【摘要】：隨著信息技術(shù)的發(fā)展和廣泛應(yīng)用,現(xiàn)代人越來越依賴于移動(dòng)智能手機(jī)存儲(chǔ)和處理個(gè)人信息。眾所周知,智能操作系統(tǒng)是智能手機(jī)的靈魂,它是智能手機(jī)獲得成功的基礎(chǔ)。Android目前是市場上最受歡迎的智能操作系統(tǒng),在國內(nèi)外占有很大的市場份額。Android平臺和應(yīng)用軟件市場(例如,Google Play)的開放性給開發(fā)者和用戶帶來便利的同時(shí),也隱藏著各類安全隱患。研究表明,Android應(yīng)用軟件的安全問題給用戶帶來了經(jīng)濟(jì)損失、隱私泄露等不良后果。本文基于Android安全機(jī)制和組件通信機(jī)制研究應(yīng)用軟件權(quán)限提升攻擊這一類安全問題,提出了基于環(huán)境的權(quán)限提升攻擊漏洞靜態(tài)檢測框架。我們以用戶手機(jī)的整個(gè)Android系統(tǒng)為研究背景,以系統(tǒng)中所有的第三方應(yīng)用軟件為檢測對象,在應(yīng)用軟件源代碼和配置文件中查找應(yīng)用程序組件之間的通信鏈路。此外,我們通過詳細(xì)分析權(quán)限提升攻擊的典型特征,提出四條判斷通信鏈路是否存在權(quán)限提升攻擊風(fēng)險(xiǎn)的基本原則。最后,我們實(shí)現(xiàn)了基于環(huán)境的權(quán)限提升攻擊漏洞靜態(tài)檢測框架,并設(shè)計(jì)了兩類實(shí)驗(yàn),分別驗(yàn)證四條本原則的合理性和靜態(tài)檢測框架的有效性。同時(shí),我們的實(shí)驗(yàn)還指出:與眾多常見的Android系統(tǒng)安全軟件和殺毒軟件相比,我們的靜態(tài)檢測框架可以檢測出前者不能發(fā)現(xiàn)的安全漏洞和隱患,進(jìn)一步體現(xiàn)了本文工作的價(jià)值。
[Abstract]:With the development and wide application of information technology, modern people rely more and more on mobile smartphones to store and process personal information. As we all know, the smart operating system is the soul of the smartphone. It is the foundation of the success of the smartphone. Android is currently the most popular smart operating system on the market. Android platform and application software market (such as the openness of, Google Play) bring convenience to developers and users, but also hide all kinds of security risks. The research shows that the security problems of Android application software bring users economic loss, privacy disclosure and other adverse consequences. In this paper, based on Android security mechanism and component communication mechanism, the security problems of application software privilege escalation attack are studied, and a framework for static detection of privilege escalation vulnerabilities based on environment is proposed. We take the whole Android system of the user's mobile phone as the research background, take all the third party application software in the system as the detection object, and find the communication link between the application components in the application source code and the configuration file. In addition, by analyzing the typical characteristics of privilege escalation attacks in detail, we propose four basic principles for judging whether there is a risk of privilege escalation attacks in communication links. Finally, we implement the environment based static detection framework for privilege escalation attacks, and design two kinds of experiments to verify the rationality of the four principles and the validity of the static detection framework. At the same time, our experiment also points out that compared with many common Android system security software and antivirus software, our static detection framework can detect the security vulnerabilities and hidden dangers that the former can not find, which further reflects the value of the work in this paper.
【學(xué)位授予單位】：國防科學(xué)技術(shù)大學(xué)
【學(xué)位級別】：碩士
【學(xué)位授予年份】：2016
【分類號】：TP309;TP316

【相似文獻(xiàn)】

相關(guān)期刊論文 前10條

1 袁萌;;Android計(jì)劃為什么要懸賞1000萬[J];信息系統(tǒng)工程;2007年12期

2 林耕宇;;觀摩50名Google Android程序開發(fā)競賽作品[J];電子與電腦;2008年08期

3 樹子;;Android中文版不完全體驗(yàn)[J];互聯(lián)網(wǎng)天地;2009年04期

4 Jason Whitmire;;產(chǎn)業(yè)軟件專家如何協(xié)助解決Android的分裂困境[J];電子與電腦;2010年02期

5 蔣彬;;10款A(yù)ndroid手機(jī)必備應(yīng)用——Android操作系下的軟件評測[J];微電腦世界;2010年04期

6 ;PCWorld Windows Phone 7挑戰(zhàn)Android 毅然崛起的AndroidⅠ洗心革面的Windows Phone 7[J];微電腦世界;2010年08期

7 韓青;;Android平臺發(fā)展的動(dòng)力與挑戰(zhàn)[J];中國電子商情(基礎(chǔ)電子);2010年09期

8 方智勇;;Android手機(jī)這樣用[J];電腦迷;2010年15期

9 缺少浪漫;;Android的另一面[J];電腦迷;2010年13期

10 ;ZTE and Three Release Android ，

本文編號：2316710