WO2023035751A1 - 移动端应用的智能混淆 - Google Patents

移动端应用的智能混淆 Download PDF

Info

Publication number
WO2023035751A1
WO2023035751A1 PCT/CN2022/104296 CN2022104296W WO2023035751A1 WO 2023035751 A1 WO2023035751 A1 WO 2023035751A1 CN 2022104296 W CN2022104296 W CN 2022104296W WO 2023035751 A1 WO2023035751 A1 WO 2023035751A1
Authority
WO
WIPO (PCT)
Prior art keywords
reinforcement
hardening
obfuscation
attacked
dynamic
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/104296
Other languages
English (en)
French (fr)
Inventor
曹世杰
张建涛
张宁
姚尧
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alipay Hangzhou Information Technology Co Ltd
Original Assignee
Alipay Hangzhou Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alipay Hangzhou Information Technology Co Ltd filed Critical Alipay Hangzhou Information Technology Co Ltd
Publication of WO2023035751A1 publication Critical patent/WO2023035751A1/zh
Priority to US18/393,637 priority Critical patent/US12524524B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security

Definitions

  • the present disclosure mainly relates to software obfuscation, and in particular to intelligent obfuscation of mobile terminal applications.
  • the obfuscation and reinforcement of apps in the industry is to obfuscate the intermediate files generated during the program compilation phase.
  • the ollvm obfuscation hardening technology mainly relies on artificially applying ollvm to harden specific code logic at the code and symbol layers.
  • the obfuscation strength and obfuscation elasticity are calculated, so as to automatically output obfuscation.
  • the present disclosure provides an intelligent obfuscation solution for mobile terminal applications.
  • This solution can use the internal viewing ability of the security aspect system to detect the resource call, and identify the attacked node and the attacked method for the abnormal call, so as to automatically select and strengthen the reinforcement plan in a targeted manner.
  • an intelligent obfuscation method for a mobile terminal application including: using a security aspect to detect a call chain to find an abnormal call; node to determine the hardening position; identify the attacked method for the abnormal call to determine the hardening strength; select an automatic hardening scheme based on the hardening strength; and execute the selected automatic hardening scheme at the hardening position to check the impact of the automatic hardening on performance controlled within an acceptable range.
  • the exception call is based on a dynamic proxy Hook mechanism.
  • the abnormal call corresponds to static analysis or dynamic analysis.
  • the security aspect is a security layer interwoven with and parallel to the business.
  • the attacked nodes in the call chain include reflection/dynamic proxy hook points, JNI interface call hook points, class loading path hook points, JNI function hook points, dynamic link library hook points, and inline hook points One or more of the points.
  • the attacked means includes an attacked means corresponding to static analysis, or an attacked means corresponding to dynamic analysis, or an attacked means corresponding to both static analysis and dynamic analysis.
  • the reinforcement strength can be selected among weak reinforcement strength, medium reinforcement strength and strong reinforcement strength.
  • the automatic reinforcement scheme selected based on the weak reinforcement strength uses static obfuscation.
  • dynamic obfuscation is used in the automatic reinforcement scheme selected based on the reinforcement strength.
  • the automatic hardening solution selected based on the strong hardening strength adopts dynamic obfuscation or a combination of static obfuscation and dynamic obfuscation.
  • an intelligent obfuscation system for mobile terminal applications including: a detection module, which uses security aspects to detect call chains to find abnormal calls; an identification module, which identifies the abnormal call Call the attacked node in the chain to determine the reinforcement position, and identify the attacked method for the abnormal call to determine the reinforcement strength; the reinforcement selection module selects an automatic reinforcement scheme based on the reinforcement strength; and the reinforcement execution module executes all The selected automatic hardening solution to control the impact of automatic hardening on performance within an acceptable range.
  • the abnormal call corresponds to static analysis or dynamic analysis.
  • the attacked means includes an attacked means corresponding to static analysis, or an attacked means corresponding to dynamic analysis, or an attacked means corresponding to both static analysis and dynamic analysis.
  • the reinforcement strength can be selected among weak reinforcement strength, medium reinforcement strength and strong reinforcement strength.
  • the automatic hardening scheme selected by the hardening selection module based on weak hardening strength adopts static obfuscation.
  • the reinforcement selection module adopts dynamic obfuscation based on the automatic reinforcement scheme selected in the reinforcement strength.
  • the automatic hardening scheme selected by the hardening selection module based on strong hardening strength adopts dynamic obfuscation or a combination of static obfuscation and dynamic obfuscation.
  • a computer-readable storage medium storing instructions, and when executed, the instructions cause a machine to perform the aforementioned method.
  • FIG. 1 is a flow chart illustrating an intelligent obfuscation method for a mobile terminal application according to an embodiment of the present disclosure
  • FIG. 2 is a schematic diagram illustrating a security aspect system according to an embodiment of the present disclosure
  • FIG. 3 is a schematic diagram showing a process of intelligent obfuscation based on a security aspect according to an embodiment of the present disclosure
  • Fig. 4 is a schematic diagram showing the process of judging different attacked nodes based on call chain exceptions according to an embodiment of the present disclosure
  • Fig. 5 is a block diagram illustrating an intelligent obfuscation system for a mobile terminal application according to an embodiment of the present disclosure.
  • Cyber attacks against mobile applications can be anti-translation of APP, modification of important codes and server connection methods, repackaging and signing, and generating the same or similar applications as the original ones, thereby seeking benefits. It is also possible to add malicious code after cracking the application, such as obtaining photo album data, obtaining address book and SMS data, and monitoring sensitive information such as bank accounts, etc.
  • the App obfuscation technology used in this field basically obfuscates the intermediate files generated during the program compilation stage, mainly based on the complexity and performance of the program, and generates a certain degree of obfuscation intensity.
  • the App obfuscation technology used in this field basically obfuscates the intermediate files generated during the program compilation stage, mainly based on the complexity and performance of the program, and generates a certain degree of obfuscation intensity.
  • the intelligent obfuscation scheme of the mobile application disclosed in this disclosure incorporates the security aspect system, through which the real risk points of the mobile application being attacked are found, so as to be strengthened in a targeted manner.
  • the intelligent obfuscation scheme of the mobile terminal application of the present disclosure realizes safe internal inspection and traceability through the restoration of the call chain, and has a strong perception ability; and through the analysis of the call chain node information, it realizes efficient and targeted reinforcement.
  • This disclosure will mainly use the Android mobile terminal application as an example to describe the intelligent obfuscation scheme of the mobile terminal application, but those skilled in the art can understand that the technical solution of the present disclosure is also applicable to the iOS mobile terminal application, and will not be repeated below repeat.
  • Fig. 1 is a flow chart showing a method 100 for intelligent obfuscation of a mobile terminal application according to an embodiment of the present disclosure.
  • the security aspect is used to perform call detection on the call chain, so as to find abnormal calls.
  • the security aspect system establishes a security layer that is interwoven and parallel with the business, so that security can go deep into the business logic and achieve detailed observation; at the same time, it ensures the decoupling of business and security, making business and security independent and efficient.
  • the security aspect system adopts aspect-oriented programming (AOP, Aspect-oriented Programming), specifically through precompilation, runtime dynamic proxy or injection, to dynamically add functions to the program without modifying the source code.
  • AOP realizes the decoupling between the caller and the callee, and can provide cross-module function aggregation.
  • AOP is suitable for solving system functions involving cross-cut in the program.
  • the security aspect system has the ability to internally inspect the access to core resources when the app is running, through the detection of the call chain, it can find risky calls and derive the generation of hardening solutions.
  • the attacked node in the call chain is identified to determine a hardening location.
  • the specific implementation of AOP programming uses the Hook mechanism of dynamic proxy.
  • the hook mechanism can achieve precise cut-in for different nodes and different granularities of the call chain.
  • the process of judging different attacked nodes based on call chain anomalies according to an embodiment of the present disclosure will be specifically described below with reference to FIG. 4 .
  • the attacked nodes in the call chain include reflection/dynamic proxy hook points, JNI interface call hook points, class loading path hook points, JNI function hook points, dynamic link library hook points, and inline hook points one or more of
  • the reinforcement position can be determined.
  • the attacked nodes may involve one or more nodes, which can be hardened one by one at each hardened position.
  • identify the attacked means is called for the abnormality to determine the hardening strength.
  • the attack methods of the corresponding call chain usually correspond to static analysis (such as reflection call) and dynamic analysis (such as code injection, stack trace, Trojan horse hijacking, etc.).
  • Static analysis usually does not run the code, but analyzes the static features and functional modules of the code.
  • Static analysis can outline the program, including control flow and data structure.
  • the protection method corresponding to static analysis attack is static obfuscation.
  • Static obfuscation can be mainly divided into obfuscated control flow and obfuscated data structure.
  • static control flow obfuscation methods include splicing instructions, control flow flattening, etc.
  • data structure obfuscation methods include merging and splitting classes and structures, hiding virtual tables, etc.
  • Dynamic analysis runs the code in a controllable environment, monitors all operations of the code, observes changes in its status and execution process, and obtains various data during the execution process. It includes debugging, profiling, tracing, simulators, and more.
  • the protection method corresponding to dynamic analysis attack is dynamic obfuscation.
  • Dynamic obfuscation mainly includes obfuscation methods such as self-modifying code and virtual machine protection.
  • Self-modifying code is a mechanism for modifying or generating code while a program is running. It stores instructions and data in the same memory space, so instructions can be read and modified by other instructions as data. The program writes data to the code segment when it is running, and the written data is executed as an instruction to achieve the effect of self-modification.
  • the self-modification protection mechanism can effectively resist static reverse analysis and because the code appears in plain text only when needed, it can prevent reverse tools from obtaining all the plain text code of the program to a certain extent, thereby resisting dynamic analysis.
  • Virtual machine protection is to add a layer of custom instruction set to the virtual machine, and it is difficult to reverse. If a cracker wants to obtain the program source code, he must first understand the instruction set of the virtual machine, which greatly increases the reverse cost. Virtual machine protection technology obtains higher protection strength by increasing complexity and overhead in time and space.
  • the corresponding reinforcement strength is determined.
  • the determined reinforcement strength is weak; if the attacked means corresponds to dynamic analysis, then the determined reinforcement strength is medium; and if the The attack method corresponds to the combination of static analysis and dynamic analysis, and the determined reinforcement strength is strong reinforcement strength.
  • the attack means are various and complicated, and the reinforcement strength can be determined as required, so details will not be described here.
  • an automatic reinforcement scheme is selected based on the reinforcement strength.
  • an automatic reinforcement scheme may be selected.
  • the automatic hardening scheme can be set differently according to the scene.
  • the automatic reinforcement scheme based on weak reinforcement strength selection adopts static confusion; the automatic reinforcement scheme based on medium reinforcement strength selection adopts dynamic confusion; and the automatic reinforcement scheme based on strong reinforcement strength selection adopts static confusion and dynamic confusion The combination.
  • attack means are complicated and the automatic hardening scheme can be set as required.
  • static obfuscation methods may include: random encryption of sensitive strings in the App source code, string encryption for dynamic decryption of strings at runtime; obfuscation of class names and function names in App applications Operation symbol confusion; local variable name confusion for variable names in the source code; transformation of execution control logic into flat control logic, and deep obfuscation of control flow flattening from the abstract syntax tree level; Instruction replacement for equivalent conversion of operational expressions; confusion diversification by introducing randomness technology in the obfuscation process; and opaque predicates for branching and judging conditions in the code, etc.
  • control flow obfuscation, symbol obfuscation, etc. are realized to protect the code in an all-round way, and greatly improve the static reverse capability of the code.
  • dynamic obfuscation methods may include: Anti-dynamic debugging of App applications. When it is detected that classes, methods, and functions configured with anti-dynamic debugging functions are dynamically debugged by reverse tools, the App application will automatically exit and run; When an injection operation for an App application is detected, the App application performs anti-dynamic injection that automatically exits the running operation; when a dynamic hook is detected, the App performs anti-HOOK protection that automatically exits the operation; when the code segment in the App application is found to be tampered with , the App application automatically exits the code segment verification; and the integrity verification of the specified function in the App, when the application is re-signed and the integrity of the code is damaged, it triggers the App program to flash back.
  • Anti-dynamic debugging of App applications When it is detected that classes, methods, and functions configured with anti-dynamic debugging functions are dynamically debugged by reverse tools, the App application will automatically exit and run; When an injection operation for an App application is detected, the App application performs anti-dynamic injection that automatically exit
  • the automatic hardening solution may determine the adoption rules for the above static obfuscation techniques and dynamic obfuscation techniques as required.
  • the automatic reinforcement solution of the present disclosure is not limited to adopting the above-mentioned static obfuscation methods and dynamic obfuscation methods, and may incorporate other obfuscation methods as technology progresses.
  • the selected automatic hardening solution is executed at the hardening position, so as to control the impact of the automatic hardening on performance within an acceptable range.
  • the automatic reinforcement scheme selected at 108 is executed at the reinforcement location determined at 104 . After the automatic hardening scheme is executed, the strength of confusion and the stability of the system are automatically evaluated. If the performance exceeds the maximum expansion value reserved by the rule, the hardening plan will be rolled back, that is, hardening will not be performed; if it falls within the maximum performance expansion range, hardening will be performed.
  • the performance impact of confusion is controlled within an acceptable range, so that the final selected automatic hardening scheme is a hardening scheme that emphasizes both strength and stability.
  • the intelligent obfuscation method for mobile applications disclosed in this disclosure is incorporated into the security aspect system, through which the real risk points of mobile application programs being attacked are discovered, so as to be reinforced in a targeted manner.
  • the intelligent obfuscation method of the mobile terminal application of the present disclosure realizes safe internal inspection and traceability by restoring the call chain, and has a strong perception ability; and realizes efficient and targeted reinforcement by analyzing the call chain node information.
  • FIG. 2 is a schematic diagram illustrating a security aspect system according to an embodiment of the present disclosure.
  • the security aspect defense layer is embedded in the framework of the entire APP, while maintaining an independently running rule engine and upgrade capability. All key security-related interfaces in the APP are protected by aspects. In fact, it is to provide security services for direct business concerns, that is, direct concerns, that is, cross-cutting concerns. The modularization of cross-cutting concerns is an aspect.
  • the aspect-oriented software security architecture is used for security cut-in, and the security function can be dynamically added to the program without modifying the source code.
  • the security aspect judges whether a call is reasonable, it will retrospectively check the link information of the call, and make a perspective on the call risk of the link to make an accurate and comprehensive judgment.
  • the security aspect system shown in Figure 2 uses aspects (Aspect) to define security entry points and notification objects, uses joint points (Joint Point) to perceive security events, objects, services, business data, etc., and uses The entry point (Point Cut) defines all operations on the connection points, and surrounds and enhances the points that need security care. At this time, the ability to see through the data is required.
  • core logic, key behaviors, private information, etc. are points that require security care in a scenario according to an embodiment of the present disclosure, and one or more entry points can be defined for surround enhancement.
  • the security aspect system shown in FIG. 2 can surround and enhance the above-mentioned security entry point through various technical means such as privacy protection, security defense, anomaly detection, and risk isolation.
  • the security aspect system shown in Figure 2 uses Advice to describe the work to be done by the aspect and when to execute the work.
  • the applicable notification types are: Before—call notification before the method is called, After—call notification after the method is completed, whether the method is executed successfully or not, After-returning—before the method is executed Advice is invoked after success, and After-throwing—notifies after the method throws an exception.
  • the security aspect system shown in Figure 2 also uses proxy (Proxy) to enhance the security capabilities of current services.
  • Non-core functions such as logging, performance monitoring, exception handling, and circuit breaking and current limiting are extracted separately, and they are integrated with business codes. Separation, cross-cutting above the core business code.
  • Obtaining full link information is the core of the security aspect system. Because it is integrated into the entire system, the security aspect system can obtain a large amount of such real, complete, and detailed data to build anomaly detection capabilities and attack blocking capabilities. That is, through the restoration of the call link, security internal inspection and traceability are realized, and targeted reinforcement is carried out by analyzing code node information and locating attack risk points.
  • Fig. 3 is a schematic diagram illustrating a process of intelligent obfuscation based on security aspects according to an embodiment of the present disclosure.
  • the invocation of system resources by each business can be obtained. For example, from the stack, through the module name and path corresponding to each symbol, it is judged whether it belongs to the calling source of the native program, otherwise it is reported to the cloud for analysis.
  • a Hook framework such as Xpose
  • a call address or symbol information of an external dynamic library in the call chain it may be determined whether there is a Hook framework (such as Xpose) and a call address or symbol information of an external dynamic library in the call chain.
  • the cloud data analysis server will deduplicate different stacks and attacked nodes (symbols in this embodiment), and analyze the corresponding attacked symbols and attacked means (for example, reflective calls, code injection, Trojan horse hijacking) etc).
  • the attacked symbol will associate package-related information through the cloud server to find the corresponding module, code warehouse, and code location corresponding to the attacked symbol.
  • the intelligent hardening server After receiving the hardening instructions, the intelligent hardening server generates hardening rules at the beginning of the function and the compiler according to the corresponding attack method, configures the obfuscation parameters in the compiler, and inserts relevant symbols in the head of the corresponding function for ollvm compiler identification .
  • the attack method and the corresponding reinforcement scheme can be manually formulated into rules, and the maximum range of performance expansion that can be tolerated by the corresponding strength can be input, and then automatically executed in the subsequent process.
  • the reinforcement means include three types: constant protection, code obfuscation, and symbol obfuscation.
  • the hardening product is simulated to execute the corresponding hardening function to perform performance comparison. If the performance exceeds the maximum expansion predetermined by the rule, the hardening plan will be rolled back, that is, the hardening will not be performed; if it falls within the maximum performance expansion range, then the reinforcement.
  • Fig. 4 is a schematic diagram showing a process of judging different attacked nodes based on call chain exceptions according to an embodiment of the present disclosure. This embodiment utilizes the Hook mechanism of the dynamic proxy to realize accurate cut-in for different nodes and different granularities of the call chain.
  • the Android process shown in Figure 4 is essentially a Linux process, which dynamically links a bunch of dynamic link libraries so.
  • the Linux process mainly runs a virtual machine, which includes a class loader, object/memory management, thread scheduling, etc., and provides a runtime environment for JAVA.
  • the virtual machine contains two parts: JAVA FrameWork and application JAVA code.
  • Mobile applications usually also contain navtive code, which runs in a Linux process with a virtual machine.
  • Android process exchange data depends on the linux kernel to provide process communication interface, such as: Binder communication, Socket communication and so on.
  • the Hook mechanism can achieve the expected purpose by modifying these components in the Android process.
  • the security aspect system of the present disclosure can determine possible attacked locations and attacked means by detecting different nodes of the Hook call chain.
  • the Hook mechanism is used in the Java layer.
  • the virtual machine provides reflective/dynamic proxies as a standard programming interface.
  • the reflection API can help to access and modify private attributes, and the dynamic proxy can directly construct a proxy object dynamically from the Interface and monitor the object. That is, at node 1 (that is, the reflection/dynamic proxy hook node), the Hook mechanism usually uses a dynamic proxy to construct a proxy object, and then uses the reflection API to replace the object in the process, so as to achieve the purpose of the hook. If the call to the node 1 is judged to be abnormal, obfuscation for static analysis, such as variable name obfuscation, data flow obfuscation, etc., can be used in a targeted manner.
  • the call between the java code and the native is called through the JNI interface, and all function pointers of the JNI interface will be stored in the table of the virtual machine. Therefore, the Hook mechanism acting on node 2 (that is, the JNI interface calls the hook node) can be implemented by modifying the function pointer. If the call to the node 2 is judged to be abnormal, data flow obfuscation for static analysis can be used in a targeted manner to blur the calling relationship of the function.
  • the execution of java code depends on the class loader ClassLoader of the virtual machine to load. Therefore, the Hook mechanism acting on node 3 (that is, the class loading path hook node) achieves the goal by modifying the Path path of ClassLoader loading java class. If the call to the node 3 is judged to be abnormal, path obfuscation for static analysis and the like may be used in a targeted manner.
  • the Hook mechanism is used for virtual machines.
  • the virtual machine provides a runtime environment for java. All java methods are stored and maintained in the map of the virtual machine. Each Java Method has a flag indicating whether it is a JNI function. If it is a JNI function, search for the corresponding native function. Therefore, the Hook mechanism acting on node 4 (that is, the JNI function hook node) realizes the corresponding native function by modifying the function to be hooked into a JNI function. If the call to the node 4 is judged to be abnormal, obfuscation for dynamic analysis, such as virtual machine protection, can be used in a targeted manner.
  • the Android process when the Android process loads the dynamic link library, it uses the dlopen() function to read SO into the memory area in the current process. When the so code is called, it directly jumps to the memory area of so for execution. The function tables and function addresses provided by so are also in this memory. Therefore, the Hook mechanism acting on node 5 (that is, the dynamic link library hook node) will modify the function address. If the call to the node 5 is judged to be abnormal, the obfuscation for dynamic analysis, such as anti-dynamic hook, can be used in a targeted manner.
  • the attacked node in the call chain can be identified, so as to further determine the reinforcement location.
  • the hardening scheme can be targeted to perform hardening at each hardening position one by one.
  • FIG. 5 is a block diagram illustrating an intelligent obfuscation system 500 for mobile applications according to an embodiment of the present disclosure.
  • the intelligent obfuscation system 500 of the mobile application includes a detection module 502 , an identification module 504 , a reinforcement selection module 506 and a reinforcement execution module 508 .
  • the detection module 502 utilizes the security aspect to perform call detection on the call chain, so as to find abnormal calls.
  • the security aspect system since the security aspect system has the ability to internally inspect the access to core resources when the App is running, through the detection of the call chain, it can find risky calls and derive the generation of hardening solutions.
  • the identification module 504 identifies the attacked node in the call chain for the abnormal call to determine the hardening location.
  • the specific implementation of AOP programming uses the Hook mechanism of dynamic proxy.
  • the hook mechanism can achieve precise cut-in for different nodes and different granularities of the call chain.
  • the reinforcement position can be determined.
  • the identification module 504 identifies the attacked means for the abnormal call to determine the reinforcement strength.
  • the attack methods of the corresponding call chain usually correspond to static analysis (such as reflection call) and dynamic analysis (such as code injection, stack trace, Trojan horse hijacking, etc.).
  • the protection method corresponding to static analysis attack is static obfuscation.
  • Static obfuscation can be mainly divided into obfuscated control flow and obfuscated data structure.
  • static control flow obfuscation methods include splicing instructions, control flow flattening, etc.
  • data structure obfuscation methods include merging and splitting classes and structures, hiding virtual tables, etc.
  • the protection method corresponding to dynamic analysis attack is dynamic obfuscation.
  • Dynamic obfuscation mainly includes obfuscation methods such as self-modifying code and virtual machine protection.
  • the identification module 504 determines the corresponding reinforcement strength.
  • the attacked means if the attacked means only corresponds to static analysis, then determine the corresponding reinforcement strength as static confusion; if the attacked means only corresponds to dynamic analysis, then determine the corresponding reinforcement strength as dynamic confusion; and if The attacked means corresponds to a combination of static analysis and dynamic analysis, and the corresponding reinforcement strength is determined to be a combination of static obfuscation and dynamic obfuscation.
  • the reinforcement selection module 506 selects an automatic reinforcement scheme based on the reinforcement strength.
  • the hardening selection module 506 can select an automatic hardening scheme.
  • the automatic hardening scheme can be set differently according to the scene.
  • static obfuscation methods may include: string encryption, symbol obfuscation, local variable name obfuscation, control flow flattening, instruction replacement, obfuscation diversification; and opaque predicates, etc.; while dynamic obfuscation methods may include: anti-dynamic Debugging, anti-dynamic injection, anti-HOOK protection, code segment verification, integrity verification, etc.
  • control flow obfuscation, symbol obfuscation, etc. are realized to protect the code in an all-round way, and greatly improve the static reverse capability of the code.
  • the automatic hardening solution of the present disclosure can determine the rules for adopting the above static obfuscation techniques and dynamic obfuscation techniques as required.
  • the hardening execution module 508 executes the selected automatic hardening scheme at the hardening position, so as to control the impact of the automatic hardening on performance within an acceptable range.
  • the automatic reinforcement scheme selected by the reinforcement selection module 506 is executed at the reinforcement position determined by the recognition module 504 . After the automatic hardening scheme is executed, the strength of confusion and the stability of the system are automatically evaluated.
  • the performance impact of confusion is controlled within an acceptable range, so that the final selected automatic hardening scheme is a hardening scheme that emphasizes both strength and stability.
  • the intelligent obfuscation system of the mobile terminal application disclosed in this disclosure incorporates the security aspect system, and through the security aspect, the real risk points of the mobile application being attacked are found, so as to be reinforced in a targeted manner.
  • the intelligent obfuscation system of the mobile terminal application of the present disclosure realizes safe internal inspection and traceability through the restoration of the call chain, and has a strong perception ability; and through the analysis of the call chain node information, it realizes efficient and targeted reinforcement.
  • the various steps and modules of the intelligent obfuscation method and system for mobile terminal applications described above can be implemented by hardware, software, or a combination thereof. If implemented in hardware, the various illustrative steps, modules, and circuits described in connection with the present invention can be implemented with a general purpose processor, digital signal processor (DSP), application specific integrated circuit (ASIC), field programmable gate array (FPGA), or other programmable logic components, hardware components, or any combination thereof.
  • a general-purpose processor may be a processor, microprocessor, controller, microcontroller, or state machine, among others. If implemented in software, the various illustrative steps, modules described in connection with the invention may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
  • the software modules implementing the various operations of the present invention may reside in storage media such as RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, removable disk, CD-ROM, cloud storage, and the like.
  • the storage medium can be coupled to the processor so that the processor can read and write information from/to the storage medium, and execute corresponding program modules to realize various steps of the present invention.
  • software-based embodiments may be uploaded, downloaded or accessed remotely through appropriate communication means.
  • suitable means of communication include, for example, the Internet, the World Wide Web, an Intranet, software applications, cables (including fiber optic cables), magnetic communications, electromagnetic communications (including RF, microwave, and infrared communications), electronic communications, or other such means of communication.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开提供了一种移动端应用的智能混淆方法。其中，所述方法包括：利用安全切面对调用链进行调用检测，以发现异常调用；针对该异常调用识别该调用链中的被攻击节点以确定加固位置；针对该异常调用识别被攻击手段以确定加固强度；基于该加固强度选择自动加固方案；以及在该加固位置执行所选择的自动加固方案，以将该自动加固对性能的影响控制在可接受范围内。

Description

移动端应用的智能混淆 技术领域
本公开主要涉及软件混淆，尤其涉及移动端应用的智能混淆。
背景技术
目前业界对与App的混淆加固，大都是对程序编译阶段生成的中间文件进行混淆。举例而言，ollvm混淆加固技术主要是依赖人工对于特定的代码逻辑，应用ollvm在代码、符号层进行加固。又如，基于分析代码的性能与复杂度，计算混淆强度和混淆弹性，从而来自动输出混淆。
面对日益增多的网络安全问题，需要保护移动端应用系统，以防外部通过逆向手法对逻辑进行跟踪分析、并进一步对移动端应用进行攻击。
因此，本领域需要能够一种能够快速高效地对移动端应用中的敏感逻辑进行自动化保护加固的方案。
发明内容
为解决上述技术问题，本公开提供了一种移动端应用的智能混淆方案。该方案能够利用安全切面体系对移动端应用的内视能力，对资源调用进行检测，针对异常调用识别出被攻击节点和被攻击手段，从而针对性地自动选择加固方案并进行加固。
在本公开一实施例中，提供了一种移动端应用的智能混淆方法，包括：利用安全切面对调用链进行调用检测，以发现异常调用；针对该异常调用识别该调用链中的被攻击节点以确定加固位置；针对该异常调用识别被攻击手段以确定加固强度；基于该加固强度选择自动加固方案；以及在该加固位置执行所选择的自动加固方案，以将该自动加固对性能的影响控制在可接受范围内。
在本公开另一实施例中，该异常调用基于动态代理的Hook机制。
在本公开又一实施例中，该异常调用与静态分析或动态分析相对应。
在本公开另一实施例中，该安全切面是和业务相交织且平行的安全层。
在本公开又一实施例中，该调用链中的被攻击节点包括反射/动态代理hook点、JNI接口调用hook点、类加载路径hook点、JNI函数hook点、动态链接库hook点、inline hook点中的一个或多个。
在本公开另一实施例中，该被攻击手段包括对应于静态分析的被攻击手段、或对应于动态分析的被攻击手段、或对应于静态分析和动态分析两者的被攻击手段。
在本公开又一实施例中，该加固强度可在弱加固强度、中加固强度和强加固强度之中选择。
在本公开另一实施例中，基于该弱加固强度选择的自动加固方案采用静态混淆。
在本公开又一实施例中，基于该中加固强度选择的自动加固方案采用动态混淆。
在本公开再一实施例中，基于该强加固强度选择的自动加固方案采用动态混淆或者静态混淆和动态混淆的组合。
在本公开一实施例中，提供了一种移动端应用的智能混淆系统，包括：检测模块，利用安全切面对调用链进行调用检测，以发现异常调用；识别模块，针对该异常调用识别该调用链中的被攻击节点以确定加固位置，并针对该异常调用识别被攻击手段以确定加固强度；加固选择模块，基于该加固强度选择自动加固方案；以及加固执行模块，在该加固位置执行所选择的自动加固方案，以将该自动加固对性能的影响控制在可接受范围内。
在本公开另一实施例中，该异常调用与静态分析或动态分析相对应。
在本公开又一实施例中，该被攻击手段包括对应于静态分析的被攻击手段、或对应于动态分析的被攻击手段、或对应于静态分析和动态分析两者的被攻击手段。
在本公开另一实施例中，该加固强度可在弱加固强度、中加固强度和强加固强度之中选择。
在本公开又一实施例中，该加固选择模块基于弱加固强度选择的自动加固方案采用静态混淆。
在本公开另一实施例中，该加固选择模块基于中加固强度选择的自动加固方案采用动态混淆。
在本公开又一实施例中，该加固选择模块基于强加固强度选择的自动加固方案采用动态混淆或者静态混淆和动态混淆的组合。
在本公开一实施例中，提供了一种存储有指令的计算机可读存储介质，当这些指令被执行时使得机器执行如前所述的方法。
提供本概述以便以简化的形式介绍以下在详细描述中进一步描述的一些概念。本概 述并不旨在标识所要求保护主题的关键特征或必要特征，也不旨在用于限制所要求保护主题的范围。
附图说明
本公开的以上发明内容以及下面的具体实施方式在结合附图阅读时会得到更好的理解。需要说明的是，附图仅作为所请求保护的发明的示例。在附图中，相同的附图标记代表相同或类似的元素。
图1是示出根据本公开一实施例的移动端应用的智能混淆方法的流程图；
图2是示出根据本公开一实施例的安全切面系统的示意图；
图3是示出根据本公开一实施例的基于安全切面进行智能混淆的过程的示意图；
图4是示出根据本公开一实施例的基于调用链异常判断不同被攻击节点的过程的示意图；
图5是示出根据本公开一实施例的移动端应用的智能混淆系统的框图。
具体实施方式
为使得本公开的上述目的、特征和优点能更加明显易懂，以下结合附图对本公开的具体实施方式作详细说明。
在下面的描述中阐述了很多具体细节以便于充分理解本公开，但是本公开还可以采用其它不同于在此描述的其它方式来实施，因此本公开不受下文公开的具体实施例的限制。
在当今数字时代，移动应用的数量呈爆炸性增长，涵盖金融、电子商务、社区、医疗、房地产、工业等各行各业。在给人类带来便利的同时，网络攻击也从传统的PC网站转移到移动互联网。
网络攻击针对移动端应用可以是反译APP，修改重要代码和服务器的连接方式，重新包装和签字，生成与原创相同或相似的应用，由此谋取利益。还可以是在破解应用程序后添加恶意代码，比如获取相册数据、获取地址簿和短信数据，以及监控银行账户等敏感信息等等。
为保护移动端应用，本领域采用的App混淆技术基本上通过程序编译阶段生成的中间文件进行混淆，主要是基于程序的复杂性、性能，生成一定混淆强度的方案。但是在 移动端应用程序中，除了考虑性能的影响以外，还需要关注哪些逻辑是要保护的，此时需要在外部通过逆向手法对逻辑进行跟踪分析。由此，本领域通用的对中间文件进行混淆并不适合对逻辑进行针对性保护。
本公开所揭示的移动端应用的智能混淆方案纳入了安全切面体系，通过安全切面发现移动应用程序真实被攻击的风险点，从而针对性进行加固。本公开的移动端应用的智能混淆方案通过对调用链的还原，实现安全内视和追溯，具有强大的感知能力；并且通过对调用链节点信息的分析，来实现高效针对性加固。
本公开将主要以安卓Android移动端应用为例进行移动端应用的智能混淆方案的具体描述，但本领域技术人员可以理解，本公开的技术方案同样适用于iOS移动端应用，在下文中将不再赘述。
图1是示出根据本公开一实施例的移动端应用的智能混淆方法100的流程图。
在102，利用安全切面对调用链进行调用检测，以发现异常调用。
安全切面体系建立了和业务相交织且平行的安全层，使得安全能够深入业务逻辑，实现细致的观测；同时又保证业务和安全的解耦合，使得业务和安全各自独立，各自高效运行。安全切面体系采用的是面向切面编程(AOP，Aspect-oriented Programming)，具体是通过预编译、运行时动态代理或者注入的方式，实现在不修改源代码的情况下向程序动态添加功能。AOP实现调用者和被调用者之间的解耦，能够提供跨模块的功能汇聚。AOP适合解决程序中涉及横切面(cross-cut)的系统功能。
安全切面体系由于具备了对App运行时对核心资源访问的内视能力，通过对调用链的检测，可以发现有风险的调用，并推导加固方案的生成。
在104，针对该异常调用识别该调用链中的被攻击节点以确定加固位置。
在Android移动端应用中，AOP编程的具体实现用到了动态代理的Hook机制。hook机制可以实现针对调用链的不同节点和不同粒度的精确切入。根据本公开一实施例的基于调用链异常判断不同被攻击节点的过程将在以下结合图4具体描述。在本公开一实施例中，调用链中的被攻击节点包括反射/动态代理hook点、JNI接口调用hook点、类加载路径hook点、JNI函数hook点、动态链接库hook点、inline hook点中的一个或多个
当针对异常调用识别出调用链的被攻击节点时，即可确定加固位置。
本领域技术人员可以理解，被攻击节点可涉及一个或多个，可针对性地逐个在各个 加固位置进行加固。
在106，针对该异常调用识别被攻击手段以确定加固强度。
由于hook机制可以实现针对调用链的不同节点和不同粒度的精确切入，因此其对应的调用链的被攻击手段通常对应于静态分析(例如反射调用)和动态分析(例如代码注入、栈跟踪、木马劫持等)。
静态分析通常并不运行代码，而对代码的静态特征和功能模块进行分析。静态分析能描绘程序的轮廓，包括控制流和数据结构。与静态分析攻击相对应的保护方法是静态混淆。静态混淆主要可以分为混淆控制流和混淆数据结构。举例而言，静态控制流混淆方法包括花指令、控制流平面化等，而数据结构混淆方法包括合并和拆分类和结构体，隐藏虚表等。
动态分析则通过在可控环境中运行代码，全程监控代码的所有操作，观察其状态和执行流程的变化，从而获得执行过程中的各种数据。其包括调试、剖分、跟踪、模拟器等。与动态分析攻击相对应的保护方法是动态混淆。动态混淆主要包括自修改代码和虚拟机保护等混淆手段。自修改代码是程序运行期间修改或产生代码的机制，其将指令和数据存储在同一个内存空间中，因此指令可以被视作数据被其他指令读取和修改。程序在运行时向代码段中写数据，并且写入的数据被作为指令执行，达到自我修改的效果。自修改保护机制可以有效抵御静态逆向分析而且由于代码仅在需要时才以明文的形式出现，可以在一定程度上阻碍逆向工具获取程序所有的明文代码，从而抵抗动态分析。虚拟机保护是在虚拟机增加了一层自定义的指令集，而且其难以逆向，破解者想要获得程序源码，首先必须弄懂虚拟机的指令集，这极大增加了逆向的开销。虚拟机保护技术通过增加复杂度和在时间和空间上开销，获取了更高的保护强度。
在识别出调用链所受攻击的攻击手段是对应于静态分析、动态分析、还是静态分析和动态分析两者的组合之后，确定对应的加固强度。
在本公开一实施例中，如果被攻击手段仅对应于静态分析，则确定的加固强度为弱加固强度；如果被攻击手段对应于动态分析，则确定的加固强度为中加固强度；以及如果被攻击手段对应于静态分析和动态分析两者的组合，则确定的加固强度为强加固强度。
本领域技术人员可以理解，在不同的网络应用场景中，攻击手段纷繁复杂，加固强度可按需确定，在此不做赘述。
在108，基于该加固强度选择自动加固方案。
基于在106确定的加固强度，可选择自动加固方案。该自动加固方案可依场景进行不同的设置。
在本公开一实施例中，基于弱加固强度选择的自动加固方案采用静态混淆；基于中加固强度选择的自动加固方案采用动态混淆；而基于强加固强度选择的自动加固方案采用静态混淆和动态混淆的组合。
同样，本领域技术人员可以理解，在不同的网络应用场景中，攻击手段纷繁复杂，自动加固方案可按需设置。
举例而言，静态混淆手法可包括：将App的源代码中敏感字符串做随机加密处理、在运行时进行对字符串动态解密的字符串加密；对App应用中的类名称、函数名称进行混淆操作的符号混淆；对源代码中的变量名称进行做混淆操作的局部变量名称混淆；将执行控制逻辑变换为平坦的控制逻辑，从抽象语法树层面进行深度混淆的控制流平坦化；对代码中的运算表达式进行等效转换的指令替换；在混淆过程中引入随机性技术的混淆多样化；以及将代码中分支跳转判断条件的不透明谓词，等等。
由此，通过多样化静态防护手段，实现控制流混淆、符号混淆等来全方位保护代码，大大的提高代码静态逆向能力。
举例而言，动态混淆手法可包括：对App应用进行的防动态调试，当检测到配置防动态调试功能的类、方法、函数被逆向工具进行动态调试时，App应用进行自动退出运行操作；当检测到针对App应用的注入操作时，App应用进行自动退出运行操作的防动态注入；当检测到动态hook时，App进行自动退出操作的防HOOK保护；当发现App应用中的代码段被篡改时，App应用进行自动退出运行的代码段校验；以及对App中指定的函数进行的完整性校验，当应用被重新签名和代码的完整性遭到破坏时，其触发App程序闪退。
在本公开一实施例中，自动加固方案可按需确定对以上的静态混淆手法和动态混淆手法的采用规则。本领域技术人员可以理解，本公开的自动加固方案不限于采用以上所列举的静态混淆手法和动态混淆手法，并可随技术的进步纳入其他混淆手段。
在110，在该加固位置执行所选择的自动加固方案，以将该自动加固对性能的影响控制在可接受范围内。
将在108选择的自动加固方案在104确定的加固位置执行。该自动加固方案执行后，对混淆的强度和系统的稳定性进行自动评估。如果性能超过规则所预订的膨胀最大值， 则进行加固方案回滚，也就是不执行加固；如果属于性能膨胀最大值范围内，则进行加固。
在本公开一实施例中，通过编译参数的逐步收敛，将混淆的性能影响控制在可以接受的范围内，以使得最终选定的自动加固方案是强度和稳定并重的加固方案。
本公开所揭示的移动端应用的智能混淆方法纳入了安全切面体系，通过安全切面发现移动应用程序真实被攻击的风险点，从而针对性进行加固。本公开的移动端应用的智能混淆方法通过对调用链的还原，实现安全内视和追溯，具有强大的感知能力；并且通过对调用链节点信息的分析，来实现高效针对性加固。
图2是示出根据本公开一实施例的安全切面系统的示意图。
在图2的安全切面系统中，安全切面防御层嵌入到了整个APP的框架中，同时保持独立运行的规则引擎和升级能力。APP中所有重点安全相关的接口，都有切面进行保护。实际上就是为直接的业务关注点，即直切关注点，提供安全服务，就是横切关注点。横切关注点的模块化即为切面。
采用面向切面的软件安全架构来进行安全切入，实现在不修改源代码的情况下给程序动态添加安全功能。安全切面判断某个调用是否合理时，会追溯查看调用的链路信息，对链路的调用风险进行透视，以做出获得准确全面的判断。
具体而言，如图2所示的安全切面系统采用切面(Aspect)来定义安全的切入点和通知对象，采用连接点(Joint Point)来感知安全事件、对象、服务、业务数据等，还采用切入点(Point Cut)对连接点进行全部操作的定义，对需要安全看护的点进行环绕增强，此时需要对数据的透视能力。
如图2所示，举例而言，核心逻辑、关键行为、隐私信息等在根据本公开一实施例的场景中为需要安全看护的点，为进行环绕增强可各自定义一个或多个切入点。如图2所示的安全切面系统在本实施例中可通过隐私保护、安全防御、异常检测、风险隔离等多种技术手段来对上述安全切入点进行环绕增强。
如图2所示的安全切面系统利用通知(Advice)来描述切面要完成的工作，并描述何时执行这个工作。在根据本公开一实施例的场景中，可应用的通知类型有：Before—在方法调用之前调用通知，After—在方法完成之后调用通知，无论方法执行成功与否，After-returning—在方法执行成功之后调用通知，以及After-throwing—在方法抛出异常后进行通知。
如图2所示的安全切面系统还利用代理(Proxy)对目前服务进行安全能力的增强，诸如日志记录，性能监控，异常处理、熔断限流这样的非核心功能被单独抽取出来，与业务代码分离，横切在核心业务代码之上。
获取全链路信息是安全切面系统的核心。由于融入到了整个系统内部，因此安全切面系统可以获得大量的这种真实的、完整的、细致的数据来建设异常检测能力和攻击阻断能力。也就是通过对调用链路的还原，实现安全内视和追溯，并通过代码节点信息分析和定位攻击风险点，来进行针对性加固。
图3是示出根据本公开一实施例的基于安全切面进行智能混淆的过程的示意图。
在安全切面层，由于对系统资源进行接管，可获取到每个业务对于系统资源的调用情况。例如，从堆栈中，通过每个符号所对应的模块名、路径，来判断是否属于原生程序的调用来源，否则上报到云端进行分析。
在本公开一实施例中，可判断调用链中是否存在Hook框架(如Xpose)以及外部动态库的调用地址或者符号信息。
在本公开一实施例中，可在调用链中判断调用来源地址是否存在Hook风险，举例而言，函数地址对应的起始地址未跳转汇编指令，或系统函数的地址属于外部第三方的一模块。
云端数据分析服务器，会将不同的堆栈和被攻击节点(在本实施例中为符号)进行去重，以及分析出对应的被攻击符号、被攻击手段(例如，反射调用、代码注入、木马劫持等等)。被攻击符号会通过云端服务器进行包相关信息关联，找到对应的模块、代码仓库，以及对应被攻击符号所对应的代码位置。
智能加固服务器接收到加固指令后，在函数开头以及编译器，根据对应攻击手法生成加固规则，并将混淆参数在编译器进行配置，并在对应函数头部进行插入相关符号用于ollvm编译器识别。攻击手法和对应的加固方案可人工配制成规则，并输入对应强度所能容忍的性能膨胀最大值范围，自动化执行到后面的流程中。在本实施例中，加固手段包括3类：常量保护、代码混淆、符号混淆。
在尝试编译的过程中，会根据编译报错，自动进行相关编译配置的优化，进行重试，在重试一定次数之后若编译仍然不成功则放弃加固。如果编译成功，则生成未加固产物(原产物)、加固产物。
最后对加固产物通过模拟执行对应加固函数，进行性能比较，如果性能超过规则所 预订的膨胀最大值，则进行加固方案回滚，也就是不执行加固；如果属于性能膨胀最大值范围内，则进行加固。
图4是示出根据本公开一实施例的基于调用链异常判断不同被攻击节点的过程的示意图。该实施例利用动态代理的Hook机制来实现针对调用链的不同节点和不同粒度的精确切入。
如图4所示的Android进程实质上是Linux进程，其动态链接了一堆动态链接库so。该Linux进程中主要运行的是虚拟机，该虚拟机包含类加载器、对象/内存管理、线程调度等，为JAVA提供运行时环境。虚拟机中包含JAVA FrameWork和应用JAVA代码两部分。移动端应用通常还包含navtive代码，该native代码会和虚拟机一起在Linux进程中运行。Android进程交换数据依赖于linux内核提供进程通信接口，例如：Binder通信、Socket通信等等。
Hook机制可以通过修改Android进程中的这些组件来达到预期目的。在本实施例中，本公开的安全切面系统可通过检测Hook调用链的不同节点，来判断可能的被攻击位置和被攻击手段。
如图4中节点1，Hook机制作用于Java层。虚拟机提供了作为标准编程接口的反射/动态代理。反射API可以帮助访问到private属性并修改，动态代理可以直接从Interface中动态地构造出代理对象，并去监控该对象。即，在节点1(即，反射/动态代理hook节点)，Hook机制通常用动态代理构造出代理对象，然后用反射API去替换进程中的对象，从而达到hook的目的。针对该节点1的调用如果判断为异常，则可针对性地采用针对静态分析的混淆，例如变量名称混淆、数据流混淆等。
如图4中节点2，java代码和native之间的调用是通过JNI接口调用的，所有JNI接口的函数指针都会被保存在虚拟机的表中。所以，作用于节点2(即，JNI接口调用hook节点)的Hook机制可以通过修改函数指针实现。针对该节点2的调用如果判断为异常，则可针对性地采用针对静态分析的数据流混淆等，以模糊函数的调用关系。
如图4中节点3，java代码的执行依靠虚拟机的类加载器ClassLoader去加载。所以，作用于节点3(即，类加载路径hook节点)的Hook机制通过修改ClassLoader加载java class的Path路径达到目的。针对该节点3的调用如果判断为异常，则可针对性地采用针对静态分析的路径混淆等。
如图4中节点4，Hook机制作用于虚拟机。虚拟机为java提供运行时环境，所有的 java method都保存在虚拟机的Map中维护，每个Java Method都有个是否是JNI函数的标志位，如果是JNI函数则去查找对应的native函数。所以，作用于节点4(即，JNI函数hook节点)的Hook机制通过将要hook的函数修改为JNI函数，实现对应的native函数。针对该节点4的调用如果判断为异常，则可针对性地采用针对动态分析的混淆，例如虚拟机保护等。
如图4中节点5，Android进程加载动态链接库时都通过dlopen()函数去把SO读入到当前进程中的内存区域中。当调用so代码时，直接跳转到so的内存区域去执行。so对外提供的函数表及函数地址也都在这块内存中。所以，作用于节点5(即，动态链接库hook节点)的Hook机制会修改该函数地址。针对该节点5的调用如果判断为异常，则可针对性地采用针对动态分析的混淆，例如防动态hook等。
如图4中节点6，有些场景需要hook so内部函数，此时要用到inline hook技术。基本原理是在目标函数执行区域中插入Jump指令，使得cpu跳转到hook函数(shellcode)中。inline hook的实现和指令平台强相关。所以，作用于节点6(即，inline hook节点)的Hook机制会需要针对性地实现指令集。针对该节点6的调用如果判断为异常，则可针对性地采用针对动态分析的混淆，例如防动态调试等。
如图4所示，基于调用链的不同节点的检测，可识别出该调用链中的被攻击节点，从而进一步确定加固位置。本领域技术人员可以理解，被攻击节点可以是一个或多个，加固方案可针对性地逐个在各个加固位置执行加固。
图5是示出根据本公开一实施例的移动端应用的智能混淆系统500的框图。
该移动端应用的智能混淆系统500包括检测模块502、识别模块504、加固选择模块506和加固执行模块508。
检测模块502利用安全切面对调用链进行调用检测，以发现异常调用。
如上所述，安全切面体系由于具备了对App运行时对核心资源访问的内视能力，通过对调用链的检测，可以发现有风险的调用，并推导加固方案的生成。
识别模块504针对该异常调用识别该调用链中的被攻击节点以确定加固位置。
在Android移动端应用中，AOP编程的具体实现用到了动态代理的Hook机制。hook机制可以实现针对调用链的不同节点和不同粒度的精确切入。当针对异常调用识别出调用链的被攻击节点时，即可确定加固位置。本领域技术人员可以理解，被攻击节点可涉及一个或多个，可针对性地逐个在各个加固位置进行加固。
进一步地，识别模块504针对该异常调用识别被攻击手段以确定加固强度。
由于hook机制可以实现针对调用链的不同节点和不同粒度的精确切入，因此其对应的调用链的被攻击手段通常对应于静态分析(例如反射调用)和动态分析(例如代码注入、栈跟踪、木马劫持等)。
与静态分析攻击相对应的保护方法是静态混淆。静态混淆主要可以分为混淆控制流和混淆数据结构。举例而言，静态控制流混淆方法包括花指令、控制流平面化等，而数据结构混淆方法包括合并和拆分类和结构体，隐藏虚表等。与动态分析攻击相对应的保护方法是动态混淆。动态混淆主要包括自修改代码和虚拟机保护等混淆手段。
在识别出调用链所受攻击的攻击手段是对应于静态分析、动态分析、还是静态分析和动态分析两者的组合之后，识别模块504确定对应的加固强度。
在本公开一实施例中，如果被攻击手段仅对应于静态分析，则确定对应的加固强度为静态混淆；如果被攻击手段仅对应于动态分析，则确定对应的加固强度为动态混淆；而如果被攻击手段对应于静态分析和动态分析两者的组合，则确定对应的加固强度为静态混淆和动态混淆的组合。
加固选择模块506基于该加固强度选择自动加固方案。
基于识别模块504所确定的加固强度，加固选择模块506可选择自动加固方案。该自动加固方案可依场景进行不同的设置。
举例而言，静态混淆手法可包括：字符串加密、符号混淆、局部变量名称混淆、控制流平坦化、指令替换、混淆多样化；以及不透明谓词，等等；而动态混淆手法可包括：防动态调试、防动态注入、防HOOK保护、代码段校验、完整性校验，等等。
由此，通过多样化静态防护手段，实现控制流混淆、符号混淆等来全方位保护代码，大大的提高代码静态逆向能力。
本公开的自动加固方案可按需确定对以上的静态混淆手法和动态混淆手法的采用规则。
加固执行模块508在该加固位置执行所选择的自动加固方案，以将该自动加固对性能的影响控制在可接受范围内。
将加固选择模块506所选择的自动加固方案在识别模块504所确定的加固位置执行。该自动加固方案执行后，对混淆的强度和系统的稳定性进行自动评估。
在本公开一实施例中，通过编译参数的逐步收敛，将混淆的性能影响控制在可以接受的范围内，以使得最终选定的自动加固方案是强度和稳定并重的加固方案。
本公开所揭示的移动端应用的智能混淆系统纳入了安全切面体系，通过安全切面发现移动应用程序真实被攻击的风险点，从而针对性进行加固。本公开的移动端应用的智能混淆系统通过对调用链的还原，实现安全内视和追溯，具有强大的感知能力；并且通过对调用链节点信息的分析，来实现高效针对性加固。
以上描述的移动端应用的智能混淆方法和系统的各个步骤和模块可以用硬件、软件、或其组合来实现。如果在硬件中实现，结合本发明描述的各种说明性步骤、模块、以及电路可用通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)、或其他可编程逻辑组件、硬件组件、或其任何组合来实现或执行。通用处理器可以是处理器、微处理器、控制器、微控制器、或状态机等。如果在软件中实现，则结合本发明描述的各种说明性步骤、模块可以作为一条或多条指令或代码存储在计算机可读介质上或进行传送。实现本发明的各种操作的软件模块可驻留在存储介质中，如RAM、闪存、ROM、EPROM、EEPROM、寄存器、硬盘、可移动盘、CD-ROM、云存储等。存储介质可耦合到处理器以使得该处理器能从/向该存储介质读写信息，并执行相应的程序模块以实现本发明的各个步骤。而且，基于软件的实施例可以通过适当的通信手段被上载、下载或远程地访问。这种适当的通信手段包括例如互联网、万维网、内联网、软件应用、电缆(包括光纤电缆)、磁通信、电磁通信(包括RF、微波和红外通信)、电子通信或者其他这样的通信手段。
还应注意，这些实施例可能是作为被描绘为流程图、流图、结构图、或框图的过程来描述的。尽管流程图可能会把诸操作描述为顺序过程，但是这些操作中有许多操作能够并行或并发地执行。另外，这些操作的次序可被重新安排。
所公开的方法、装置和系统不应以任何方式被限制。相反，本发明涵盖各种所公开的实施例(单独和彼此的各种组合和子组合)的所有新颖和非显而易见的特征和方面。所公开的方法、装置和系统不限于任何具体方面或特征或它们的组合，所公开的任何实施例也不要求存在任一个或多个具体优点或者解决特定或所有技术问题。
上面结合附图对本发明的实施例进行了描述，但是本发明并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本发明的启示下，在不脱离本发明宗旨和权利要求所保护的范围情况下，还可做出很多更改，这些均落在本发明的保护范围之内。

Claims (18)

  1. 一种移动端应用的智能混淆方法，包括：
    利用安全切面对调用链进行调用检测，以发现异常调用；
    针对所述异常调用识别所述调用链中的被攻击节点以确定加固位置；
    针对所述异常调用识别被攻击手段以确定加固强度；
    基于所述加固强度选择自动加固方案；以及
    在所述加固位置执行所选择的自动加固方案，以将所述自动加固对性能的影响控制在可接受范围内。
  2. 如权利要求1所述的方法，所述异常调用基于动态代理的Hook机制。
  3. 如权利要求1所述的方法，所述异常调用与静态分析或动态分析相对应。
  4. 如权利要求1所述的方法，所述安全切面是和业务相交织且平行的安全层。
  5. 如权利要求1所述的方法，所述调用链中的被攻击节点包括反射/动态代理hook点、JNI接口调用hook点、类加载路径hook点、JNI函数hook点、动态链接库hook点、inline hook点中的一个或多个。
  6. 如权利要求1所述的方法，所述被攻击手段包括对应于静态分析的被攻击手段、或对应于动态分析的被攻击手段、或对应于静态分析和动态分析两者的被攻击手段。
  7. 如权利要求1所述的方法，所述加固强度可在弱加固强度、中加固强度和强加固强度之中选择。
  8. 如权利要求7所述的方法，基于所述弱加固强度选择的自动加固方案采用静态混淆。
  9. 如权利要求7所述的方法，基于所述中加固强度选择的自动加固方案采用动态混淆。
  10. 如权利要求7所述的方法，基于所述强加固强度选择的自动加固方案采用动态混淆或者静态混淆和动态混淆的组合。
  11. 一种移动端应用的智能混淆系统，包括：
    检测模块，利用安全切面对调用链进行调用检测，以发现异常调用；
    识别模块，针对所述异常调用识别所述调用链中的被攻击节点以确定加固位置，并针对所述异常调用识别被攻击手段以确定加固强度；
    加固选择模块，基于所述加固强度选择自动加固方案；以及
    加固执行模块，在所述加固位置执行所选择的自动加固方案，以将所述自动加固对性能的影响控制在可接受范围内。
  12. 如权利要求11所述的系统，所述异常调用与静态分析或动态分析相对应。
  13. 如权利要求11所述的系统，所述被攻击手段包括对应于静态分析的被攻击手段、或对应于动态分析的被攻击手段、或对应于静态分析和动态分析两者的被攻击手段。
  14. 如权利要求11所述的系统，所述加固强度可在弱加固强度、中加固强度和强加固强度之中选择。
  15. 如权利要求14所述的系统，所述加固选择模块基于所述弱加固强度选择的自动加固方案采用静态混淆。
  16. 如权利要求15所述的系统，所述加固选择模块基于所述中加固强度选择的自动加固方案采用动态混淆。
  17. 如权利要求15所述的系统，所述加固选择模块基于所述强加固强度选择的自动加固方案采用动态混淆或者静态混淆和动态混淆的组合。
  18. 一种存储有指令的计算机可读存储介质，当所述指令被执行时使得机器执行如权利要求1-10中任一项所述的方法。
PCT/CN2022/104296 2021-09-13 2022-07-07 移动端应用的智能混淆 Ceased WO2023035751A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/393,637 US12524524B2 (en) 2021-09-13 2023-12-21 Intelligent obfuscation of mobile applications

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111067984.1 2021-09-13
CN202111067984.1A CN113779578B (zh) 2021-09-13 2021-09-13 移动端应用的智能混淆方法和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/393,637 Continuation US12524524B2 (en) 2021-09-13 2023-12-21 Intelligent obfuscation of mobile applications

Publications (1)

Publication Number Publication Date
WO2023035751A1 true WO2023035751A1 (zh) 2023-03-16

Family

ID=78843012

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/104296 Ceased WO2023035751A1 (zh) 2021-09-13 2022-07-07 移动端应用的智能混淆

Country Status (3)

Country Link
US (1) US12524524B2 (zh)
CN (2) CN113779578B (zh)
WO (1) WO2023035751A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118228254A (zh) * 2024-03-06 2024-06-21 中金金融认证中心有限公司 移动端恶意代码检测方法、装置、移动端设备及存储介质
US12524524B2 (en) 2021-09-13 2026-01-13 Alipay (Hangzhou) Information Technology Co., Ltd. Intelligent obfuscation of mobile applications

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019092552A1 (en) 2017-11-09 2019-05-16 nChain Holdings Limited Systems and methods for ensuring correct execution of computer program using a mediator computer system
GB201720946D0 (en) 2017-12-15 2018-01-31 Nchain Holdings Ltd Computer-implemented system and method
KR102738013B1 (ko) 2017-11-09 2024-12-05 엔체인 홀딩스 리미티드 확인 키를 변경으로부터 보호하고 정확성 증명의 유효성을 확인하기 위한 시스템
KR102810891B1 (ko) 2017-12-13 2025-05-20 엔체인 홀딩스 리미티드 암호 자료를 안전하게 공유하기 위한 시스템 및 방법
CN114866355B (zh) * 2022-07-06 2023-04-28 浙江国利网安科技有限公司 一种报文流转发方法、装置、计算机设备
CN115712901B (zh) * 2022-11-24 2026-04-03 杭州中尔网络科技有限公司 一种基于自顶向下的Apache Log4j2远程代码执行语句构造方法
CN116108435A (zh) * 2022-12-14 2023-05-12 支付宝(杭州)信息技术有限公司 移动端安全切面的按需开启方法及装置
CN116127413B (zh) * 2022-12-14 2026-04-21 支付宝(杭州)数字服务技术有限公司 移动端安全切面防护方法、装置、存储介质及电子设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150363580A1 (en) * 2014-06-17 2015-12-17 Apple Inc. Protecting software through a fake cryptographic layer
CN107992724A (zh) * 2017-12-14 2018-05-04 四川大学 一种软件安全加固方法
CN111428237A (zh) * 2020-03-06 2020-07-17 支付宝(杭州)信息技术有限公司 一种攻击风险的识别方法、系统、装置和电子设备
CN111614624A (zh) * 2020-04-24 2020-09-01 支付宝(杭州)信息技术有限公司 风险检测方法、装置、系统及存储介质
CN112804184A (zh) * 2019-11-13 2021-05-14 阿里巴巴集团控股有限公司 数据混淆方法、装置及设备
CN113779578A (zh) * 2021-09-13 2021-12-10 支付宝(杭州)信息技术有限公司 移动端应用的智能混淆方法和系统

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7930256B2 (en) * 2006-05-23 2011-04-19 Charles River Analytics, Inc. Security system for and method of detecting and responding to cyber attacks on large network systems
US9798867B2 (en) * 2013-06-05 2017-10-24 Cisco Technology, Inc. Techniques for virtualization as interprocess communication, synchronization and code obfuscation
US10594705B2 (en) * 2015-10-06 2020-03-17 Shouhuai Xu Systems and methods for instructions-based detection of sophisticated obfuscation and packing
CN106650341A (zh) * 2016-11-18 2017-05-10 湖南鼎源蓝剑信息科技有限公司 基于smali流程混淆技术的Android应用加固方法
KR102738013B1 (ko) 2017-11-09 2024-12-05 엔체인 홀딩스 리미티드 확인 키를 변경으로부터 보호하고 정확성 증명의 유효성을 확인하기 위한 시스템
KR102105020B1 (ko) * 2019-08-30 2020-04-27 (유)아홉 가상 머신 기반 코드 변이 기술을 이용한 동적 자가변이 시스템
CN110647748B (zh) * 2019-09-10 2021-04-20 北京理工大学 一种基于硬件特性的代码复用攻击检测系统及方法
CN111865909B (zh) * 2020-06-08 2021-05-28 西安电子科技大学 Sgx侧信道攻击防御方法、系统、介质、程序及应用
CN113111347A (zh) * 2021-02-26 2021-07-13 全球能源互联网研究院有限公司 一种Android应用的威胁处置方法和安全监测探针
CN114866355B (zh) 2022-07-06 2023-04-28 浙江国利网安科技有限公司 一种报文流转发方法、装置、计算机设备
CN118228254A (zh) 2024-03-06 2024-06-21 中金金融认证中心有限公司 移动端恶意代码检测方法、装置、移动端设备及存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150363580A1 (en) * 2014-06-17 2015-12-17 Apple Inc. Protecting software through a fake cryptographic layer
CN107992724A (zh) * 2017-12-14 2018-05-04 四川大学 一种软件安全加固方法
CN112804184A (zh) * 2019-11-13 2021-05-14 阿里巴巴集团控股有限公司 数据混淆方法、装置及设备
CN111428237A (zh) * 2020-03-06 2020-07-17 支付宝(杭州)信息技术有限公司 一种攻击风险的识别方法、系统、装置和电子设备
CN111614624A (zh) * 2020-04-24 2020-09-01 支付宝(杭州)信息技术有限公司 风险检测方法、装置、系统及存储介质
CN113779578A (zh) * 2021-09-13 2021-12-10 支付宝(杭州)信息技术有限公司 移动端应用的智能混淆方法和系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12524524B2 (en) 2021-09-13 2026-01-13 Alipay (Hangzhou) Information Technology Co., Ltd. Intelligent obfuscation of mobile applications
CN118228254A (zh) * 2024-03-06 2024-06-21 中金金融认证中心有限公司 移动端恶意代码检测方法、装置、移动端设备及存储介质

Also Published As

Publication number Publication date
CN113779578A (zh) 2021-12-10
US12524524B2 (en) 2026-01-13
US20240143739A1 (en) 2024-05-02
CN113779578B (zh) 2024-01-19
CN118051910A (zh) 2024-05-17

Similar Documents

Publication Publication Date Title
WO2023035751A1 (zh) 移动端应用的智能混淆
Liao et al. SmartDagger: a bytecode-based static analysis approach for detecting cross-contract vulnerability
Dahse et al. Code reuse attacks in php: Automated pop chain generation
CN105760787B (zh) 用于检测随机存取存储器中的恶意代码的系统及方法
Jiang et al. WANA: Symbolic execution of wasm bytecode for extensible smart contract vulnerability detection
Mongiovì et al. Combining static and dynamic data flow analysis: a hybrid approach for detecting data leaks in Java applications
Zech et al. Towards a model based security testing approach of cloud computing environments
CN109271789B (zh) 恶意进程检测方法、装置、电子设备及存储介质
Tromer et al. Droiddisintegrator: Intra-application information flow control in android apps
Wang et al. Basis path coverage criteria for smart contract application testing
CN114282221B (zh) 注入类漏洞检测方法、系统、终端及存储介质
Tran et al. Security issues in android application development and plug-in for android studio to support secure programming
Busch et al. {GlobalConfusion}:{TrustZone} Trusted Application 0-Days by Design
Qin et al. Enhancing smart contract security analysis with execution property graphs
Fang et al. IVDroid: Static detection for input validation vulnerability in Android inter-component communication
US8375443B1 (en) Code annotations for preventing access to unsafe functionality
Simpson SAFECode whitepaper: Fundamental practices for secure software development 2nd edition
US11057416B2 (en) Analyze code that uses web framework using local parameter model
Ma et al. Communication-based attacks detection in android applications
Lu et al. Static detection of file access control vulnerabilities on windows system
CN111523115A (zh) 信息确定方法、函数调用方法及电子设备
Chen et al. Hybrid information flow analysis for Python bytecode
Popa Requirements of a better secure program coding
Lei et al. Making (Only) the Right Calls: Preventing Remote Code Execution Attacks in PHP Applications with Contextual, State-Sensitive System Call Filtering
Chen et al. Ethereum smart contract security: Design, risks and protection approaches

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22866226

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11202309981Q

Country of ref document: SG

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22866226

Country of ref document: EP

Kind code of ref document: A1