition of the if statement is determined by the user's input information, it is determined that there is no SSL risk.
  • Exemplary embodiments of the present disclosure also provide a computer-readable storage medium on which is stored a program product capable of implementing the above-mentioned method of this specification.
  • various aspects of the present disclosure can also be implemented in the form of a program product, which includes program code.
  • the program product runs on a terminal device, the program code is used to make the terminal device execute the above-mentioned instructions in this specification.
  • any one or more of the steps in FIG. 2, FIG. 3, FIG. 4, FIG. 5, or FIG. 6 may be performed.
  • the exemplary embodiments of the present disclosure also provide a program product for implementing the above method, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be installed on a terminal device, such as a personal computer. run.
  • a program product of the present disclosure is not limited thereto.
  • the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with an instruction execution system, device, or device.
  • the program product can adopt any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable Type programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • the computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • the readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with the instruction execution system, apparatus, or device.
  • the program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.
  • the program code for performing the operations of the present disclosure can be written in any combination of one or more programming languages.
  • the programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming. Language-such as "C" language or similar programming language.
  • the program code can be executed entirely on the user's computing device, partly on the user's device, executed as an independent software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on.
  • the remote computing device can be connected to a user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (for example, using Internet service providers). Business to connect via the Internet).
  • LAN local area network
  • WAN wide area network
  • Internet service providers for example, using Internet service providers

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Telephone Function (AREA)
  • Stored Programmes (AREA)

Abstract

一种应用程序安全检测方法、应用程序安全检测装置、计算机可读存储介质与电子设备，涉及计算机技术技术领域。该应用程序安全检测方法包括：解析待检测应用程序的代码，生成所述待检测应用程序的控制流图（S210）；在所述控制流图中查找所述待检测应用程序中的网页视图对象（S220）；从所述网页视图对象中提取经过重新编写的类信息（S230）；检测所述经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险（S240）。该方法可以对应用程序进行有效的安全检测，以使开发人员根据检测结果对应用程序进行优化或更新，从而提高应用程序的安全性。

Description

应用程序安全检测方法、装置、存储介质及电子设备 技术领域
本公开涉及计算机技术领域，尤其涉及一种应用程序安全检测方法、应用程序安全检测装置、计算机可读存储介质与电子设备。
背景技术
近年来，随着移动互联网技术的迅速发展，出现了各种各样应用于不同操作系统平台的应用程序，这些应用程序在实际的使用过程中，虽然为人们带来很多便利，但同时也存在一些安全隐患。例如，现有技术中，当开发者通过重写WebView(网页视图)接口的相关方法和属性，来自定义网络页面的展示效果和处理逻辑时，可能会出现由于开发者忽略SSL(Secure Sockets Layer，安全套接层协议)而导致应用程序受到攻击的情况，使得WebView内容发生更改、传输的数据(例如登录凭据)被读取、以及使用JavaScript的代码被执行等，应用程序的安全受到了极大的威胁。因此，如何有效的对应用程序的安全进行检测，是现有技术亟待解决的问题。
需要说明的是，在上述背景技术部分公开的信息仅用于加强对本公开的背景的理解，因此可以包括不构成对本领域普通技术人员已知的现有技术的信息。
发明内容
本公开提供了一种应用程序安全检测方法、应用程序安全检测装置、计算机可读存储介质与电子设备，进而至少在一定程度上提高应用程序的安全性。
本公开的其他特性和优点将通过下面的详细描述变得显然，或部分地通过本公开的实践而习得。
根据本公开的第一方面，提供一种应用程序安全检测方法，包括：解析待检测应用程序的代码，生成所述待检测应用程序的控制流图；在所述控制流图中查找所述待检测应用程序中的网页视图对象；从所述网页视图对象中提取经过重新编写的类信息；检测所述经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险。
根据本公开的第二方面，提供一种应用程序安全检测装置，包括：代码解析模块，用于解析待检测应用程序的代码，生成所述待检测应用程序的控制流图；对象查找模块，用于在所述控制流图中查找所述待检测应用程序中的网页视图对象；信息提取模块，用于从所述网页视图对象中提取经过重新编写的类信息；风险确定模块，用于检测所述经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险。
根据本公开的第三方面，提供一种计算机可读存储介质，其上存储有计算机程序， 所述计算机程序被处理器执行时实现上述应用程序安全检测方法。
根据本公开的第四方面，提供一种电子设备，包括：处理器；以及存储器，用于存储所述处理器的可执行指令；其中，所述处理器配置为经由执行所述可执行指令来执行上述应用程序安全检测方法。
本公开的技术方案具有以下有益效果：
根据上述应用程序安全检测方法、应用程序安全检测装置、计算机可读存储介质与电子设备，通过解析待检测应用程序的代码，生成待检测应用程序的控制流图；在控制流图中查找待检测应用程序中的网页视图对象；从网页视图对象中提取经过重新编写的类信息；检测经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险。一方面，通过检测经过重新编写的类信息中关于SSL错误的设置信息，可以对应用程序的安全性进行检测，进一步，可以根据检测结果对应用程序进行保护，避免应用程序受到攻击，导致对用户信息造成威胁的问题；另一方面，本示例性实施例通过生成控制流图，确定网页视图对象，并从中提取类信息，进一步对应用程序进行风险检测，可以准确定位到风险代码所在的位置，有利于开发人员对存在风险的问题代码进行快速定位，以便于对其及时更新或修改，定位准确度较高，对应用程序提供了安全保障。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本公开的实施例，并与说明书一起用于解释本公开的原理。显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出本示例性实施方式的电子设备的示意图；
图2示出本示例性实施方式一种应用程序安全检测方法的流程图；
图3示出本示例性实施方式一种应用程序安全检测方法的子流程图；
图4示出本示例性实施方式一种应用程序安全检测方法的子流程图；
图5示出本示例性实施方式另一种应用程序安全检测方法的流程图；
图6示出本示例性实施方式另一种应用程序安全检测方法的子流程图；
图7示出本示例性实施方式一种应用程序安全检测装置的结构框图。
具体实施方式
现在将参考附图更全面地描述示例实施方式。然而，示例实施方式能够以多种形式实施，且不应被理解为限于在此阐述的范例；相反，提供这些实施方式使得本 公开将更加全面和完整，并将示例实施方式的构思全面地传达给本领域的技术人员。所描述的特征、结构或特性可以以任何合适的方式结合在一个或更多实施方式中。在下面的描述中，提供许多具体细节从而给出对本公开的实施方式的充分理解。然而，本领域技术人员将意识到，可以实践本公开的技术方案而省略特定细节中的一个或更多，或者可以采用其它的方法、组元、装置、步骤等。在其它情况下，不详细示出或描述公知技术方案以避免喧宾夺主而使得本公开的各方面变得模糊。
此外，附图仅为本公开的示意性图解，并非一定是按比例绘制。图中相同的附图标记表示相同或类似的部分，因而将省略对它们的重复描述。附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
本公开的示例性实施方式提供一种用于实现应用程序安全检测方法的电子设备。该电子设备至少包括处理器和存储器，存储器用于存储处理器的可执行指令，处理器配置为经由执行可执行指令来执行应用程序安全检测方法。
电子设备可以以各种形式来实施，例如可以包括手机、平板电脑、笔记本电脑、个人数字助理(Personal Digital Assistant，PDA)、导航装置、可穿戴设备、无人机等移动设备，以及台式电脑、智能电视等固定设备。下面以图1中的移动终端100为例，对电子设备的构造进行示例性说明。本领域技术人员应当理解，除了特别用于移动目的的部件之外，图1中的构造也能够应用于固定类型的设备。在另一些实施方式中，移动终端100可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件、软件或软件和硬件的组合实现。各部件间的接口连接关系只是示意性示出，并不构成对移动终端100的结构限定。在另一些实施方式中，移动终端100也可以采用与图1不同的接口连接方式，或多种接口连接方式的组合。
如图1所示，移动终端100具体可以包括：处理器110、内部存储器121、外部存储器接口122、通用串行总线(Universal Serial Bus，USB)接口130、充电管理模块140、电源管理模块141、电池142、天线1、天线2、移动通信模块150、无线通信模块160、音频模块170、扬声器171、受话器172、麦克风173、耳机接口174、传感器模块180、显示屏190、摄像模组191、指示器192、马达193、按键194以及用户标识模块(Subscriber Identification Module，SIM)卡接口195等。其中传感器模块180可以包括深度传感器1801、压力传感器1802、陀螺仪传感器1803、气压传感器1804等。
处理器110可以包括一个或多个处理单元，例如：处理器110可以包括应用处理器(Application Processor，AP)、调制解调处理器、图形处理器(Graphics Processing Unit，GPU)、图像信号处理器(Image Signal Processor，ISP)、控制器、视频编解码 器、数字信号处理器(Digital Signal Processor，DSP)、基带处理器和/或神经网络处理器(Neural-Network Processing Unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。
控制器可以根据指令操作码和时序信号，产生操作控制信号，完成读取指令和执行指令的控制。
处理器110中还可以设置存储器，用于存储指令和数据。存储器可以存储用于实现六个模块化功能的指令：检测指令、连接指令、信息管理指令、分析指令、数据传输指令和通知指令，并由处理器110来控制执行。在一些实施方式中，处理器110中的存储器为高速缓冲存储器。该存储器可以保存处理器110刚用过或循环使用的指令或数据。如果处理器110需要再次使用该指令或数据，可从存储器中直接调用。避免了重复存取，减少了处理器110的等待时间，因而提高了系统的效率。
在一些实施方式中，处理器110可以包括一个或多个接口。接口可以包括集成电路(Inter-Integrated Circuit，I2C)接口、集成电路内置音频(Inter-Integrated Circuit Sound，I2S)接口、脉冲编码调制(Pulse Code Modulation，PCM)接口、通用异步收发传输器(Universal Asynchronous Receiver/Transmitter，UART)接口、移动产业处理器接口(Mobile Industry Processor Interface，MIPI)、通用输入输出(General-Purpose Input/Output，GPIO)接口、用户标识模块(Subscriber Identity Module，SIM)接口和/或通用串行总线(Universal Serial Bus，USB)接口等。通过不同的接口和移动终端100的其他部件形成连接。
USB接口130是符合USB标准规范的接口，具体可以是MiniUSB接口，MicroUSB接口，USBTypeC接口等。USB接口130可以用于连接充电器为移动终端100充电，也可以连接耳机，通过耳机播放音频，还可以用于移动终端100连接其他电子设备，例如连接电脑、外围设备等。
充电管理模块140用于从充电器接收充电输入。其中，充电器可以是无线充电器，也可以是有线充电器。在一些有线充电的实施方式中，充电管理模块140可以通过USB接口130接收有线充电器的充电输入。在一些无线充电的实施方式中，充电管理模块140可以通过移动终端100的无线充电线圈接收无线充电输入。充电管理模块140为电池142充电的同时，还可以通过电源管理模块141为电子设备供电。
电源管理模块141用于连接电池142、充电管理模块140与处理器110。电源管理模块141接收电池142和/或充电管理模块140的输入，为处理器110、内部存储器121、显示屏190、摄像模组191和无线通信模块160等供电。电源管理模块141还可以用于监测电池容量，电池循环次数，电池健康状态(漏电，阻抗)等参数。在其他一些实施方式中，电源管理模块141也可以设置于处理器110中。在另一些实施方式中，电源管理模块141和充电管理模块140也可以设置于同一个器件中。
移动终端100的无线通信功能可以通过天线1、天线2、移动通信模块150、无 线通信模块160、调制解调处理器以及基带处理器等实现。
天线1和天线2用于发射和接收电磁波信号。移动终端100中的每个天线可用于覆盖单个或多个通信频带。不同的天线还可以复用，以提高天线的利用率。例如：可以将天线1复用为无线局域网的分集天线。在另外一些实施方式中，天线可以和调谐开关结合使用。
移动通信模块150可以提供应用在移动终端100上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块150可以包括至少一个滤波器，开关，功率放大器，低噪声放大器(Low Noise Amplifier，LNA)等。移动通信模块150可以由天线1接收电磁波，并对接收的电磁波进行滤波、放大等处理，传送至调制解调处理器进行解调。移动通信模块150还可以对经调制解调处理器调制后的信号放大，经天线1转为电磁波辐射出去。在一些实施方式中，移动通信模块150的至少部分功能模块可以被设置于处理器110中。在一些实施方式中，移动通信模块150的至少部分功能模块可以与处理器110的至少部分模块被设置在同一个器件中。
调制解调处理器可以包括调制器和解调器。其中，调制器用于将待发送的低频基带信号调制成中高频信号。解调器用于将接收的电磁波信号解调为低频基带信号。随后解调器将解调得到的低频基带信号传送至基带处理器处理。低频基带信号经基带处理器处理后，被传递给应用处理器。应用处理器通过音频设备(不限于扬声器171，受话器172等)输出声音信号，或通过显示屏190显示图像或视频。在一些实施方式中，调制解调处理器可以是独立的器件。在另一些实施方式中，调制解调处理器可以独立于处理器110，与移动通信模块150或其他功能模块设置在同一个器件中。
无线通信模块160可以提供应用在移动终端100上的包括无线局域网(Wireless Local Area Networks，WLAN)(如无线保真(Wireless Fidelity，Wi-Fi)网络)、蓝牙(Bluetooth，BT)、全球导航卫星系统(Global Navigation Satellite System，GNSS)、调频(Frequency Modulation，FM)、近距离无线通信技术(Near Field Communication，NFC)、红外技术(Infrared，IR)等无线通信的解决方案。无线通信模块160可以是集成至少一个通信处理模块的一个或多个器件。无线通信模块160经由天线2接收电磁波，将电磁波信号调频以及滤波处理，将处理后的信号发送到处理器110。无线通信模块160还可以从处理器110接收待发送的信号，对其进行调频，放大，经天线2转为电磁波辐射出去。
在一些实施方式中，移动终端100的天线1和移动通信模块150耦合，天线2和无线通信模块160耦合，使得移动终端100可以通过无线通信技术与网络以及其他设备通信。无线通信技术可以包括全球移动通讯系统(Global System for Mobile communications，GSM)，通用分组无线服务(General Packet Radio Service，GPRS)，码分多址接入(Code Division Multiple Access，CDMA)，宽带码分多址(Wideband  Code Division Multiple Access，WCDMA)，时分码分多址(Time Division-Synchronous Code Division Multiple Access，TD-SCDMA)，长期演进(Long Term Evolution，LTE)，新空口(New Radio，NR)，BT，GNSS，WLAN，NFC，FM，和/或IR技术等。GNSS可以包括全球卫星定位系统(Global Positioning System，GPS)，全球导航卫星系统(Global Navigation Satellite System，GLONASS)，北斗卫星导航系统(Beidou Navigation Satellite System，BDS)，准天顶卫星系统(Quasi-Zenith Satellite System，QZSS)和/或星基增强系统(Satellite Based Augmentation Systems，SBAS)。
移动终端100通过GPU、显示屏190及应用处理器等实现显示功能。GPU为图像处理的微处理器，连接显示屏190和应用处理器。GPU用于执行数学和几何计算，用于图形渲染。处理器110可包括一个或多个GPU，其执行程序指令以生成或改变显示信息。
显示屏190用于显示图像，视频等。显示屏190包括显示面板。显示面板可以采用液晶显示屏(Liquid Crystal Display，LCD)，有机发光二极管(Organic Light-Emitting Diode，OLED)，有源矩阵有机发光二极体或主动矩阵有机发光二极体(Active-Matrix Organic Light Emitting Diode，AMOLED)，柔性发光二极管(Flexlight-Emitting Diode，FLED)，Miniled，MicroLed，Micro-oLed，量子点发光二极管(Quantum dot Light Emitting Diodes，QLED)等。在一些实施方式中，移动终端100可以包括1个或N个显示屏190，N为大于1的正整数。
移动终端100可以通过ISP、摄像模组191、视频编解码器、GPU、显示屏190及应用处理器等实现拍摄功能。
ISP用于处理摄像模组191反馈的数据。例如，拍照时，打开快门，光线通过镜头被传递到摄像头感光元件上，光信号转换为电信号，摄像头感光元件将电信号传递给ISP处理，转化为肉眼可见的图像。ISP还可以对图像的噪点，亮度，肤色进行算法优化。ISP还可以对拍摄场景的曝光，色温等参数优化。在一些实施方式中，ISP可以设置在摄像模组191中。
摄像模组191用于捕获静态图像或视频。物体通过镜头生成光学图像投射到感光元件。感光元件可以是电荷耦合器件(Charge Coupled Device，CCD)或互补金属氧化物半导体(Complementary Metal-Oxide-Semiconductor，CMOS)光电晶体管。感光元件把光信号转换成电信号，之后将电信号传递给ISP转换成数字图像信号。ISP将数字图像信号输出到DSP加工处理。DSP将数字图像信号转换成标准的RGB，YUV等格式的图像信号。在一些实施方式中，移动终端100可以包括1个或N个摄像模组191，N为大于1的正整数，若移动终端100包括N个摄像头，N个摄像头中有一个是主摄像头。
数字信号处理器用于处理数字信号，除了可以处理数字图像信号，还可以处理其他数字信号。例如，当移动终端100在频点选择时，数字信号处理器用于对频点 能量进行傅里叶变换等。
视频编解码器用于对数字视频压缩或解压缩。移动终端100可以支持一种或多种视频编解码器。这样，移动终端100可以播放或录制多种编码格式的视频，例如：动态图像专家组(Moving Picture Experts Group，MPEG)1，MPEG2，MPEG3，MPEG4等。
外部存储器接口122可以用于连接外部存储卡，例如Micro SD卡，实现扩展移动终端100的存储能力。外部存储卡通过外部存储器接口122与处理器110通信，实现数据存储功能。例如将音乐，视频等文件保存在外部存储卡中。
内部存储器121可以用于存储计算机可执行程序代码，可执行程序代码包括指令。内部存储器121可以包括存储程序区和存储数据区。其中，存储程序区可存储操作系统，至少一个功能所需的应用程序(比如声音播放功能，图像播放功能等)等。存储数据区可存储移动终端100使用过程中所创建的数据(比如音频数据，电话本等)等。此外，内部存储器121可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(Universal Flash Storage，UFS)等。处理器110通过运行存储在内部存储器121的指令和/或存储在设置于处理器中的存储器的指令，执行移动终端100的各种功能应用以及数据处理。
移动终端100可以通过音频模块170、扬声器171、受话器172、麦克风173、耳机接口174及应用处理器等实现音频功能。例如音乐播放、录音等。
音频模块170用于将数字音频信息转换成模拟音频信号输出，也用于将模拟音频输入转换为数字音频信号。音频模块170还可以用于对音频信号编码和解码。在一些实施方式中，音频模块170可以设置于处理器110中，或将音频模块170的部分功能模块设置于处理器110中。
扬声器171，也称“喇叭”，用于将音频电信号转换为声音信号。移动终端100可以通过扬声器171收听音乐，或收听免提通话。
受话器172，也称“听筒”，用于将音频电信号转换成声音信号。当移动终端100接听电话或语音信息时，可以通过将受话器172靠近人耳接听语音。
麦克风173，也称“话筒”，“传声器”，用于将声音信号转换为电信号。当拨打电话或发送语音信息时，用户可以通过人嘴靠近麦克风173发声，将声音信号输入到麦克风173。移动终端100可以设置至少一个麦克风173。在另一些实施方式中，移动终端100可以设置两个麦克风173，除了采集声音信号，还可以实现降噪功能。在另一些实施方式中，移动终端100还可以设置三个，四个或更多麦克风173，实现采集声音信号，降噪，还可以识别声音来源，实现定向录音功能等。
耳机接口174用于连接有线耳机。耳机接口174可以是USB接口130，也可以是3.5mm的开放移动电子设备平台(Open Mobile Terminal Platform，OMTP)标准 接口，美国蜂窝电信工业协会(Cellular Telecommunications Industry Association of the USA，CTIA)标准接口。
深度传感器1801用于获取景物的深度信息。在一些实施方式中，深度传感器可以设置于摄像模组191。
压力传感器1802用于感受压力信号，可以将压力信号转换成电信号。在一些实施方式中，压力传感器1802可以设置于显示屏190。压力传感器1802的种类很多，如电阻式压力传感器，电感式压力传感器，电容式压力传感器等。
陀螺仪传感器1803可以用于确定移动终端100的运动姿态。在一些实施方式中，可以通过陀螺仪传感器1803确定移动终端100围绕三个轴(即，x，y和z轴)的角速度。陀螺仪传感器1803可以用于拍摄防抖。示例性的，当按下快门，陀螺仪传感器1803检测移动终端100抖动的角度，根据角度计算出镜头模组需要补偿的距离，让镜头通过反向运动抵消移动终端100的抖动，实现防抖。陀螺仪传感器1803还可以用于导航，体感游戏场景。
气压传感器1804用于测量气压。在一些实施方式中，移动终端100通过气压传感器1804测得的气压值计算海拔高度，辅助定位和导航。
此外，根据实际需要，还可以在传感器模块180中设置其他功能的传感器，例如磁传感器、加速度传感器、距离传感器、接近光传感器、指纹传感器、温度传感器、触摸传感器、环境光传感器、骨传导传感器等等。
按键194包括开机键，音量键等。按键194可以是机械按键。也可以是触摸式按键。移动终端100可以接收按键输入，产生与移动终端100的用户设置以及功能控制有关的键信号输入。
马达193可以产生振动提示，例如来电、闹钟、接收信息等的振动提示，也可以用于触摸振动反馈，例如作用于不同应用(如拍照、游戏、音频播放等)的触摸操作，或者作用于显示屏190不同区域的触摸操作，可以对应不同的振动反馈效果。触摸振动反馈效果可以支持自定义。
指示器192可以是指示灯，可以用于指示充电状态，电量变化，也可以用于指示消息，未接来电，通知等。
SIM卡接口195用于连接SIM卡。SIM卡可以通过插入SIM卡接口195，或从SIM卡接口195拔出，实现和移动终端100的接触和分离。移动终端100可以支持1个或N个SIM卡接口，N为大于1的正整数。SIM卡接口195可以支持Nano SIM卡，Micro SIM卡，SIM卡等。同一个SIM卡接口195可以同时插入多张卡。多张卡的类型可以相同，也可以不同。SIM卡接口195也可以兼容不同类型的SIM卡。SIM卡接口195也可以兼容外部存储卡。移动终端100通过SIM卡和网络交互，实现通话以及数据通信等功能。在一些实施方式中，移动终端100采用eSIM，即：嵌入式SIM卡。eSIM卡可以嵌在移动终端100中，不能和移动终端100分离。
下面对本公开示例性实施方式的应用程序安全检测方法和应用程序安全检测装置进行具体说明。
图2示出了本示例性实施方式中一种应用程序安全检测方法的流程，包括以下步骤S210～S240：
步骤S210，解析待检测应用程序的代码，生成待检测应用程序的控制流图。
其中，待检测应用程序即为需要进行安全检测的应用程序，其可以包括多种类型的应用程序。通常，应用程序可以包括原生应用程序，Web(Woeld Wide Web，全球广域网)应用程序以及混合应用程序。其中，原生应用程序是指可以直接在终端设备上执行的应用程序，其可以使用终端设备的硬件功能(如扬声器、加速度传感器、摄像头等)；Web应用程序与原生应用程序相反，是一种可以通过Web访问的应用程序，用户只需要有浏览器即可，不需要再安装其他应用软件；而混合应用程序是指介于Web应用程序和原生应用程序之间的应用程序，采用了原生应用程序的一部分，以及Web应用程序的一部分，通常是在原生应用程序内嵌浏览器。因此，混合应用程序可以一部分在终端设备上执行，一部分在Web上执行。
随着软件平台的不断扩展，业务功能趋向复杂化，原生应用程序大多都会往混合应用程序的方向靠拢。基于WebView组件开发的混合应用程序逐渐成为移动应用跨平台的流行解决方案。而开发者在自定义WebView相关属性时，往往会由于某些设置对应用程序的安全造成威胁。而本示例性实施例，可以对不同的应用程序进行安全检测，特别的，可以针对于混合应用程序，具有较广的适用范围。
在本示例性实施例中，对待检测的应用程序进行解析，可以得到相应的程序代码，然后，可以根据解析得到的代码，生成待检测应用程序的控制流图。其中，控制流图是一种抽象的数据结构图，其可以对程序或过程进行抽象反映，表示程序执行过程中遍历到的所有路径，也可以反映一个过程的实时执行过程，由编译器在内部进行维护。
在一示例性实施例中，上述待检测应用程序的代码，可以通过以下方式获取：
通过反编译待检测应用程序的文件，得到待检测应用程序的Smali代码和/或可扩展标记语言XML代码。
其中，Smali是指操作系统(如Android)里的Java虚拟机所使用的一种“.dex”格式文件的汇编器；XML(Extensible Markup Language，可扩展标记语言)则是一种用于标记电子文件使其具有结构性的标记语言。在本示例性实施例中，通过特定的逆向工具或软件对待检测应用程序的文件进行反编译，即可以得到相应的Smali代码以及XML代码，例如采用APKTool(APK编译工具)，对混合应用程序的apk(Android Package，安卓应用程序包)进行反编译，可以得到该混合应用程序的Smali代码以及XML代码。
在一示例性实施例中，如图3所示，上述步骤S210可以包括以下步骤：
步骤S310，对待检测应用程序的代码进行控制流分析，生成待检测应用程序的控制流图；
步骤S320，对待检测应用程序的代码进行函数调用分析，生成待检测应用程序的函数调用图；
步骤S330，对待检测应用程序的组件进行生命周期分析，并结合控制流图和函数调用图，生成待检测应用程序的过程间控制流图。
其中，CFG(Control Flow Graph，控制流图)，是指通过有向图来表示程序的控制流过程的图。CFG中的每个节点可以表示程序的基本块(一组连续的程序指令)，有向边表示两个基本块可以从前一个基本块跳转到后一个基本块。本示例性实施例可以基于反编译得到的Smali代码进行控制流分析，生成待检测应用程序的控制流图，以表示程序的执行过程。
函数调用图是指能够表示程序中函数之间调用关系的有向图，其中，每个节点可以对应一个函数，边可以表示一个函数对另一个函数的调用关系，例如边(p1，p2)表示函数p1可以调用函数p2。在本示例性实施例中，可以通过对待检测应用程序反编译得到的XML代码进行函数调用分析，生成对应的函数调用图。
进一步的，通过结合控制流图和函数调用图，可以生成待检测应用程序的iCFG(Inter-procedural Control-Flow Graph，过程间控制流图)。需要说明的是，虽然iCFG与CFG均可以对程序的控制流过程进行表示，但二者具有差别，CFG表示的是单个方法的结构，iCFG则可以表示整个程序的结构。iCFG可以结合CFG与函数调用图的特点，且具有更高的分析精度，有助于提高后续进行应用程序安全检测的准确性。
步骤S220，在控制流图中查找待检测应用程序中的网页视图对象。
WebView是一种用于展示web页面的控件。网页视图对象是系统提供的，用于在应用程序中展示网页内容的组件，例如在Android系统中，网页视图对象可以是WebView对象，其可以是一个变量、一个数据结构、或者是一个函数。
通常，在软件系统中，对象具有唯一的标识符，可以包括属性和方法，其中，属性就是需要记忆的信息，方法就是对象能够提供的服务。在面向对象的软件中，对象是某一个类的实例。WebView中一般包括多个类，例如WebViewClient，可以用于处理各种通知和请求事件；WebChromeClient，可以用于辅助WebView处理Javascript的对话框、网站图标、或者网站标题等。而每个类下又可以包括多个对象，例如WebViewClient可以包括，onPageStartedonPageFinished，用于在页面加载时，以及页面加载完毕时调用；onLoadResource，用于在页面加载资源时调用，每加载一个资源(如图片)，就调用一次；onReceivedSslError，重写此方法时，可以让WebView处理https(Hyper Text Transfer Protocol over SecureSocket Layer，超文本传输安全协议)请求等等。
本示例性实施例可以通过多种方式，在控制流图中查找待检测应用程序的网页 视图对象，例如可以采用遍历或查表的方式，还可以采用正则表达式筛选出符合特定规则的节点等等，本公开对此不做具体限定。
在一示例性实施例中，上述步骤S220可以包括以下步骤：
遍历过程间控制流图中的节点，以查找待检测应用程序中的网页视图对象。
在本示例性实施例中，可以通过对过程间控制流图进行遍历的方式，查找到待检测应用程序的网页视图对象。具体可以是，从过程间控制流图的第一个节点开始，逐个查找每个节点，并判断其是否为WebView对象列表中的节点，如果是，则可以确定其为网页视图对象。
步骤S230，从网页视图对象中提取经过重新编写的类信息。
步骤S240，检测经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险。
SSL是指为网络通信提供安全及数据完整性的一种安全协议，其可以与TLS(Transport Layer Security，继任者传输层安全)在传输层与应用层之间对网络连接进行加密。现有技术中，开发者在通过重写WebView接口的相关方法和属性，来自定义Web页面的展示效果和处理逻辑时，往往会设置忽略SSL而导致应用程序遭受到MITM(Man-in-the-MiddleAttack，中间人攻击)。基于此，本示例性实施例可以基于确定的网页视图对象，从中提取出特定的类信息，例如WebViewClient类，通过分析WebViewClient类是否经过重新编写，并检测其中关于SSL错误的设置信息，进而确定待检测应用程序是否存在SSL风险。其中，SSL错误的设置信息可以包括是否设置忽略错误SSL的信息，或者是否设置向用户进行发送错误提示信息等。在本示例性实施例中，当确定待检测应用程序的安全检测结果后，还可以根据检测结果打印风险代码所在的Java类、Java方法或代码位置，以便于开发人员及时对待检测应用程序进行优化或更改等。
具体的，在一示例性实施例中，如图4所示，上述步骤S230可以包括以下步骤：
步骤S410，当检测网页视图对象中的WebViewClient类经过重新编写时，获取WebViewClient类中关于SSL错误的设置信息；
步骤S420，当检测网页视图对象中的WebViewClient类未经过重新编写时，确定不存在SSL风险。
考虑到SSL的设置信息一般会出现在重新编写的WebViewClient类信息中，因此，本示例性实施例可以通过检测WebViewClient类是否经过重新编写，来判断其是否存在SSL风险。当检测到网页视图对象中的WebViewClient类未经过重新编写时，可以确定待检测应用程序不存在SSL风险；而当检测到网页视图对象中的WebViewClient类经过重新编写时，则需要获取WebViewClient类中关于SSL错误的设置信息，进一步判断待检测应用程序是否存在SSL风险。
具体的，在一示例性实施例中，当检测网页视图对象中的WebViewClient类经过 重新编写后，上述步骤S240可以包括：
当检测WebViewClient类重载onReceivedSslError方法时，判断onReceivedSslError方法中是否包括选择忽略错误SSL的设置信息，以确定是否存在SSL风险。
WebViewClient作为处理各种通知和请求时间的类，其中包括了多种方法，其中，onReceivedSslError方法则是用于在加载页面的服务器，出现错误时(如出现404页面时)进行回调。在本示例性实施例中，当检测网页视图对象中的WebViewClient类经过重新编写后，可以进一步检测WebViewClient类是否重载了onReceivedSslError方法，当判断WebViewClient类重载onReceivedSslError方法后，则可以通过确定onReceivedSslError方法中是否包括选择忽略错误SSL的设置信息，确定是否存在SSL风险。
图5示出了本示例性实施例中另一种应用程序安全检测方法，具体可以包括以下步骤：
步骤S502，解析待检测应用程序的代码，得到待检测应用程序的Smali代码和可扩展标记语言XML代码；
步骤S504，根据待检测应用程序的Smali代码进行控制流分析，生成待检测应用程序的控制流图；
步骤S506，根据待检测应用程序的可扩展标记语言XML代码进行函数调用分析，生成待检测应用程序的函数调用图；
步骤S508，对待检测应用程序的组件进行生命周期分析，并结合控制流图和函数调用图，生成待检测应用程序的过程间控制流图。
步骤S510，遍历过程间控制流图中的节点，以查找待检测应用程序中的网页视图对象；
步骤S512，检测网页视图对象中的WebViewClient类是否经过重新编写；
如果未经过重新编写，则执行步骤S514，确定待检测应用程序不存在SSL风险；
如果经过重新编写，则执行步骤S516，检测WebViewClient类是否重载onReceivedSslError方法；
如果WebViewClient类未重载onReceivedSslError方法，则执行步骤S514，确定待检测应用程序不存在SSL风险；
如果WebViewClient类重载onReceivedSslError方法，则执行步骤S518，判断onReceivedSslError方法中是否包括选择忽略错误SSL的设置信息；
如果包括选择忽略错误SSL的设置信息，则执行步骤S520，确定待检测应用程序存在SSL风险；
如果不包括选择忽略错误SSL的设置信息，则执行步骤S514，确定待检测应用程序不存在SSL风险。
在一示例性实施例中，如图6所示，上述判断onReceivedSslError方法中是否包括选择忽略错误SSL的设置信息，以确定是否存在SSL风险，可以包括以下步骤：
步骤S610，检测onReceivedSslError方法中是否调用了SslErrorHandler类的proceed语句；
如果未检测到onReceivedSslError方法体中调用了SslErrorHandler类的proceed语句，则执行
步骤S620，确定待检测应用程序不存在SSL风险。
如果检测到onReceivedSslError方法体中调用了SslErrorHandler类的proceed语句，则执行
步骤S630，判断proceed语句是否在if语句内，且if语句的判断条件是否由用户的输入信息确定；
如果proceed语句在if语句内，且if语句的判断条件由用户的输入信息确定，则执行步骤S620，确定待检测应用程序不存在SSL风险。
反之，如果proceed语句不在if语句内，且if语句的判断条件不由用户的输入信息确定，则执行
步骤S640，确定待检测应用程序存在SSL风险。
在本示例性实施例中，在分析onReceivedSslError方法时，可以先检测onReceivedSslError方法是否对SslErrorHandler类的proceed语句进行调用，如果调用，认为待检测应用程序可能存在SSL风险，需要进一步，检测proceed语句是否在if语句内，且if语句的判断条件是否由用户的输入信息确定。其中，用户的输入信息可以是指用户通过在特定弹窗中，选择的忽略、拒绝、继续访问等选项信息，通过对用户进行提示，并根据用户操作确定是否忽略错误的SSL。当判断proceed语句在if语句内，且if语句的判断条件由用户的输入信息确定时，可以认为当前的进程为用户允许的，已经向用户发送过提示信息的。因此，确定待检测应用程序SSL风险较低或不存在SSL风险；反之，当判断proceed语句不在if语句内，且if语句的判断条件不是由用户的输入信息确定时，可能出现未经用户判断就直接忽视错误SSL执行进程的情况，则认为当前待检测应用程序存在风险。
综上，本示例性实施方式中，通过解析待检测应用程序的代码，生成待检测应用程序的控制流图；在控制流图中查找待检测应用程序中的网页视图对象；从网页视图对象中提取经过重新编写的类信息；检测经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险。一方面，通过检测经过重新编写的类信息中关于SSL错误的设置信息，可以对应用程序的安全性进行检测，进一步，可以根据检测结果对应用程序进行保护，避免应用程序受到攻击，导致对用户信息造成威胁的问题；另一方面，本示例性实施例通过生成控制流图，确定网页视图对象，并从中提取类信息，进一步对应用程序进行风险检测，可以准确定位 到风险代码所在的位置，有利于开发人员对存在风险的问题代码进行快速定位，以便于对其及时更新或修改，定位准确度较高，对应用程序提供了安全保障。
本公开的示例性实施方式还提供一种应用程序安全检测装置。如图7所示，该应用程序安全检测装置700可以包括：代码解析模块710，用于解析待检测应用程序的代码，生成待检测应用程序的控制流图；对象查找模块720，用于在控制流图中查找待检测应用程序中的网页视图对象；信息提取模块730，用于从网页视图对象中提取经过重新编写的类信息；风险确定模块740，用于检测经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险。
在一示例性实施例中，待检测应用程序的代码，通过反编译单元获取。反编译单元，用于通过反编译待检测应用程序的文件，得到待检测应用程序的Smali代码和/或可扩展标记语言XML代码。
在一示例性实施例中，代码解析模块包括：第一图像生成单元，用于对待检测应用程序的代码进行控制流分析，生成待检测应用程序的控制流图；第二图像生成单元，用于对待检测应用程序的代码进行函数调用分析，生成待检测应用程序的函数调用图；第三图像生成单元，用于对待检测应用程序的组件进行生命周期分析，并结合控制流图和函数调用图，生成待检测应用程序的过程间控制流图。
在一示例性实施例中，对象查找模块包括：节点遍历单元，用于遍历过程间控制流图中的节点，以查找待检测应用程序中的网页视图对象。
在一示例性实施例中，信息提取模块包括：检测单元，用于当检测网页视图对象中的WebViewClient类经过重新编写时，获取WebViewClient类中关于SSL错误的设置信息；以及当检测网页视图对象中的WebViewClient类未经过重新编写时，确定不存在SSL风险。
在一示例性实施例中，风险确定模块包括：设置信息判断单元，用于当检测WebViewClient类重载onReceivedSslError方法时，判断onReceivedSslError方法中是否包括选择忽略错误SSL的设置信息，以确定是否存在SSL风险。
在一示例性实施例中，设置信息判断单元包括：语句判断子单元，用于当检测到onReceivedSslError方法中调用了SslErrorHandler类的proceed语句时，判断proceed语句是否在if语句内，且if语句的判断条件是否由用户的输入信息确定；如果proceed语句在if语句内，且if语句的判断条件由用户的输入信息确定，则确定不存在SSL风险。
上述装置中各模块的具体细节在方法部分实施方式中已经详细说明，未披露的细节内容可以参见方法部分的实施方式内容，因而不再赘述。
所属技术领域的技术人员能够理解，本公开的各个方面可以实现为系统、方法或程序产品。因此，本公开的各个方面可以具体实现为以下形式，即：完全的硬件实施方式、完全的软件实施方式(包括固件、微代码等)，或硬件和软件方面结合的 实施方式，这里可以统称为“电路”、“模块”或“系统”。
本公开的示例性实施方式还提供了一种计算机可读存储介质，其上存储有能够实现本说明书上述方法的程序产品。在一些可能的实施方式中，本公开的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当程序产品在终端设备上运行时，程序代码用于使终端设备执行本说明书上述“示例性方法”部分中描述的根据本公开各种示例性实施方式的步骤，例如可以执行图2、图3、图4、图5或图6中任意一个或多个步骤。
本公开的示例性实施方式还提供了一种用于实现上述方法的程序产品，其可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在终端设备，例如个人电脑上运行。然而，本公开的程序产品不限于此，在本文件中，可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以为但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于无线、有线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本公开操作的程序代码，程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络，包括局域网(LAN)或广域网(WAN)，连接到用户计算设备，或者，可以连接到外部计算设备(例如利用因特网服务提供商来通过因特网连接)。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本公开的 其他实施方式。本公开旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施方式仅被视为示例性的，本公开的真正范围和精神由权利要求指出。
应当理解的是，本公开并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本公开的范围仅由所附的权利要求来限。

Claims (10)

  1. 一种应用程序安全检测方法，其特征在于，包括：
    解析待检测应用程序的代码，生成所述待检测应用程序的控制流图；
    在所述控制流图中查找所述待检测应用程序中的网页视图对象；
    从所述网页视图对象中提取经过重新编写的类信息；
    检测所述经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险。
  2. 根据权利要求1所述的方法，其特征在于，所述待检测应用程序的代码，通过以下方式获取：
    通过反编译所述待检测应用程序的文件，得到所述待检测应用程序的Smali代码和/或可扩展标记语言XML代码。
  3. 根据权利要求1所述的方法，其特征在于，所述解析待检测应用程序的代码，生成所述待检测应用程序的控制流图，包括：
    对所述待检测应用程序的代码进行控制流分析，生成所述待检测应用程序的控制流图；
    对所述待检测应用程序的代码进行函数调用分析，生成所述待检测应用程序的函数调用图；
    对所述待检测应用程序的组件进行生命周期分析，并结合所述控制流图和所述函数调用图，生成所述待检测应用程序的过程间控制流图。
  4. 根据权利要求3所述的方法，其特征在于，所述在所述控制流图中查找所述待检测应用程序中的网页视图对象，包括：
    遍历所述过程间控制流图中的节点，以查找所述待检测应用程序中的网页视图对象。
  5. 根据权利要求1所述的方法，其特征在于，所述从所述网页视图对象中提取经过重新编写的类信息，包括：
    当检测所述网页视图对象中的WebViewClient类经过重新编写时，获取所述WebViewClient类中关于SSL错误的设置信息；
    当检测所述网页视图对象中的WebViewClient类未经过重新编写时，确定不存在SSL风险。
  6. 根据权利要求5所述的方法，其特征在于，所述检测所述经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险，包括：
    当检测所述WebViewClient类重载onReceivedSslError方法时，判断所述onReceivedSslError方法中是否包括选择忽略错误SSL的设置信息，以确定是否存在SSL风险。
  7. 根据权利要求6所述的方法，其特征在于，所述判断所述onReceivedSslError 方法中是否包括选择忽略错误SSL的设置信息，以确定是否存在SSL风险，包括：
    当检测到所述onReceivedSslError方法中调用了SslErrorHandler类的proceed语句时，判断所述proceed语句是否在if语句内，且所述if语句的判断条件是否由用户的输入信息确定；
    如果所述proceed语句在if语句内，且所述if语句的判断条件由用户的输入信息确定，则确定不存在SSL风险。
  8. 一种应用程序安全检测装置，其特征在于，包括：
    代码解析模块，用于解析待检测应用程序的代码，生成所述待检测应用程序的控制流图；
    对象查找模块，用于在所述控制流图中查找所述待检测应用程序中的网页视图对象；
    信息提取模块，用于从所述网页视图对象中提取经过重新编写的类信息；
    风险确定模块，用于检测所述经过重新编写的类信息中关于安全套接层协议SSL错误的设置信息，以确定是否存在SSL风险。
  9. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现权利要求1至7任一项所述的方法。
  10. 一种电子设备，其特征在于，包括：
    处理器；以及
    存储器，用于存储所述处理器的可执行指令；
    其中，所述处理器配置为经由执行所述可执行指令来执行权利要求1至7任一项所述的方法。
PCT/CN2020/090351 2020-05-14 2020-05-14 应用程序安全检测方法、装置、存储介质及电子设备 WO2021226961A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080100517.1A CN115485685A (zh) 2020-05-14 2020-05-14 应用程序安全检测方法、装置、存储介质及电子设备
PCT/CN2020/090351 WO2021226961A1 (zh) 2020-05-14 2020-05-14 应用程序安全检测方法、装置、存储介质及电子设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/090351 WO2021226961A1 (zh) 2020-05-14 2020-05-14 应用程序安全检测方法、装置、存储介质及电子设备

Publications (1)

Publication Number Publication Date
WO2021226961A1 true WO2021226961A1 (zh) 2021-11-18

Family

ID=78526298

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/090351 WO2021226961A1 (zh) 2020-05-14 2020-05-14 应用程序安全检测方法、装置、存储介质及电子设备

Country Status (2)

Country Link
CN (1) CN115485685A (zh)
WO (1) WO2021226961A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114722396A (zh) * 2022-05-18 2022-07-08 北京长亭未来科技有限公司 一种检测反弹Shell进程的方法、系统及设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104484607A (zh) * 2014-12-16 2015-04-01 上海交通大学 Android应用程序安全性测试的通用方法及系统
CN106709356A (zh) * 2016-12-07 2017-05-24 西安电子科技大学 基于静态污点分析和符号执行的安卓应用漏洞挖掘方法
CN110276202A (zh) * 2019-06-24 2019-09-24 深圳前海微众银行股份有限公司 一种反序列化漏洞的检测方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104484607A (zh) * 2014-12-16 2015-04-01 上海交通大学 Android应用程序安全性测试的通用方法及系统
CN106709356A (zh) * 2016-12-07 2017-05-24 西安电子科技大学 基于静态污点分析和符号执行的安卓应用漏洞挖掘方法
CN110276202A (zh) * 2019-06-24 2019-09-24 深圳前海微众银行股份有限公司 一种反序列化漏洞的检测方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ANONYMOUS: "Android Safety Inspection Report", 30 August 2019 (2019-08-30), XP055866198, Retrieved from the Internet <URL:https://smartsds-1253329830.cos.ap-shanghai.myqcloud.com/Android.pdf> *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114722396A (zh) * 2022-05-18 2022-07-08 北京长亭未来科技有限公司 一种检测反弹Shell进程的方法、系统及设备
CN114722396B (zh) * 2022-05-18 2022-09-23 北京长亭未来科技有限公司 一种检测反弹Shell进程的方法、系统及设备

Also Published As

Publication number Publication date
CN115485685A (zh) 2022-12-16

Similar Documents

Publication Publication Date Title
WO2020244492A1 (zh) 一种投屏显示方法及电子设备
CN112291764B (zh) 一种内容接续系统
US11934352B2 (en) Card rendering method and electronic device
WO2020244623A1 (zh) 一种空鼠模式实现方法及相关设备
WO2021027630A1 (zh) 补丁方法、相关装置及系统
CN109359262B (zh) 动画播放方法、装置、终端及存储介质
CN111382418B (zh) 应用程序权限管理方法、装置、存储介质与电子设备
CN111563466B (zh) 人脸检测方法及相关产品
WO2022089121A1 (zh) 处理推送消息的方法和装置
WO2022042637A1 (zh) 一种蓝牙数据传输方法及相关装置
WO2022135269A1 (zh) 一种利用其它设备授权的方法、电子设备和系统
WO2022267635A1 (zh) 用于数据交互的方法和装置
US20240095000A1 (en) Plug-In Installation Method, Apparatus, and Storage Medium
WO2024037032A1 (zh) 账号登录的方法及电子设备
CN111556479B (zh) 信息共享方法及相关装置
US20210385187A1 (en) Method and device for performing domain name resolution by sending key value to grs server
WO2022253158A1 (zh) 一种用户隐私保护方法及装置
CN113190362A (zh) 服务调用方法、装置、计算机设备及存储介质
CN113516991A (zh) 基于群组会话的音频播放、设备管理方法及装置
WO2021226961A1 (zh) 应用程序安全检测方法、装置、存储介质及电子设备
US20220292141A1 (en) Quick Application Startup Method and Related Apparatus
WO2023029916A1 (zh) 批注展示方法、装置、终端设备及可读存储介质
WO2022111529A1 (zh) 一种应用程序的调试方法及电子设备
CN117425227A (zh) 建立基于WiFi直接连接的会话的方法和装置
WO2021232311A1 (zh) 文件处理方法、文件处理装置、存储介质与电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20935814

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 12/01/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20935814

Country of ref document: EP

Kind code of ref document: A1