WO2023029325A1

WO2023029325A1 - Android privilege escalation attack discovery method based on dynamic permission set

Info

Publication number: WO2023029325A1
Application number: PCT/CN2021/142968
Authority: WO
Inventors: 徐潜; 章庆; 贺伟; 马颂华
Original assignee: 天翼电子商务有限公司
Priority date: 2021-09-06
Filing date: 2021-12-30
Publication date: 2023-03-09
Also published as: CN113923663A; JP2023543605A

Abstract

The present invention relates to the fields of system security and privacy protection under environments of Android security, mobile Internet, and industrial Internet, and provides an Android privilege escalation attack discovery method based on a dynamic permission set. For a privilege escalation attack problem existing in an Android platform, a malicious App privilege escalation attack discovery method based on a dynamic permission set is provided. Permission distribution characteristics of strongly connected branches are first constructed and analyzed, and dynamic permission set division is designed; a permission escalation path is abstracted on the basis of coupling of an information flow and a permission set; and finally, a dynamic permission set updating algorithm of linear time is provided, and the decision control of fine granularity is achieved by tracking the permission set during operation. The provided security detection algorithm well resists privilege escalation attacks and reduces time complexity.

Description

A method for discovering Android privilege escalation attacks based on dynamic permission sets

technical field

The invention relates to the field of system security and privacy protection under the environment of Android security, mobile Internet and industrial Internet, in particular to a method for discovering Android privilege escalation attacks based on a dynamic permission set.

Background technique

The Android system has become the mainstream operating system on the mobile platform, and its security issues are attracting more and more attention. Android uses permission mechanism, isolation mechanism, application signature and other methods to ensure the security of the platform, but there are serious defects: 1) the authorization of the application is entrusted to users who lack security protection vigilance; 2) there are privilege escalation attacks.

At present, the work on Android security mainly includes permission analysis, runtime detection and data tracking, static analysis, etc. However, these mechanisms have no effective defense against privilege escalation attacks, especially runtime multi-application collusion attacks. Many access control strategies introduce directed graphs into the Android security model, but there are problems of high time complexity and dependence on the communication direction between Apps. Aiming at these problems, the present invention builds a strongly connected aggregation graph on the basis of a directed graph of process communication, replaces a single application permission with a dynamic permission set, and tracks the permission set through the merge search and permission promotion path to realize the shared meaning The linear-time decision-making algorithm under .

Contents of the invention

The technical problem to be solved by the present invention is to overcome the defects of the prior art and provide a method for discovering Android privilege escalation attacks based on dynamic permission sets. On the basis of the coupling of flow and permission set, the path of privilege escalation is abstracted; finally, a linear time access control algorithm is proposed, and fine-grained decision-making control is realized by dynamically tracking the permission set; the proposed security model is very good against privilege escalation attacks , reducing the time complexity.

In order to solve the problems of the technologies described above, the present invention provides the following technical solutions:

The present invention provides a method for discovering an Android privilege escalation attack based on a dynamic authority set, which is characterized in that a malicious APP privilege escalation attack detection method is designed by using the characteristic that the application authority sets in the strongly connected branch in the communication state diagram are equal. Equivalently divide system applications with dynamic permission sets, construct an application group "group" to simplify the search space, and use a permission set-based "privilege escalation path" to replace the permission chain formed by the application process itself, specifically including the following steps:

In the overall architecture of the DP_ManDroid model, System View is responsible for storing the communication state diagram of the computing system; Decision Checker is a component responsible for checking the current communication according to the communication state diagram and the system's dangerous permission set (here provided by the MAC Policy component) Requests, including ICC calls, socket communication, and file IO operations, etc.; SELinux is at the kernel layer and is mainly responsible for controlling covert channels. Here it mainly refers to IO operations, socket operations, etc.;

The following describes several communication operations:

1) New program installation: When a new application is installed, the native Android system extracts the permissions in the Manifest file and stores them in the Permission permission library. Here, the node creation work in the System view is added, and the nodes are assigned according to the permissions of the Manifest P_SET_STATIC attribute; similarly, when the program is uninstalled, the Permission database will be deleted, and the nodes of the System view will also be deleted. Run Algorithm 3 to update the P_SET set of the whole graph;

2) ICC call: Same as the native Android, the call is processed by the reference monitor. First, it is judged according to the Permission permission library. If the original Android permission requirements are not met, the communication is directly rejected. Otherwise, the call Decision Checker judges, first query the Decision database to see if the system state diagram and the communication requester are in the database, if so, return directly according to the previous calculation result; otherwise, send the communication request to the System view, and communicate with the Graph maker The strongly connected aggregate calculation of the state diagram, and then the system view performs the P_SET set comparison according to Algorithm 3 (here, the MAC Policy provides the dangerous permission set), and if the communication is allowed, the result is returned to the Decision Checker, and the decision made and The current system communication state diagram is stored in the Decision database, which can be used directly in the next communication judgment to improve efficiency;

3) File operations and socket operations involve access control at the kernel layer, which is judged the same as ICC, except that the communication requests intercepted by the reference monitor in ICC are intercepted by SELinux here, and the subsequent process is the same as ICC, SELinux sends communication requests Give Decision Checker a decision.

Compared with the prior art, the beneficial effects of the present invention are as follows:

The scheme of the present invention aims at the problem of privilege elevation attack of Android malicious APPs, and realizes fine-grained detection of malicious attack paths through the method of dynamically tracking privilege sets by using the abstract privilege elevation path of the strongly connected aggregation graph. At the same time, the attack example model proves that the proposed Android privilege escalation attack detection method has good performance and security in terms of time complexity, space complexity, and the ability to resist privilege escalation attacks. Privacy protection has a positive effect.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the description, and are used together with the embodiments of the present invention to explain the present invention, and do not constitute a limitation to the present invention. In the attached picture:

Fig. 1 is the overall architecture diagram of the security model of the present invention;

Fig. 2 is a flow chart of V1 initiating a communication connection request to V2;

Fig. 3 is a flow chart of V1 initiating a communication disconnection request to V2;

Figure 4 is a schematic diagram of an example attack model;

Figure 5 is a schematic diagram of a privilege escalation attack;

Figure 6 is a schematic diagram of a Soundcomber attack instance.

Detailed ways

The preferred embodiments of the present invention will be described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described here are only used to illustrate and explain the present invention, and are not intended to limit the present invention.

Example 1

The present invention is shown in Figures 1-6. The present invention provides a dynamic permission set-based Android privilege escalation attack discovery method, which uses the characteristic that the application permission sets in the strongly connected branch of the communication state diagram are equal to design mandatory access control. Model DP_ManDroid uses dynamic permission sets to divide system applications equivalently, builds application group "group" to simplify the search space, and uses permission set-based "privilege escalation path" to replace the permission chain formed by the application process itself, including the following steps :

As shown in Figure 1, in the overall architecture of the DP_ManDroid model, System View is responsible for storing the communication state diagram of the computing system. Decision Checker is a component responsible for judging current communication requests, including ICC calls, socket communication, and file IO operations, according to the communication state diagram and the system's dangerous permission set (here provided by the MAC Policy component). SELinux is at the kernel layer and is mainly responsible for controlling covert channels, here mainly refers to IO operations, socket operations, etc.;

The following describes several communication operations:

1) New program installation: When a new application is installed, the native Android system extracts the permissions in the Manifest file and stores them in the Permission permission library. Here, the node creation work in the System view is added, and the nodes are assigned according to the permissions of the Manifest. P_SET_STATIC attribute. Similarly, when the program is uninstalled, the Permission database will be deleted, and the nodes of the System view will also be deleted. Run Algorithm 3 to update the P_SET set of the whole graph.

2) ICC call: Same as native Android, the call is processed by the reference monitor. First, it is judged according to the Permission permission library. If the native Android permission requirements are not met, the communication is directly rejected. Otherwise, the call Decision Checker judges, first query the Decision database to see if the system state diagram and the communication requester are in the database, if so, return directly according to the previous calculation result; otherwise, send the communication request to the System view, and communicate with the Graph maker The strongly connected aggregate calculation of the state diagram, and then the system view performs the P_SET set comparison according to Algorithm 3 (here, the MAC Policy provides the dangerous permission set), and if the communication is allowed, the result is returned to the Decision Checker, and the decision made and The current system communication state diagram is stored in the Decision database, which can be used directly in the next communication judgment to improve efficiency.

Specifically, the prepositional theorem: firstly, the definition of the system communication state diagram is given.

Definition 1 System communication directed graph G = (V, E), vertex set V represents the communication subject, E is the communication connection, and the direction of E specifies the direction of the communication information flow. The attribute P_SET of the vertex V defines the permission set that the node has in the communication connection.

Define G_SCC=(V_SCC, E_SCC) as a strongly connected aggregation graph formed by abstracting each strongly connected branch in G=(V, E) into a single node.

Define the edge set E in 2G=(V, E) to include one-way and two-way communication connections, mainly including ICC calls, file access and Internet socket operations.

1) Two-way communication: Let v_1, v_2∈V, if there are ICC calls of v_1→v_2 (v_2→v_1), socket calls, two-way file read and write access, etc., then:

e_2∈E∧e_1=(v_1,v_2)∧e_2=(v_2,v_1).

2) One-way communication: Let v_1, v_2∈V, if there is one-way file read and write access of v_1→v_2(v_2→v_1), then:

Theorem 1. Permission transmission characteristics: Let v_1, v_2∈V and

e=(v_1,v_2), then:

Proof: If e=(v_1,v_2), then it is known from definition 1 that information flows from v_1 to v_2, if v_1 has certain permissions to obtain certain information, then v_2 can also obtain it, which is equivalent to passing the permissions of v_1 to v_2, thus

Corollary 1 Authority chain: If there is a single-source directed path p=(v_1,v_2,…,v_k) in G=(V,E), where v_1,v_2,…,v_k∈V, then v_i→P_SET=v_1→P_SET ∪v_2→P_SET∪…∪v_i→P_SET. That is, the permission set P_SET of a node has the characteristic of being transmitted along a directed path, and the transmission direction is in the same direction as the information flow. At this time, the path p is called a "authority chain", and the direction is v_1→v_k, where v_1 is the starting point of the authority chain, and v_k is the end point.

Theorem 2. Dynamic permission set: The permission set of each node in the strongly connected branch is equal, which is the union of P_SET of each node. At this time, the union of vertex permissions in the strongly connected branch is called "dynamic permission set". That is if

Then the dynamic permission set V_i→P_SET=v_1→P_SET∪v_2→P_SET∪...∪v_k→P_SET.

Proof: If v_1→P_SET≠v_2→P_SET, then

According to the definition of strong connectivity, v_1 and v_2 are reachable to each other, so they can transfer permissions to each other, so it can be deduced from Corollary 1:

The contradiction is derived, and the theorem is proved.

Corollary 2 Privilege Escalation Path: If there is a single-source directed path p=(V_1,V_2,...,V_k) in the strongly connected aggregation graph G_SCC, where V_1,V_2,...,V_k∈V_SCC, then V_i→P_SET=V_1→P_SET ∪V_2→P_SET∪…∪V_i→P_SET. At this time, the path p is called the "privilege escalation path" of the system, that is, the transfer path of the dynamic permission set. It can be concluded that the dynamics of the permission set comes from two aspects: 1) If the permission set of V_i changes Δ, where i≤k, then the permission set of V_(i+1), V_(i+2),...V_k Also change Δ; 2) The strongly connected aggregation graph of the system changes with the change of the communication situation, that is, the strongly connected branches and corresponding permission sets will also change. In particular, when each V_i on the privilege escalation path contains only one node v_i, the privilege escalation path degenerates into a privilege chain, so the privilege chain is a special case of the privilege escalation path.

Detailed control strategy:

The access control rules of the model are defined by "Rules 1.1~2.2", and are considered separately from the establishment and disconnection of communication connections.

Define tw(v ₁ , v ₂ ) as the event that v ₁ initiates a two-way communication connection to v ₂ , sw(v ₁ , v ₂ ) is the event that v ₁ initiates a one-way communication connection to v ₂ , and v ₁ and v ₂ belong to The strongly connected branches of are V ₁ , V ₂ . Assume that if there are k directed edges between V ₁ and V ₂ , then count[V ₁ ][V ₂ ]=k.

1) v ₁ and v ₂ establish a communication connection.

Rule 1.1 If tw(v ₁ , v ₂ )∧V ₁ =V ₂ , it is known from Theorem 2 that the P_SETs of v ₁ and v ₂ are equal, and the communication connection is directly allowed to be established.

Rule 1.2 If tw(v ₁ , v ₂ )∧V ₁ ≠V ₂ , then merge the dynamic permission set V=V ₁ ∪V ₂ and

V→P_SET＝V ₁ →P_SET∪V ₂ →P_SET, at the same time update the node permission set on the permission escalation path starting from V, and only when all the updated P_SETs do not match the dangerous permission set, the communication connection is allowed to be established.

Rule 1.3 If sw(v ₁ , v ₂ )∧V ₁ =V ₂ , the situation is the same as rule 1.1, and the communication connection is directly allowed to be established.

Rule 1.4 If sw(v ₁ , v ₂ )∧V ₁ ≠V ₂ , if the condition is satisfied: count[V ₁ ][V ₂ ]≥1, the communication connection is directly allowed to be established; if count[V ₂ ][V ₁ ] ≥1, then the establishment of communication will lead to the merger of V ₁ and V ₂ into the same strongly connected branch V=V ₁ ∪V ₂ , which can be judged according to rule 1.2; if

count[V ₂ ][V ₁ ]=0, then V ₁ and V ₂ form a single connected branch, and update the P_SET of each point on the privilege escalation path starting from V ₂ as follows: V _i →P_SET=V _i →P_SET∪V ₁ → P_SET. The communication connection is allowed to be established only if none of the updated P_SETs match the dangerous permission set.

Special case: when V ₁ ≠ V ₂ , if the conditions are met:

or

Then V ₁ , V _i ,..., V ₂ form a loop, and the judgment of the loop does not need to be explicitly executed, just follow the normal judgment of rule 1.2 or rule 1.4, and update the privilege escalation starting from V=V ₁ ∪V ₂ Just the path. Obviously, the permission sets of each point on the ring will be updated and equal to each other after updating, maintaining the distribution characteristics of strongly connected branch permissions.

2) The communication connection between v ₁ and v ₂ is disconnected. At this time, no dangerous permission set will be generated, only the change of the strongly connected aggregation graph G _SCC and the change of the corresponding P_SET set should be considered.

Rule 2.1 When V ₁ ≠ V ₂ , if count[V ₁ ][V ₂ ]=1, update the permission set of each node on the directed tree with V ₂ as root: V _i →P_SET=V _i → P_SET\V ₁ →P_SET, and count[V ₁ ][V ₂ ]=0.

Rule 2.2 When V ₁ =V ₂ , the strongly connected aggregation graph G _SCC should be recalculated, and P_SET of each node should be updated. According to the characteristics of directed acyclic graph, the update algorithm is still constrained in linear time.

In order to improve the decision-making efficiency, the abstract strongly connected branch of "union search set" is introduced. Algorithm FIND finds the strongly connected branch to which node x belongs (root node of union search set)

Algorithm FIND

Input: node x; parent pointer p.

Output: The strongly connected branch to which x belongs.

1) if p[x]≠x return p[x]=FIND(p[x])

2) return p[x]

The time complexity of the FIND algorithm is O(α(n)), where α(n) is a function of growth and its slowness, usually α(n)≤4, it can be considered that the FIND algorithm is completed in a constant time O(1) .

Algorithm UNION merges two strongly connected branches.

Algorithm UNION

Input: the root nodes x and y of the two union-find sets to be merged; Boolean variable ch.

1) p[y]=x

2) x→P_SET＝x→P_SET+y→P_SET

3) x→neighbors＝x→neighbors+y→neighbors

4) if ch=1

5) foreach vertex n in V _SCC do

6) count[x][n]=count[x][n]+count[y][n]

7) count[n][x]=count[n][x]+count[n][y]

The worst-case time complexity of the UNION algorithm is O(V _SCC )≤O(V).

The algorithm DFS_TARJAN calculates the strongly connected aggregation graph G _SCC based on the original graph G, constructs the G _SCC tree topology, and updates the neighbors attribute of each node and the global count array.

Algorithm 1: DFS_TARJAN

Input: the adjacency list description of the directed graph G; array dfn: record the vertex access time; array low: record the minimum dfn value reachable by the vertex in the stack; and check the root node root.

Output: A strongly connected aggregation graph G _SCC of the directed graph G.

1) foreach vertex u in G do

2) low[u]=dfn[u]=index+1

3) push u to stack

4) foreach (u, v) in E do

5)if v is not in stack then DFS_TARJAN(v)

6) low[u]=min(low[u], low[v])

7) else if u is in stack

8) low[u]=min(low[u], dfn[u])

9) if dfn[u]＝low[u] then pop the stack from top to u as a V _SCC

10) foreach vertex u,v in V _SCC do

11) root = UNION(u, v, 0)

12) add root into G _SCC

13) foreach edge e＝(u, v) in G do

14)if FIND(u)≠FIND(v)

15) cont[FIND(u)][FIND(v)]++

16) FIND(u)→neighbors[k++]=FIND(v)

17) end

According to the aggregation analysis, each vertex will only be pushed into the stack and popped out once. All UNION operations are performed O(V) times in total. Since the parameter ch=0 when calling UNION, the total time complexity of the UNION algorithm is O(V), so the time complexity of the algorithm DFS_TARJAN is O(V+E) .

Algorithm BFS_UPDATE updates the privilege escalation path from point u ∈ V _SCC in G _SCC , uses the breadth-first search method to traverse the vertex privilege set on the directed tree rooted at u, and judges whether there is a privilege escalation attack.

Algorithm 2: BFS_UPDATE

Input: node u to be updated; label set Δ→P_SET to be deleted or added; Boolean variable ch; auxiliary queue queue.

Output: Presence of a privilege escalation attack.

1) add u into queue

2) while queue is not empty do

3) pop the top element n from queue

4) if ch=1

5) n→P_SET＝n→P_SET+Δ→P_SET

6) if P_SET _dangerous = n→P_SET return true

7) if ch=0

8) n→P_SET＝n→P_SET-Δ→P_SET

9) foreach v in n→neighbors

10)add v into queue

Algorithm BFS_UPDATE adopts the breadth-first method to update, which avoids repeated updates of multi-branch nodes and improves efficiency, and the non-loop feature of G _SCC ensures that the upper limit of time complexity is O(V _SCC +E _SCC )≤O(V+ E).

FIG. 2 and FIG. 3 respectively describe the flow charts when _v1 initiates a communication connection request and a communication disconnection request to _v2 . The time complexity of judging by the security model is O(1) in the optimal case. The worst case is that when reconstructing the strongly connected aggregation graph of the system, it is only necessary to change the input parameter u of the algorithm BFS_UPDATE to the set of nodes with an in-degree of 0 in G _SCC . According to the aggregation analysis, each node in the BFS_UPDATE algorithm has Enter and exit the queue once, so the upper limit of the time complexity of the algorithm is still O(V+E), within the linear time bound.

Explanation of the correctness of the scheme:

Theorem 3. Model correctness: Model decision-making algorithms can resist collusion attacks from multiple applications and multiple communication directions.

Proof: 1) From the perspective of control granularity and efficiency: first, the communication state graph G based on the algorithm couples the information flow, and includes the covert channel of the kernel layer, which is finer than the existing model control granularity; secondly, through the specific algorithm According to the analysis, the worst-case time complexity of the decision-making model is O(V+E), which is better than the existing similar models in the linear bounds.

2) Theoretical correctness: According to the definition of privilege escalation attack and the characteristics of permission transmission, no matter how many applications participate in the attack, a permission transmission chain is established in the system to achieve the purpose of expanding permissions at a certain point. Therefore, the detection of multi-application collusion attacks can be reduced to the detection of the existence of permission chains in the system. If the establishment of communication between v ₁ and v ₂ leads to the expansion of v’s authority, then the authority chain p=(v ₁ ,v ₂ ,…,v) must be generated after the communication, otherwise, no matter whether p already exists before the communication or it still does not exist after the communication There is p, and the communication between v ₁ and v ₂ cannot affect the permission of v. Since the authority chain is a special case of the authority escalation path, there must be an authority escalation path p _SCC =(V ₁ , V ₂ ,...,V) corresponding to p in the strongly connected aggregation graph, where V ₁ , V ₂ , V are respectively is v ₁ , v ₂ and the strongly connected branch to which v belongs.

Based on the above analysis, when v ₁ and v ₂ establish communication, it is only necessary to start from the permission set V ₁ and V ₂ to which v ₁ and v ₂ belong, and check whether the permission elevation path p _SCC starting from V ₁ and V ₂ is There is a set of dangerous permissions, rule 1.2 (two-way communication) or rule 1.4 (one-way communication). Thus the correctness of the algorithm is proved.

An abstract attack model example (based on the application of telephone wiretapping) is introduced here to analyze the correctness of the algorithm proposed in this paper. As shown in Figure 4.

In the figure, 6 nodes are defined to represent 6 applications, and the directed edges between them represent the transmission of information, and the direction of the edges is the opposite direction of the information flow. Among them, v ₄ can release data to a third party, which is likely to be used for sensitive data transmission; node v ₀ represents some applications that provide content services, such as phonebook, communication voice information, etc., which may contain sensitive data; node v ₁ and v ₂ are applications that initiate a communication connection request, and the communication direction is v ₁ →v ₂ (the direction of the edge shown in the figure is v ₂ →v ₁ ). According to Fig. 5, it can be seen that before v ₁ and v ₂ establish a communication operation, v ₁ obtains information from v ₀ , v ₄ and v ₃ obtain information from v ₂ , and v ₅ obtains information from v ₃ and v ₄ .

Assume that initially v ₄ has permission A (A may be INTERNET), v ₀ has permission B (B may be PROCESS_OUTGOING_CALL, GPS, SMS, etc.), v ₃ has permission C, and v ₁ v ₂ v ₅ has arbitrary permissions. It can be defined that v _i has authority X _i , where i∈{1, 2, 5}. At this time, there are three simply connected branches in the system communication state graph, which are {v ₁ , v ₄ }, {v ₅ , v ₄ , v ₂ }, {v ₅ , v ₃ , v ₂ }. Therefore, by Algorithm 2, the permissions of v ₀ and v ₂ remain unchanged, and the permission set of P_SET_STATIC _i , v ₄ , v ₁ , v ₃ , and v ₅ is updated from Algorithm 2 to P_SET ₄ ={A, X ₂ }, P_SET ₁ ={B,X ₁ }, P_SET ₃ ={X ₂ ,C}, P_SET ₅ ={A,C,X ₂ ,X ₅ }. A dangerous permission set is defined as {A, B, C}, which does not match any P_SET _i .

When v ₁ requests a communication connection with v ₂ (it may be initiated by the user or indirectly initiated by other applications without the user's knowledge), the single-connected branch at this time is {v ₅ , v ₄ , v ₂ , v ₁ , v ₀ }{v ₅ , v ₃ , v ₂ , v ₁ , v ₀ }, and by Algorithm 2, the permission set of each point is: P_SET ₁ = {B, X ₁ }, P_SET ₂ = {B, X ₁ , X ₂ }, P_SET ₃ = {B, C, X ₁ , X ₂ }, P_SET ₄ = {A, B, X ₁ , X ₂ }, P_SET ₅ = {A, B, C, X ₁ , X ₂ } , only P_SET ₅ matches the dangerous permission set {A, B, C}, so the communication request is rejected. The longest path of two simply connected components leads to a privilege escalation attack.

When the communication between v ₁ and v ₂ is disconnected, the system state diagram restores the initial three single-connected branches, and re-runs Algorithm 2 to restore the permission set of each node.

The practical description is as follows:

Android introduces a permission label mechanism to ensure the security of communication. The application can specify the required Permissions label and obtain user authorization, and the system also has many built-in security labels. Through this tag matching mechanism, communication can be established or resources obtained only when the initiator of the communication or the resource requester has the corresponding permission tag. Although the permission label mechanism prevents illegal applications from directly obtaining resources or sensitive data, it lacks an effective defense method when faced with privilege escalation attacks that use services protected by unauthorized permissions to expand permissions. As shown in Figure 5, the components of application C are only allowed to be accessed by applications with permissions. Therefore, the components of application A do not have permission to directly access, but they have access permissions, and those with permissions can access. At this time, they can be accessed through illegally obtained data. The essence of a privilege escalation attack is to establish a "permission transfer link" between system applications, and finally implement a "dangerous permission set" on an application, such as {INTERNET, FINE_LOCATION}. When an application has a dangerous permission set, it will There is a risk of privacy data leakage. Traditional access control methods, such as access control lists, cannot solve the problem of privilege escalation attacks. The scheme of the present invention utilizes the feature that the permission sets of the applications in the strongly connected branches of the communication state graph are equal, and uses the dynamic permission set to divide the system applications into equivalence, and constructs the DAG simplification problem of the directed acyclic graph. Replace the permission chain formed by the application itself with the "privilege escalation path" based on the permission set, abstract the permission escalation path and track permission changes on the basis of coupling information flow and dynamic permission set, so that the model has runtime decision-making ability, and at the same time, the permission escalation The establishment of the path enables the model to resist the collusion attack of multi-application and multi-communication direction. In addition, due to the consideration of kernel layer covert channels such as file operations and socket operations, it can resist collusion attacks based on kernel covert channels, and construct dynamic permission division based on strongly connected branches, which simplifies and narrows the search space. The nature of the privilege escalation path constrains the algorithm within a linear time bound. Therefore, the scheme of the present invention has better practicability.

Consider the Soundcomber wiretapping example. As shown in Figure 6, applications A, B, C and Audio Recorder will conspire to steal user privacy session information through the covert channel;

Define the set of dangerous permissions as: {PROCESS_OUTGOING_CALL, INTERNET, RECORDER_AUDIO}.

The Audio Recorder records the microphone, and the COLLACTION and TRANSMITION modules perform semantic analysis and data transmission respectively. The application Call Process has the permission PROCESS_OUTGOING_CALL, and establishes an ICC two-way communication connection with the application Audio Recorder to form a strongly connected branch. The corresponding dynamic permission set is: {PROCESS_OUTGOING_CALL, RECORDER_AUDIO}.

Malicious application A obtains the data of the Audio Recorder module, so the permission set of A is: {PROCESS_OUTGOING_CALL, RECORDER_AUDIO}. Application B can establish one-way communication (file writing operation) with Deliver App, and B passes the data to Deliver App and then sends it to the Internet.

If A initiates a one-way communication connection request to B (write B's file common file):

1) Adopt the XmanDroid security model: enumerate two applications each time, because the dangerous permission set has three permission labels, so the permission label set composed of any two programs in Call Process, Audio Recorder, Malware A, Malware B, and Deliver App None of them can match the dangerous permission set, and the decision fails.

2) The security model using the historical permission set: the History attribute of application A is: {PROCESS_OUTGOING_CALL, RECORDER_AUDIO}, the History attribute of application B is NULL, the algorithm merges application A, and the History attribute of B is: {PROCESS_OUTGOING_CALL, RECORDER_AUDIO}, which do not match Dangerous permission set, allowing communication to be established, and then applying the Deliver App to B’s adjacency to update the History. At this time, sensitive data is sent to the Internet through A, B, and the Deliver App, and the decision becomes invalid.

3) According to the decision-making algorithm proposed by the present invention, since it is a one-way communication request, according to rule 1.4, run the linear time algorithm BFS_UPDATE to update the permission set along the permission promotion path {, A, B, Deliver App}, and find the permission set of the Deliver App program is: {PROCESS_OUTGOING_CALL,RECORDER_AUDIO,INTRNET}, which matches the dangerous permission set, so the communication connection is rejected.

Finally, it should be noted that: the above is only a preferred embodiment of the present invention, and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, for those skilled in the art, it still The technical solutions recorded in the foregoing embodiments may be modified, or some technical features thereof may be equivalently replaced. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

A method for discovering Android privilege escalation attacks based on dynamic privilege sets, characterized in that, using the feature that the privilege sets of applications in strongly connected branches in the communication state graph are equal, a malicious APP privilege escalation attack detection method is designed, using dynamic privileges The set divides the system applications into equivalents, constructs the application group "group" to simplify the search space, and uses the "privilege escalation path" based on the permission set to replace the permission chain formed by the application process itself, which specifically includes the following steps:

In the overall architecture of the DP_ManDroid model, System View is responsible for storing the communication state diagram of the computing system; Decision Checker is a component responsible for checking the current communication according to the communication state diagram and the system's dangerous permission set (here provided by the MAC Policy component) Requests, including ICC calls, socket communication, and file IO operations, etc.; SELinux is at the kernel layer and is mainly responsible for controlling covert channels. Here it mainly refers to IO operations, socket operations, etc.;

The following describes several communication operations:

1) New program installation: When a new application is installed, the native Android system extracts the permissions in the Manifest file and stores them in the Permission permission library. Here, the node creation work in the System view is added, and the nodes are assigned according to the permissions of the Manifest P_SET_STATIC attribute; similarly, when the program is uninstalled, the Permission database will be deleted, and the nodes of the System view will also be deleted. Run Algorithm 3 to update the P_SET set of the whole graph;

2) ICC call: Same as the native Android, the call is processed by the reference monitor. First, it is judged according to the Permission permission library. If the original Android permission requirements are not met, the communication is directly rejected. Otherwise, the call Decision Checker judges, first query the Decision database to see if the system state diagram and the communication requester are in the database, if so, return directly according to the previous calculation result; otherwise, send the communication request to the System view, and communicate with the Graph maker The strongly connected aggregate calculation of the state diagram, and then the system view performs the P_SET set comparison according to Algorithm 3 (here, the MAC Policy provides the dangerous permission set), and if the communication is allowed, the result is returned to the Decision Checker, and the decision made and The current system communication state diagram is stored in the Decision database, which can be used directly in the next communication judgment to improve efficiency;

3) File operations and socket operations involve access control at the kernel layer, which is judged the same as ICC, except that the communication requests intercepted by the reference monitor in ICC are intercepted by SELinux here, and the subsequent process is the same as ICC, SELinux sends communication requests Give Decision Checker a decision.