• • 上一篇    下一篇

基于权限分析的 Android 应用程序检测系统

张金鑫%杨晓辉   

  • 基金资助:
    国家发改委信息安全专项

ADetection System of Android Application based on Permission Analysis

ZHANG Jin-xin%YANG Xiao-hui   

  • About author:东南大学信息安全研究中心,江苏南京,210096

摘要: Android 系统在应用程序安装时仅给予粗略的权限提示界面,此界面不仅权限条目不全,而且解释异常粗略,普通用户完全看不懂,但基于使用需要,只能盲目确定授权。市面上的一些例如手机金山卫士,腾讯手机管家等管理软件,对于应用权限信息的查询要么权限条目远少于实际申请,要么权限解释一样粗略难懂,要么干脆就是直接调用 Android 系统 settings 下的粗略权限列表。
  通过研究 Android 的安全机制,在分析了上述现象可能导致的潜在安全隐患的基础上,文章设计开发了一种结合电脑端和手机端,能够对未安装的 APK 文件和已安装的 APP 应用程序进行深入权限检测系统。此系统可以检测出应用软件所申请的精确的权限个数和详细的权限列表,并通过建立数据库的方法给每条权限以及可能引起的安全问题辅以详尽、易懂的说明,使无专业知识的普通用户也可以弄懂所申请权限的作用,提高应用程序使用者的安全意识。此外,此系统还能提供用户针对某条敏感权限进行应用筛选,即列出手机内使用该敏感权限的所有应用,协助用户排查恶意软件,保护系统安全。
  针对 Android 平台开放性带来的用户隐私泄露和财产损失的问题,文章通过对 Android 安全机制的分析,给出了一种在电脑端和手机端的基于权限分析的 Android 应用程序检测系统。该系统能检测出各种应用的权限信息,也能检测出具有某条敏感权限的所有应用程序,为用户提供再判断的机会,可以更全面的保障用户信息和财产安全。

Abstract: As the openness of the Android platform lead to the privacy leaks and property damage of users, a novel detection system based on permission analysis for Android applications is proposed in this paper, which can be incorporated with computer terminals and mobile terminals. The proposed detection system can not only detect the whole permission information of applications but also help users check all the applications possess sensitive permission. In addition, the detection system provides secondary judgement so that the information and property security of the users are guaranteed.
Through the security mechanism of Android, based on the potential safety hazard analysis of the phenomenon, this paper designs and developes a system which could dectect the uninstalled APK files and the installed APP application. This system can detect the application software for the accurate access number and detailed list of permissions, and through the method of establishing the database for each authority and supplemented by security problems can be caused in detail, to understand instructions, so that ordinary users without professional knowledge can also understand the right to apply for a role, improve safety awareness application the user of the program. In addition, the system also provides user application screening for sensitive permissions, which lists all the applications that uses the sensitive permissions, so as to assist the user to check the malicious software.