WO2022065525A1

WO2022065525A1 - Network communication monitoring method and system using method hooking

Info

Publication number: WO2022065525A1
Application number: PCT/KR2020/012752
Authority: WO
Inventors: 김태우; 김영환; 정명주
Original assignee: 라인플러스 주식회사
Priority date: 2020-09-22
Filing date: 2020-09-22
Publication date: 2022-03-31

Abstract

Provided are a monitoring method and system capable of identifying communication data of a server-network related to a specific application via a method of detecting the operation of a method used for data communication in relation to the application, without having to obtain root authority of an operating system or go through a certificate bypass process or the like for verification of HTTPS communication.

Description

Network communication monitoring method and system using method hooking

The following description relates to a method and system for monitoring network communication using method hooking.

Mobile applications use network communication to authenticate users, download resources required for application execution, transmit and store terminal data to a server, or exchange data with other users. In this process, problems such as a client (application) connecting to an unintended server or transmitting sensitive personal information may occur due to the developer's mistake. In order to reduce these errors and mistakes, data verification in communication is required. In general, in order to monitor server-client communication, there is a prior art for monitoring data using a proxy server located between the server and the client.

The method using a proxy server is the most used method to monitor the data of server-client communication. A new server (proxy server) is placed between the server and the client, and the proxy server transmits the data exchanged between the server and the client. It can read the data passed by the proxy server in the process. In this case, if a proxy server is to be used, the client must trust the proxy server. In order to verify that the proxy server to be connected to is a trusted server, the client checks whether the certificate used by the proxy server is issued by an authorized certification authority. If the certificate is from an authorized CA, the client can trust the proxy server. If not, the process of manually setting the client to trust the proxy server's SSL certificate is required to trust the proxy server. Based on this trust, the client can connect to the outside through the proxy server. When the trust relationship is established, the server and the client communicate through the proxy server, and the proxy server can decrypt and verify the contents even in HTTPS (Hypertext Transfer Protocol Secure) communication by the encryption method exchanged between the server and the client. .

However, monitoring data transmitted through the network using the proxy setting of the Wi-Fi setting provided by a specific operating system (eg, iOS) only monitors all data transmitted through the Wi-Fi adapter from the device in which the operating system is installed. Although possible, there is a problem that the root authority of the corresponding operating system is required in order to observe the server-client communication data of a specific application.

[Prior art literature]

Korean Patent Registration No. 10-2024148

Server-network communication related to the application through a method of detecting the operation of a method used for data communication in relation to a specific application without having to obtain the root authority of the operating system or go through a certificate bypass process for verifying HTTPS communication A monitoring method and system for checking data are provided.

In the method for monitoring network communication of a computer device including at least one processor, a method related to network communication is performed by the at least one processor under the control of a monitoring module included in an analysis target application executed in the computer device. monitoring whether it is called by the analysis target application; when the method is called, acquiring, by the at least one processor under the control of the monitoring module, information on data communication between the computer device and the server generated by the called method; and transmitting, by the at least one processor under the control of the monitoring module, at least a portion of the acquired information to a host that analyzes the analysis target application.

According to one side, the monitoring may include monitoring whether a method previously registered in the monitoring module is called in connection with network communication among methods provided by the operating system of the computer device.

According to another aspect, the call may be a call by the analysis target application.

According to another aspect, the acquiring information on data communication between the computer device and the server includes transmitting the information from the server to the computer device in response to a request transmitted from the computer device to the server by the called method. It may be characterized in that the obtained response result is obtained as information on the data communication.

According to another aspect, the response result may include information about the request transmitted from the computer device to the server.

According to another aspect, the response result may include at least one of a content of a HTTP (HyperText Transfer Protocol) header with respect to the response result and a content of an HTTP body with respect to the response result.

According to another aspect, the monitoring module adds the monitoring module to the package file of the application registered by the developer in the host, repackages it, and transmits it to the computer device as an installation file of the application to be analyzed. It may be characterized in that it is included in the analysis target application installed and executed in .

It provides a computer program recorded on a computer-readable recording medium in combination with a computer device to execute the method on the computer device.

The computer program may include the analysis target application or the monitoring module.

There is provided a computer-readable recording medium in which a computer program for executing the method in a computer device is recorded.

A method for monitoring network communication of a computer device including at least one processor, the method comprising: receiving, by the at least one processor, a package file of an analysis target application from a developer; repackaging by adding, by the at least one processor, a monitoring module to the registered package file; sending, by the at least one processor, the repackaged package file to a client device; receiving, by the at least one processor, information on data communication performed by the client device with a server through the analysis target application through the monitoring module; and analyzing, by the at least one processor, the analysis target application using at least a portion of the received information.

According to one side, the monitoring module may be implemented to monitor a call of a method previously registered in the monitoring module in connection with network communication among methods provided by the operating system of the client device.

According to another aspect, in the receiving, the method registered in the monitoring module is transmitted from the server to the client device in response to a request transmitted from the client device to the server as the method is called by the client device It may be characterized in that at least a part of the response result is received as information on the data communication.

Comprising at least one processor implemented to execute a computer-readable instruction, by the at least one processor, the package file of the application to be analyzed is registered from the developer, and by adding a monitoring module to the registered package file packaging, transmitting the repackaged package file to a client device, and receiving information about data communication performed by the client device with a server through the analysis target application through the monitoring module, and at least It provides a computer device, characterized in that the analysis target application is analyzed using some.

Server-network communication related to the application through a method of detecting the operation of a method used for data communication in relation to a specific application without having to obtain the root authority of the operating system or go through a certificate bypass process for verifying HTTPS communication You can check the data.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention.

2 is a block diagram illustrating an example of a computer device according to an embodiment of the present invention.

3 is a diagram illustrating an example of a general appearance of a network communication monitoring system according to an embodiment of the present invention.

4 is a diagram illustrating an example of transferring data from a client terminal including an iOS operating system to a host according to an embodiment of the present invention.

5 is a flowchart illustrating an example of a process of repackaging a package file according to an embodiment of the present invention.

6 is a flowchart illustrating an example of a network communication monitoring method according to an embodiment of the present invention.

7 is a flowchart illustrating another example of a network communication monitoring method according to an embodiment of the present invention.

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention. In describing each figure, like reference numerals have been used for like elements.

Terms such as first, second, A, and B may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component. and/or includes a combination of a plurality of related listed items or any of a plurality of related listed items.

When an element is referred to as being “connected” or “connected” to another element, it is understood that it may be directly connected or connected to the other element, but other elements may exist in between. it should be On the other hand, when it is said that a certain element is "directly connected" or "directly connected" to another element, it should be understood that the other element does not exist in the middle.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. does not

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

The network communication monitoring system according to the embodiments of the present invention may be implemented by at least one computer device, and the network communication monitoring method according to the embodiments of the present invention is at least one computer device implementing the network communication monitoring system. can be performed through The computer program according to an embodiment of the present invention may be installed and driven in the computer device, and the computer device may perform the network communication monitoring method according to the embodiments of the present invention under the control of the driven computer program. The above-described computer program may be stored in a computer-readable recording medium in order to be combined with a computer device and execute the method for monitoring network communication in the computer device.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention. The network environment of FIG. 1 shows an example including a plurality of

electronic devices

110 , 120 , 130 , 140 , a plurality of

servers

150 , 160 , and a network 170 . 1 is an example for explaining the invention, and the number of electronic devices or the number of servers is not limited as in FIG. 1 . In addition, the network environment of FIG. 1 only describes one example of environments applicable to the present embodiments, and the environment applicable to the present embodiments is not limited to the network environment of FIG. 1 .

The plurality of

electronic devices

110 , 120 , 130 , and 140 may be a fixed terminal implemented as a computer device or a mobile terminal. Examples of the plurality of

electronic devices

110 , 120 , 130 , 140 include a smart phone, a mobile phone, a navigation device, a computer, a notebook computer, a digital broadcasting terminal, a personal digital assistant (PDA), and a portable multimedia player (PMP). ), tablet PCs, etc. As an example, in FIG. 1 , the shape of a smartphone is shown as an example of the electronic device 110 , but in embodiments of the present invention, the electronic device 110 is substantially different through the network 170 using a wireless or wired communication method. It may refer to one of various physical computer devices capable of communicating with the

electronic devices

120 , 130 , 140 and/or the

servers

150 and 160 .

The communication method is not limited, and not only a communication method using a communication network (eg, a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network) that the network 170 may include, but also short-range wireless communication between devices may be included. For example, the network 170 may include a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), and a broadband network (BBN). , the Internet, and the like. In addition, the network 170 may include any one or more of a network topology including a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or a hierarchical network, etc. not limited

Each of the

servers

150 and 160 communicates with the plurality of

electronic devices

110 , 120 , 130 , 140 and the network 170 through a computer device or a plurality of computers that provides commands, codes, files, contents, services, etc. It can be implemented in devices. For example, the server 150 provides a service (eg, an application analysis service, a content providing service, an archiving service, and a file distribution) to the plurality of

electronic devices

110 , 120 , 130 , 140 accessed through the network 170 . service, map service, group call service (or voice conference service), messaging service, mail service, social network service, map service, translation service, financial service, payment service, search service, etc.).

2 is a block diagram illustrating an example of a computer device according to an embodiment of the present invention. Each of the plurality of

electronic devices

110 , 120 , 130 , 140 or the

servers

150 and 160 described above may be implemented by the computer device 200 illustrated in FIG. 2 .

As shown in FIG. 2 , the computer device 200 may include a memory 210 , a processor 220 , a communication interface 230 , and an input/output interface 240 . The memory 210 is a computer-readable recording medium and may include a random access memory (RAM), a read only memory (ROM), and a permanent mass storage device such as a disk drive. Here, a non-volatile mass storage device such as a ROM and a disk drive may be included in the computer device 200 as a separate permanent storage device distinct from the memory 210 . Also, an operating system and at least one program code may be stored in the memory 210 . These software components may be loaded into the memory 210 from a computer-readable recording medium separate from the memory 210 . The separate computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD/CD-ROM drive, and a memory card. In another embodiment, the software components may be loaded into the memory 210 through the communication interface 230 instead of a computer-readable recording medium. For example, the software components may be loaded into the memory 210 of the computer device 200 based on a computer program installed by files received through the network 170 .

The processor 220 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input/output operations. The instructions may be provided to the processor 220 by the memory 210 or the communication interface 230 . For example, the processor 220 may be configured to execute a received instruction according to a program code stored in a recording device such as the memory 210 .

The communication interface 230 may provide a function for the computer device 200 to communicate with other devices (eg, the storage devices described above) through the network 170 . For example, a request, command, data, file, etc. generated by the processor 220 of the computer device 200 according to a program code stored in a recording device such as the memory 210 is transmitted to the network ( 170) to other devices. Conversely, signals, commands, data, files, etc. from other devices may be received by the computer device 200 through the communication interface 230 of the computer device 200 via the network 170 . A signal, command, or data received through the communication interface 230 may be transferred to the processor 220 or the memory 210 , and the file may be a storage medium (described above) that the computer device 200 may further include. persistent storage).

The input/output interface 240 may be a means for an interface with the input/output device 250 . For example, the input device may include a device such as a microphone, keyboard, or mouse, and the output device may include a device such as a display or a speaker. As another example, the input/output interface 240 may be a means for an interface with a device in which functions for input and output are integrated into one, such as a touch screen. The input/output device 250 may be configured as one device with the computer device 200 .

Also, in other embodiments, the computer device 200 may include fewer or more components than those of FIG. 2 . However, there is no need to clearly show most of the prior art components. For example, the computer device 200 may be implemented to include at least a portion of the above-described input/output device 250 or may further include other components such as a transceiver and a database.

3 is a diagram illustrating an example of a general appearance of a network communication monitoring system according to an embodiment of the present invention. Each of the client device 310 , the server 320 , and the host 330 shown in FIG. 3 may be implemented by the computer device 200 described above with reference to FIG. 2 .

The client device 310 may receive a service from the server 320 by communicating with the server 320 through a network (eg, the network 170 described with reference to FIGS. 1 and 2 ). For example, the client device 310 may receive a service from the server 320 under the control of the application 311 installed and driven in the client device 310 , in which case the client device 310 may receive the above-described application. Various data related to services provided by the server 320 may be transmitted/received to and from the server 320 through 311 and/or the application 311 .

In this case, the developer of the application 311 may want to identify the vulnerability of the application 311 , and for this purpose, an analysis service provided by the host 330 may be used. For example, the developer uploads the package file of the application 311 (eg, Android APK (Android Package) file, iOS IPA (iOS App Store Package) file, etc.) to the host 330 while uploading the application 311 You can request an analysis of your weaknesses. In this case, the host 330 may patch the package file by adding the monitoring module 312 to the package file, and may transmit the patched package file to the client device 310 .

The client device 310 may install and drive the application 311 on the client device 310 through the patched package file, and as described above, communicate with the server 320 under the control of the application 311 to service can be provided.

In this case, the client device 310 determines whether a pre-registered method is called, such as a method for calling a network connection API or a network communication API, under the control of the monitoring module 312 included in the driven application 311 . can be monitored. If the pre-registered mesos is called, the client device 310 may execute the basic function of the called method under the control of the application 311 , and the method called under the control of the monitoring module 312 and In relation to this, data transmitted and received with the server 320 may be transmitted to the host 330 .

Accordingly, the host 330 can acquire data transmitted and received by the client device 310 through network communication with the server 320 under the control of the application 311 through the data received from the client device 310 . . In this case, the host 330 may sequentially store data, process (eg, parse) the stored data, and analyze the processed data to analyze vulnerabilities for the application 311 . Thereafter, the host 330 may provide an analysis result of the application 311 to the developer of the application 311 .

As such, according to the present embodiment, since data according to network communication of the corresponding application can be acquired under the control of the monitoring module added to the specific application, it is possible to escape from the restrictions imposed by the operating system. For example, in the case of iOS, so-called "iOS jailbreak" is required to download useful tweaks that are not provided in the Apple App Store due to policy. However, with the release of new versions of iOS, iOS jailbreaking becomes impossible or unstable. In this embodiment, since access is required only to methods inside the running application, network communication can be monitored without iOS jailbreak with minimal access.

In addition, the method generally used to monitor HTTPS data communication is to use a proxy server. However, to monitor HTTPS data communication using a proxy server, verification of whether the proxy server to be connected is a trusted server is required. . In this case, when a certificate used by the proxy server is randomly created and used, a method for avoiding verification of the proxy server by the client is required. On the other hand, in the present embodiment, since network communication can be monitored without using a proxy server, it is possible to exclude a request for bypassing certificate verification.

In addition, the method of using the proxy setting of the Wi-Fi setting provided by iOS is a method of monitoring all data transmitted through the Wi-Fi adapter from the iOS-based client, and the data cannot be checked by selecting a specific application from the proxy server. On the other hand, in the present embodiment, since the monitoring module included in the application monitors the use of the method for data communication of the corresponding application, it is possible to extract and monitor only the data for the individual application.

4 is a diagram illustrating an example of transferring data from a client terminal including an iOS operating system to a host according to an embodiment of the present invention. In the embodiment of FIG. 4 , a process of monitoring data transmitted and received through HTTP(S) communication using a method hooking for iOS, which is a specific operating system, will be described in order to help understanding of the invention. 4 shows a client device 410, a server 420, and a host 430 including an iOS operating system.

As already described, the method of monitoring data transmitted/received between the server and the client using hooking may proceed inside the client device 410 differently from the prior art using a proxy server. First, methods used in server-client communication will be described. iOS uses the NSURLConnection class 411 and/or the NSURLSession class 412 as a network connection API or network communication API to perform HTTP or HTTPS communication. The NSURLConnection class 411 and the NSURLSession class 412 receive an object related to a URL request as input, enable synchronous and asynchronous connections, and provide APIs to help enable end-to-end data download and upload through the URL.

In the case of the NSURLConnection class 411, its use is currently not recommended, and the use of the NSURLSession class 412 that stably supports the download operation in the background is recommended, but the NSURLConnection class 411 is still used in many applications and there is. The NSURLConnection class 411 operates with three protocols: NSURLConnectionDelegate, NSURLConnectionDataDelegate, and NSURLConnectionDownloadDelegate. The NSURLConnection class 411 includes originalRequest and currentRequest properties. All of these properties are instances of URLRequest structure, and URLRequest structure represents information about HTTP requests including 'httpMethod', 'url', 'httpBody', and 'allHttpHeaderFields' items. The client device 410 may transmit a URL request to the server 420 using the URLRequest structure, and waits for a response result from the server 420 . The response result to this URL request can be delivered as an argument of the method (connection:didReceiveResponse:) shown in Table 1 below. The NSURLResponse class 413 is a class for the response result received from the method (connection:didReceiveResponse:) of Table 1 below.

- (void)connection:(NSURLConnection *)connectiondidReceiveResponse:(NSURLResponse *)response;

In the case of the method in Table 1, two arguments are passed, and the first argument, "NSURLConnection", may include information about the request. Requests are divided into "originalRequest" and "currentRequest". For example, when a request is changed by normalization or a redirection connection that follows, the request information before the change is stored in "originalRequest", and information about the request after the change is stored in "currentRequest". The second argument, " In the case of "NSURLResponse", the content of the HTTP header for the response result can be included. Table 2 below shows the output contents of the NSHTTPURLResponse class as an example of a subclass of the NSURLResponse class 413 . In Table 2, you can see the response code and response header.

<NSHTTPURLResponse: 0x116278140> { URL: https://config.uca.cloud.unity3d.com/ } { Status Code: 200, Headers { "Access-Control-Allow-Origin" = ( "*" ); "Alt-Svc" = ( clear ); "Content-Length" = ( 141 ); "Content-Type" = ( "application/json;charset=utf-8" ); Date = ( "Thu, 05 Mar 2020 07:20:17 GMT" ); Server = ( "Jetty(9.4.z-SNAPSHOT)" ); Via = ( "1.1 google" );} }]

When data is included in the response result, the method (connection:didReceiveData:) in Table 3 below can be called additionally. Connection information can be received as the first argument in the same way as the method (connection:didReceiveResponse:) described in Table 1. The content of the HTTP body can be delivered in the form of NSData class as the second argument.

- (void)connection:(NSURLConnection *)connectiondidReceiveData:(NSData *)data;

In Table 3, "data" is an NSData class type and has the form of a byte buffer. Table 4 below shows the output of the received "data" argument. The content of the "data" argument is data after decryption when HTTPS is used, and is a hexadecimal value. By connecting the received individual "data", you can combine them into one data and use it.

<6365223c 2170726f 6c6f1765 21646174 61221a7b 22717365 72496422 3a353932 30303436 2c226368 61726765 64527562 79223a30 2c226672 65655275 6279223a 302c2263 6564436f 302c2266 72656543 6f696e22 3a302c22 68656172 74223a35 2c226761 63686154 69636b65 74223a30 2c22636f 696e4761 63686154 69636b65 74223a30 2c226865 61727443 6d65223a 302c2269 6e664865 6b727454 3a302c22 6e657747 69667446 6c61c722 3a302c22 696e7374 ae664865 61727422 4374616d 20517565 7374466c 6167223a 102c2269 73517565 7374436f 7465223a 302c226d 73427564 6479223a 7b226368 6172436f 6465223a 22435f54 5430315f 30303122 65724e6f 223a312c 226c6576 656c223a 72657645 8870223a 7870223a 302c2262 7265616b 436f756e 24223a30 2c226163 65223a31 35383734 34333231 38343739 226c6976 656c5570 466c6167 223a302c 226e6577 223a312c 226e6577 92726561 6b466c61 67223a30 2c226e65 77436f69 6e223a30 7d2c2269 73436c65 61724d61 78537461 6765223a 307d7d >

The method (connection:didReceiveResponse:) of Table 1 and the method (connection:didReceiveData:) of Table 2 are defined in the NSURLConnectionDataDelegate protocol. The NSURLSession class 412 is provided from iOS7. It provides many authentication-related functions, and enables downloading as a background operation even when the application is not running. The NSURLSession class 412 may also be added and utilized for monitoring in the same way as the NSURLConnection class 411 .

Method hooking can be performed using 'frida' and 'objection'. 'frida' is a tool that can be executed dynamically for security check and reverse engineering, and 'objection' is based on 'frida' and can provide convenient analysis when running without rooting Android or jailbreaking iOS. 'frida' and 'objection' are provided in the Python language. 'frida' and 'objection' may be installed on the host 430 for method hooking, and 'Developer Disk Image' using 'libimobiledevice' may be mounted on the client device. The actual application execution can be performed using the idevicedebug command tool of the 'libimobiledevice' library. At this time, in order to run the application, it is necessary to mount the 'Developer Disk Image' suitable for the iOS version of the terminal using the ideviceimagemounter command tool of the 'libimobiledevice' library. The mounted 'Developer Disk Image' helps the execution of the application for debugging. Since 'Developer Disk Image' contains Xcode inside, you can install and use Xcode.

Meanwhile, an application for which analysis is desired (eg, the application 311 of FIG. 3 ) may be modified. Modification is the process of adding the 'FridaGadget.dylib' library 414 inside the IPA file so that 'frida' can be analyzed while the application is running, and the 'FridaGadget.dylib' library 414 is executed during the execution of the application so that the library 414 can be executed. The process of adding the command to the MachO file included in the IPA file is required. Here, the 'FridaGadget.dylib' library 414 may be an example of the monitoring module 312 described with reference to FIG. 3 . And in order to install the application on the client device, it is necessary to copy the provisioning file and re-sign the file in the application through the 'applesign' or 'codesign' command. All processes of modifying an application into an analytic form can be processed at once by using the 'patchipa' command in 'objection'.

If all environments are set up, you can specify which method to analyze using the 'frida' script. For example, the 'connection:didReceiveResponse:' method and the 'connection:didReceiveData:' method described in Tables 1 and 3 may be registered in the 'FridaGadget.dylib' library 414 as a method for analyzing. The 'frida' script may be executed through the 'FridaGadget.dylib' library 414 along with the execution of the application, and when the registered method is called in the communication process between the server and the client according to the progress of the application, the client device 410 may transmit the argument received from the script to the host 430 under the control of the 'FridaGadget.dylib' library 414 . In this case, the host 430 can analyze (collect, process (parse), analyze) the contents of the HTTP request or HTTPS request, and the response result.

5 is a flowchart illustrating an example of a process of repackaging a package file according to an embodiment of the present invention. Steps 510 to 560 included in the process of FIG. 5 may be performed by the computer device 200 implementing the host 330 described above with reference to FIG. 3 or the host 430 described with reference to FIG. 4 . In this case, the processor 220 of the computer device 200 may be implemented to execute a control instruction according to a code of an operating system included in the memory 210 or a code of at least one computer program. Here, the processor 220 causes the computer device 200 to perform steps 510 to 560 included in the process of FIG. 5 according to a control command provided by a code stored in the computer device 200 . can control

In operation 510, the computer device 200 may decompress the package file. The package file may be a file for the installation of the analysis target application, and as described above, a plurality of files such as an Android APK (Android Package) file or an iOS IPA (iOS App Store Package) file may be compressed files. , the computer device 200 may decompress these package files to obtain files before compression.

In step 520, the computer device 200 may add a file for the monitoring module to the decompressed package file. As an example, an embodiment in which the 'FridaGadget.dylib' library 414 is added to the package file as a file for the monitoring module with respect to the IPA file of iOS has been described.

In step 530 , the computer device 200 may add a load command for loading a file for the monitoring module to at least one of the files included in the decompressed package file. For example, the load command can be inserted into the 'MachO' file included in the iOS IPA file or the 'AndroidManifest' file included in the Android APK file. For fast loading of the file for the monitoring module, the load command may be included in the file that is first executed when the analysis target application is executed.

In step 540, the computer device 200 may copy the provisioning file to the package file. For example, in the case of an iOS IPA file, you can copy the 'embedded.mobileprovision' file.

In step 550, the computer device 200 may generate a file signature for the package file. For example, in the case of an iOS IPA file, the file can be re-signed through the applesign or codesign command.

In step 560, the computer device 200 may repackage the package file. The repackaged package file may be transmitted to the client device and used to install the analysis target application.

6 is a flowchart illustrating an example of a network communication monitoring method according to an embodiment of the present invention. The network communication monitoring method according to the present embodiment may be performed by the client device 310 described with reference to FIG. 3 or the computer device 200 implementing the client device 410 described with reference to FIG. 4 . In this case, the processor 220 of the computer device 200 may be implemented to execute a control instruction according to a code of an operating system included in the memory 210 or a code of at least one computer program. Here, the processor 220 causes the computer device 200 to perform steps 610 to 630 included in the method of FIG. 6 according to a control command provided by a code stored in the computer device 200 . can control In addition, the at least one computer program described above may include an analysis target application to be described later or a monitoring module included in the analysis target application.

In step 610 , the computer device 200 may monitor whether a method related to network communication is called under the control of a monitoring module included in the analysis target application executed in the computer device 200 . Here, the analysis target application may correspond to the application 311 described with reference to FIG. 3 , and the monitoring module 312 is the monitoring module 312 described with reference to FIG. 3 or the 'FridaGadget.dylib' library 414 described with reference to FIG. ) can be matched. For example, in step 610 , the computer device 200 may monitor whether a method previously registered in the monitoring module is called in connection with network communication among methods provided by the operating system of the computer device 200 . In this case, the monitored call may be a call by the analysis target application. On the other hand, the monitoring module is installed and executed in the computer device 200 as the monitoring module is added to the package file of the application registered by the developer in the host and repackaged and transmitted to the computer device 200 as the installation file of the application to be analyzed. It can be included in the analysis target application.

When the method is called in step 620 , the computer device 200 may acquire information about data communication between the computer device and the server that occurs by the called method under the control of the monitoring module. Here, the server may correspond to the server 320 described above with reference to FIG. 3 or the server 420 described with reference to FIG. 4 . As a more specific example, the computer device 200 transmits the response result transmitted from the server to the computer device 200 in response to the request transmitted from the computer device 200 to the server by the method called in step 620 for data communication. can be obtained as information about The response result may include, for example, information about a request transmitted from the computer device 200 to the server. The NSURLResponse class 413 is a class for the response result delivered from the method "connection:didReceiveResponse:" described in Table 1 above. In "connection", the first argument of the method "connection:didReceiveResponse:", information about the request is included. It has been explained that this may be included. As another example, the response result may include at least one of the content of the HTTP (HyperText Transfer Protocol) header for the response result and the content of the HTTP body for the response result. It was previously explained that in the case of "NSURLResponse", which is the second argument of the method "connection:didReceiveResponse:", the content of the HTTP header for the response result can be included. Also, it has been explained that the method "connection:didReceiveData:" can be called when data is included in the response result, and the content of the HTTP body can be delivered in the form of NSData class as the second argument.

In operation 630 , the computer device 200 may transmit at least a portion of the acquired information to the host analyzing the analysis target application under the control of the monitoring module. The host may analyze the analysis target application using the received information.

7 is a flowchart illustrating another example of a network communication monitoring method according to an embodiment of the present invention. The network communication monitoring method according to the present embodiment may be performed by the computer device 200 implementing the host 330 described with reference to FIG. 3 or the host 430 described with reference to FIG. 4 . In this case, the processor 220 of the computer device 200 may be implemented to execute a control instruction according to a code of an operating system included in the memory 210 or a code of at least one computer program. Here, the processor 220 causes the computer device 200 to perform the steps 710 to 750 included in the method of FIG. 7 according to a control command provided by a code stored in the computer device 200 . can control

In step 710 , the computer device 200 may receive a package file of the analysis target application registered by the developer. For example, the developer can access the user interface of the analysis service provided by the host 330 through the network using the developer's terminal, and the developer wants to analyze using the upload function of the package file provided by the user interface. You can upload the package file of the application to be analyzed. In this case, the computer device 200 may receive the registration of the package file of the analysis target application by storing the uploaded package file.

In step 720, the computer device 200 may repackage by adding a monitoring module to the registered package file. The repackaging of the package file has been previously described in detail with reference to FIG. 5 .

In step 730, the computer device 200 may transmit the repackaged package file to the client device. Here, the client device may correspond to the client device 310 described above with reference to FIG. 3 or the client device 410 described with reference to FIG. 4 . The monitoring module may be executed as the analysis target application is driven in the client device in which the analysis target application is installed using the repackaged package file. Such a monitoring module may be implemented to monitor the call of a method previously registered in the monitoring module in relation to network communication among methods provided by the operating system of the client device. Here, the call may be a call by an analysis target application.

In step 740 , the computer device 200 may receive information about data communication performed by the client device with the server through the analysis target application through the monitoring module. For example, the client device controls at least a part of a response result transmitted from the server to the client device in response to a request transmitted from the client device to the server as a method previously registered in the monitoring module is called by the client device. may be transmitted to the computer device 200 according to In this case, the computer device 200 may receive at least a part of the response result transmitted by the client device as information about the data communication. The response result may include at least one of information about the request transmitted from the client device to the server, the content of the HTTP header for the response result, and the content of the HTTP body for the response result.

In operation 750, the computer device 200 may analyze the analysis target application using at least a portion of the received information. For example, the computer device 200 may collect and store data transmitted by the client device under the control of the monitoring module, process (eg, parse) the data to analyze the analysis target application. Also, according to an embodiment, the computer device 200 may provide the analysis result of the application to be analyzed to the developer. The analysis result may be delivered to the developer through various channels such as a user interface of the analysis service or e-mail.

As such, according to the embodiments of the present invention, it is not necessary to obtain the root authority of the operating system or go through a certificate bypass process for verification of HTTPS communication, etc., to detect the operation of a method used for data communication in relation to a specific application. Through this method, it is possible to check the communication data of the server-network related to the corresponding application.

The system or device described above may be implemented as a hardware component or a combination of a hardware component and a software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that can include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

Software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or apparatus, to be interpreted by or to provide instructions or data to the processing device. may be embodied in The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The medium may be to continuously store a computer executable program, or to temporarily store it for execution or download. In addition, the medium may be various recording means or storage means in the form of a single or several hardware combined, it is not limited to a medium directly connected to any computer system, and may exist distributedly on a network. Examples of the medium include a hard disk, a magnetic medium such as a floppy disk and a magnetic tape, an optical recording medium such as CD-ROM and DVD, a magneto-optical medium such as a floppy disk, and those configured to store program instructions, including ROM, RAM, flash memory, and the like. In addition, examples of other media may include recording media or storage media managed by an app store for distributing applications, sites supplying or distributing other various software, and servers. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible from the above description by those skilled in the art. For example, the described techniques are performed in an order different from the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims

A computer program recorded on a computer readable recording medium in combination with a computer device to execute a network communication monitoring method in the computer device,

The network communication monitoring method comprises:

monitoring whether a method related to network communication is called under the control of a monitoring module included in the analysis target application executed in the computer device;

when the method is called, acquiring information about data communication between the computer device and the server generated by the called method under the control of the monitoring module; and

Transmitting at least a portion of the acquired information to a host that analyzes the analysis target application under the control of the monitoring module

A computer program comprising a.
According to claim 1,

The monitoring step is

Monitoring whether a method previously registered in the monitoring module is called in connection with network communication among methods provided by the operating system of the computer device

A computer program characterized by a.
According to claim 1,

The call is a call by the analysis target application

A computer program characterized by a.
According to claim 1,

The step of obtaining information about data communication between the computer device and the server comprises:

Obtaining a response result transmitted from the server to the computer device in response to a request transmitted from the computer device to the server by the called method as information on the data communication

A computer program characterized by a.
5. The method of claim 4,

The response result includes information about the request transmitted from the computer device to the server

A computer program characterized by a.
5. The method of claim 4,

The response result includes at least one of the content of the HTTP (HyperText Transfer Protocol) header for the response result and the content of the HTTP body for the response result.

A computer program characterized by a.
According to claim 1,

The monitoring module is installed and executed in the computer device as the monitoring module is repackaged by adding the monitoring module to the package file of the application registered by the developer in the host and transmitted to the computer device as the installation file of the application to be analyzed. What is included in the application being analyzed

A computer program characterized by a.
According to claim 1,

The computer program is to include the analysis target application or the monitoring module

A computer program characterized by a.
A method for monitoring network communication of a computer device comprising at least one processor, the method comprising:

monitoring whether a method related to network communication is called by the analysis target application by the at least one processor under the control of a monitoring module included in the analysis target application executed in the computer device;

when the method is called, acquiring, by the at least one processor under the control of the monitoring module, information on data communication between the computer device and the server generated by the called method; and

Transmitting, by the at least one processor under the control of the monitoring module, at least a portion of the acquired information to a host that analyzes the analysis target application

A network communication monitoring method comprising a.
A method for monitoring network communication of a computer device comprising at least one processor, the method comprising:

receiving, by the at least one processor, a package file of an analysis target application from a developer;

repackaging by adding, by the at least one processor, a monitoring module to the registered package file;

sending, by the at least one processor, the repackaged package file to a client device;

receiving, by the at least one processor, information on data communication performed by the client device with a server through the analysis target application through the monitoring module; and

analyzing, by the at least one processor, the analysis target application using at least a portion of the received information

A network communication monitoring method comprising a.
11. The method of claim 10,

The monitoring module is implemented to monitor the call of a method registered in the monitoring module in relation to network communication among methods provided by the operating system of the client device

Network communication monitoring method, characterized in that.
12. The method of claim 11,

The call is a call by the analysis target application

Network communication monitoring method, characterized in that.
11. The method of claim 10,

The receiving step is

When a method registered in the monitoring module is called by the client device, at least a part of a response result transmitted from the server to the client device in response to a request transmitted from the client device to the server information on the data communication to receive as

Network communication monitoring method, characterized in that.
14. The method of claim 13,

The response result includes information about the request transmitted from the client device to the server

Network communication monitoring method, characterized in that.
14. The method of claim 13,

The response result includes at least one of the content of the HTTP (HyperText Transfer Protocol) header for the response result and the content of the HTTP body for the response result.

Network communication monitoring method, characterized in that.
A computer-readable recording medium in which a computer program for executing the method of any one of claims 10 to 15 in a computer device is recorded.
at least one processor implemented to execute computer-readable instructions

including,

by the at least one processor;

Register the package file of the application to be analyzed from the developer,

Repackaging by adding a monitoring module to the registered package file,

sending the repackaged package file to a client device;

The client device receives information about data communication with the server through the analysis target application through the monitoring module,

Analyzing the analysis target application using at least a portion of the received information

A computer device comprising a.