CN108734007A - A kind of processing method and processing device of monitoring application program - Google Patents

Abstract

The embodiment of the present invention provides a kind of processing method and processing device of monitoring application program, the method includes：During the virtual machine after being loaded with modification system source code runs the application program, the function parameter of the application program is called in extraction；According to pre-stored strategy matching file and the function parameter, the operational process of the application program is monitored, to obtain the sensitive behavior when application program is run.Described device executes the above method.The processing method of monitoring application program provided in an embodiment of the present invention, can monitor the operation overall process of application program, and comprehensively obtain the running sensitive operation behavior of application program.

Description

Method and device for processing monitoring application program

technical field

Embodiments of the present invention relate to the technical field of virtual machines, and in particular to a processing method and device for monitoring application programs.

Background technique

With the development of mobile communication technology, more and more applications are running on mobile terminals. Some viruses and Trojan horses spy on people's privacy through applications, seriously affecting people's normal life. Therefore, monitoring applications to It is particularly important to identify whether there is an application program running abnormally in the mobile terminal.

Existing methods for monitoring application programs (taking the Android system as an example) include: after decompiling the application program (Android Package, hereinafter referred to as APK), and then increasing the call location for the sensitive application program interface (Application Program Interface, hereinafter referred to as api) logcat input, and then repackage, install and run in a mobile terminal or a virtual machine, and identify abnormally running applications by monitoring the logcat output during the running of the application. However, this method can only be used for early applications. Most current applications are hardened by packing or adding decompilation and anti-repackaging mechanisms, which makes this method invalid. There are also existing methods: through hook (hook, actually a program segment for processing messages, hooking it into the system through system calls) to hook the java interface of the system to obtain the behavior of the application program in real time, but it can only monitor The operation of the application after the hook action, and the sensitive operation of the ndk (Native Development Kit) layer cannot be monitored.

Therefore, how to monitor the entire running process of the application program and comprehensively obtain sensitive operation behaviors during the running of the application program has become an urgent problem to be solved.

Contents of the invention

Aiming at the problems existing in the prior art, embodiments of the present invention provide a method and device for processing a monitoring application program.

On the one hand, an embodiment of the present invention provides a method for processing a monitoring application, the method comprising:

During the process of running the application program on the virtual machine loaded with the modified system source code, extracting the function parameters for calling the application program;

According to the pre-stored policy matching file and the function parameters, the running process of the application program is monitored to obtain the sensitive behavior of the application program during running.

On the other hand, an embodiment of the present invention provides a processing device for monitoring application programs, the device comprising:

An extraction unit, configured to extract function parameters for calling the application during the process of running the application on the virtual machine loaded with the modified system source code;

The monitoring unit is configured to monitor the running process of the application program according to the pre-stored policy matching file and the function parameters, so as to obtain sensitive behaviors of the application program during running.

The processing method for monitoring an application program provided by the embodiment of the present invention can monitor the whole running process of the application program, and comprehensively obtain sensitive operation behaviors during the running of the application program.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flow diagram of a processing method for monitoring an application program according to an embodiment of the present invention;

2 is a schematic structural diagram of a processing device for monitoring application programs according to an embodiment of the present invention;

Fig. 3 is a schematic diagram of the physical structure of the device provided by the embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Fig. 1 is a schematic flow chart of a processing method of a monitoring application program according to an embodiment of the present invention. As shown in Fig. 1 , the processing method of a monitoring application program provided by an embodiment of the present invention includes the following steps:

S1: During the process of running the application program on the virtual machine loaded with the modified system source code, extracting function parameters for calling the application program.

Specifically, the device extracts function parameters for calling the application program during the process of running the application program on the virtual machine loaded with the modified system source code. It should be noted that the function parameters of the calling application program (Android Package, hereinafter referred to as APK) cannot be extracted by the virtual machine without modifying the system source code. The function parameters may include input values and return values of the function, and different APKs have different function parameters. In the architecture layer of the original system (including the application layer, framework layer, operating environment layer, and kernel layer), for the APK that needs to be monitored, the corresponding location of the architecture layer is determined as the monitoring point, and the modified system source code is written. The architecture layer is associated with the ndk layer, so that the sensitive behavior of the ndk layer can be monitored. Unless otherwise specified, the application program in the embodiment of the present invention is the above-mentioned application program that needs to be monitored. Taking the application program for obtaining the mobile application table as an example to illustrate the modification of the system source code as follows:

Landroid/app/ApplicationPackageManager;

List<PackageInfo>getInstalledPackages(int flags); get mobile application list

\android\frameworks\base\core\java\android\app\ApplicationPackageManager.java

Among them: the first line is the monitoring point corresponding to the application program that needs to be monitored, the second line is the call function that executes the application program that needs to be monitored, and the third line is the path and file for writing and modifying the system source code, from which you can see Output: "frameworks" in the path corresponds to the framework layer in the architecture layer. Different monitoring points need to write different monitoring codes in different paths in the original system source code. The calling function of the application program that needs to be monitored, the path and file of writing and modifying the system source code are as follows, and the specific description will not be repeated.

Create a new process application: Ljava/lang/ProcessBuilder;

start creates a new process

\libcore\luni\src\main\java\java\lang;

Initialize the application:

Android/content/Intent;

Intent initialization

Intent\android\frameworks\base\core\java\android\content\Intent.java;

Application calling Intent:

Android/content/Intent;

setAction calls Intent

setAction\android\frameworks\base\core\java\android\content\Intent.java;

Add floating window application:

Landroid/view/WindowManager;

LayoutParams add floating window

\android\frameworks\base\core\java\android\view\WindowManager.java;

To wake up the lock screen app:

Landroid/os/PowerManager;

wakeUp() wakes up the lock screen

\android\frameworks\base\core\java\android\os\PowerManager.java;

Detect if the phone is in standby application:

Landroid/app/KeyguardManager

inKeyguardRestrictedInputMode() detects whether the phone is in standby mode

\android\frameworks\base\core\java\android\app\KeyguardManager.java;

Use ssl secure communication app:

Ljavax/net/ssl/SSLContext;

getInstance("TLS"); use ssl secure communication

\android\libcore\luni\src\main\java\javax\net\ssl\SSLContext.java;

Get the encrypted example application:

Ljavax/crypto/Cipher;

getInstance("DES"); get encrypted instance

\android\libcore\luni\src\main\java\javax\crypto\Cipher.java;

Call the hash algorithm application:

Ljava/security/MessageDigest;

getInstance("MD5") calls the hash algorithm

\android\libcore\luni\src\main\java\java\security\MessageDigest.java;

Find other file apps:

Ljava/io/file;

file.list() finds other files

libcore/luni/src/main/java/java/io/File.java;

Dynamically register the receiver application:

Landroid/content/ContextWrapper;

registerReceiver(myReceiver, filter); dynamically register the receiver

\android\frameworks\base\core\java\android\content\ContextWrapper.java;

Get the FirstHeader, LastHeader, Headers application:

Lorg/apache/http/message/AbstractHttpMessage

"getFirstHeader(""Set-Cookie"");

getLastHeader(""Set-Cookie"");

getHeaders(""Set-Cookie""); "Get

cookies\external\apache-http\src\org\apache\http\message\AbstractHttpMessage.java;

Activate the application:

Android/app/Activity

startActivity(Intent intent) activates

Activity\android\frameworks\base\core\java\android\app\Activity.java;

Interface overlay detection application:

Landroid/widget/Toast;

makeText interface coverage detection

\android\frameworks\base\core\java\android\wigget\Toast.java;

Before step S1, in order to ensure the normal startup of the virtual machine after modifying the system source code, the following debugging and running tests are required:

(1) Compile the new system source code after the modification is completed. After the compilation is successful, the system image files userdata.img, system.img and ramdisk.img will be generated in the /out/target/product/generi directory, and then compile the Android system kernel Source code, after successful compilation, the kernel-qemu kernel image file will be generated.

(2) Overwrite the file with the same name in the corresponding original system image directory in the Android Software Development Kit (Software Development Kit, hereinafter referred to as SDK). If the modified source code system version is 4.4.2, its corresponding API level is Android-19 , so you need to overwrite the userdata.img, system.img, ramdisk.img and kernel-qemu in the android-sdk-linux/system-images/android-19/default/armeabi-v7a directory with the compiled image files.

(3) Run the virtual machine AVD Manager tool to create an AVD emulator to run. If the virtual machine starts normally, it is considered that the virtual machine has successfully implanted the modified system source code. Otherwise, you need to troubleshoot the problem and re-modify the system source code before executing Repeat the above steps until the virtual machine starts normally.

S2: Monitor the running process of the application program according to the pre-stored policy matching file and the function parameters, so as to obtain the sensitive behavior of the application program during running.

Specifically, the device monitors the running process of the application program according to the pre-stored policy matching file and the function parameters, so as to obtain the sensitive behavior of the application program during running. It should be noted that the policy matching file may include sample features with sensitive behaviors, and the sample features can be obtained through sample learning and training to reflect the inherent characteristics of sensitive behaviors. Sensitive behaviors can include sensitive behaviors of virtual machine detection and shielding, sensitive behaviors of network behaviors, sensitive behaviors of file operations, sensitive behaviors of privacy behaviors, sensitive behaviors of network applications, sensitive behaviors of system processes, etc. More specific descriptions are shown in Table 1 Shown:

Table 1

The sensitive behavior monitoring function is to call the system API and record the corresponding call information. According to the analysis of known sensitive behaviors, these sensitive behaviors are mainly concentrated in background networking, operating databases, sending messages in the background, and stealing user privacy. The implementation of has a corresponding API in the system, so when the APK calls this system API, it means that the APK triggers this sensitive behavior. Examples are as follows:

Network Behavior Monitoring:

There are many networking methods in the Android system, including socket, URL, etc., and its APIs include HttpGet, HttpPost, etc. When APK triggers networking behavior, information such as networking URL can be obtained.

Send SMS monitoring:

The APIs for sending text messages in the Android system mainly include sendText, sendDataMessage, etc. When the APK triggers the sending of text messages, the destination address and content of the text messages can be obtained.

Operational database monitoring:

Some application data in the Android system are usually stored in a local database, such as contacts, call records, etc. are all stored in the form of a database. The operation of the database in Android is mainly through the query, insert, delete, update and other APIs in the ContentResover class to operate the database; when the APK operates the database, its operation behavior and the name of the database can be obtained.

Steal user privacy monitoring:

The user privacy obtained by the malicious APK mainly includes the user's mobile phone number, IMEI, location and other information. The corresponding APIs in the Android system include getLine1Number, getDeviceId, etc.; when the APK performs these sensitive behaviors, corresponding records are made.

The processing method for monitoring an application program provided by the embodiment of the present invention can monitor the whole running process of the application program, and comprehensively obtain sensitive operation behaviors during the running of the application program.

On the basis of the above embodiments, the monitoring of the running process of the application program according to the pre-stored policy matching file and the function parameters, so as to obtain the sensitive behavior of the application program during running, includes:

The function parameters are sent to a log output module, and the log output module pre-stores the policy matching file, and the policy matching file includes sensitive behavior sample features.

Specifically, the device sends the function parameters to a log output module, and the log output module pre-stores the policy matching file, and the policy matching file includes sensitive behavior sample characteristics. It should be noted that: the log output module can store the obtained function parameters, and the sample feature can be compared with the feature of the parsed function parameters in the log output module.

Analyzing the function parameters in the log output module, and comparing the parsing results of the function parameters with the characteristics of the sensitive behavior samples.

Specifically, the device parses the function parameters in the log output module, and compares the parsing results of the function parameters with the characteristics of the sensitive behavior samples. The analysis is illustrated as follows: record all sensitive APIs and function parameters called by the APK, and record the UID of the process to which the behavior belongs, which is used to determine which APK issued the behavior, and then obtain all log information through logcat and shell and parse it.

According to the result of the comparison, the sensitive behavior of the application program at runtime is obtained.

Specifically, the device obtains the sensitive behavior of the application program during runtime according to the comparison result. Compare the analysis results with the sensitive behavior sample features. If the sensitive behavior sample features match the analysis results, it is considered that sensitive behaviors have occurred during APK operation, such as sending text messages and obtaining user mobile phone numbers. If the characteristics of the sensitive behavior sample do not match the analysis result, it is considered that the APK does not generate sensitive behavior when it is running.

The processing method of the monitoring application provided by the embodiment of the present invention more automatically realizes the whole process of monitoring the running of the application through feature comparison in the log output module, and comprehensively acquires sensitive operation behaviors in the running of the application.

On the basis of the above embodiments, after obtaining the sensitive behavior of the application program at runtime according to the result of the comparison, the method further includes:

Generate the obtained sensitive behavior and the policy matching file in the same report.

Specifically, the device generates the acquired sensitive behavior and the policy matching file in the same report. The report can be viewed online or downloaded offline to facilitate query and management of the sensitive behavior.

The processing method for monitoring application programs provided by the embodiment of the present invention generates the same report including sensitive behaviors and policy matching files, which is convenient for querying and managing sensitive behaviors.

Based on the above embodiments, the function parameters include: input values and return values of the function.

Specifically, the function parameters in the device include: an input value and a return value of the function. Reference may be made to the foregoing embodiments, and details are not repeated here.

In the processing method for monitoring application programs provided by the embodiments of the present invention, monitoring of application programs can be realized by extracting input values and return values in function parameters.

On the basis of the above-mentioned embodiments, the sensitive behaviors include sensitive behaviors for detection and shielding of the virtual machine, sensitive behaviors of network behaviors, sensitive behaviors of file operations, sensitive behaviors of privacy behaviors, sensitive behaviors of network applications, system processes sensitive behavior.

Specifically, the sensitive behaviors in the device include sensitive behaviors for detection and shielding of the virtual machine, sensitive behaviors of network behaviors, sensitive behaviors of file operations, sensitive behaviors of privacy behaviors, sensitive behaviors of network applications, and sensitive behaviors of system processes. Behavior. Reference may be made to the foregoing embodiments, and details are not repeated here.

The processing method for monitoring application programs provided by the embodiments of the present invention can determine more specific sensitive behaviors.

FIG. 2 is a schematic structural diagram of a processing device for monitoring application programs according to an embodiment of the present invention. As shown in FIG. 2 , an embodiment of the present invention provides a processing device for monitoring application programs, including an extraction unit 1 and a monitoring unit 2, wherein:

The extraction unit 1 is used to extract the function parameters for calling the application program during the process of running the application program on the virtual machine loaded with the modified system source code, and the monitoring unit 2 is used to match the file according to the pre-stored strategy, and the The function parameter is used to monitor the running process of the application program, so as to obtain the sensitive behavior of the application program during running.

Specifically, the extracting unit 1 is used to extract the function parameters for calling the application program during the running of the application program by the virtual machine loaded with the modified system source code, and the extracting unit 1 sends the function parameters to the monitoring unit 2 to monitor Unit 2 is configured to monitor the running process of the application program according to the pre-stored policy matching file and the function parameters, so as to obtain the sensitive behavior of the application program during running.

The processing device for monitoring application programs provided by the embodiments of the present invention can monitor the entire running process of the application programs and comprehensively acquire sensitive operation behaviors during the running of the application programs.

On the basis of the above embodiments, the monitoring unit 2 is specifically used for:

The function parameter is sent to the log output module, the log output module is pre-stored with the policy matching file, and the policy matching file includes sensitive behavior sample characteristics; parsing the function parameter in the log output module, and comparing the parsing results of the function parameters with the characteristics of the sensitive behavior samples; according to the comparison results, the sensitive behaviors when the application program is running are obtained.

Specifically, the monitoring unit 2 is specifically configured to: send the function parameters to the log output module, the log output module pre-stores the policy matching file, and the policy matching file includes sensitive behavior sample features; Analyzing the function parameter in the log output module, and comparing the parsing result of the function parameter with the characteristics of the sensitive behavior sample; according to the result of the comparison, to obtain the sensitive Behavior.

The processing device for monitoring application programs provided by the embodiments of the present invention more automatically realizes the whole process of monitoring application program running through feature comparison in the log output module, and comprehensively acquires sensitive operation behaviors during application program running.

On the basis of the above embodiments, the monitoring unit 2 is also specifically used for:

Generate the obtained sensitive behavior and the policy matching file in the same report.

Specifically, the monitoring unit 2 is further specifically configured to generate the acquired sensitive behavior and the policy matching file in the same report.

The processing device for monitoring application programs provided by the embodiments of the present invention generates the same report including sensitive behavior and policy matching files, which facilitates query and management of sensitive behavior.

On the basis of the above embodiments, the function parameters include: input values and return values of the function.

Specifically, the function parameters in the monitoring unit 2 include: input values and return values of the function.

In the processing method for monitoring application programs provided by the embodiments of the present invention, monitoring of application programs can be realized by extracting input values and return values in function parameters.

On the basis of the above-mentioned embodiments, the sensitive behaviors include sensitive behaviors for detection and shielding of the virtual machine, sensitive behaviors of network behaviors, sensitive behaviors of file operations, sensitive behaviors of privacy behaviors, sensitive behaviors of network applications, system processes sensitive behavior.

Specifically, the sensitive behaviors in the monitoring unit 2 include sensitive behaviors for detection and shielding of the virtual machine, sensitive behaviors of network behaviors, sensitive behaviors of file operations, sensitive behaviors of privacy behaviors, sensitive behaviors of network applications, system process sensitive behavior.

The processing method for monitoring application programs provided by the embodiments of the present invention can determine more specific sensitive behaviors.

The processing device for monitoring application programs provided by the embodiments of the present invention can be specifically used to execute the processing procedures of the above-mentioned method embodiments, and its functions will not be described in detail here, and reference can be made to the detailed description of the above-mentioned method embodiments.

FIG. 3 is a schematic diagram of the physical structure of the device provided by the embodiment of the present invention. As shown in FIG. 3 , the device includes: a processor (processor) 301, a memory (memory) 302, and a bus 303;

Wherein, the processor 301 and the memory 302 complete mutual communication through the bus 303;

The processor 301 is used to call the program instructions in the memory 302 to execute the methods provided by the above method embodiments, for example, including: during the process of running the application program on a virtual machine loaded with the modified system source code , extracting function parameters for calling the application program; monitoring the running process of the application program according to the pre-stored policy matching file and the function parameters, so as to obtain sensitive behaviors of the application program during operation.

This embodiment discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by the computer, the computer The methods provided by the above method embodiments can be executed, for example, including: during the process of running the application program on the virtual machine loaded with the modified system source code, extracting the function parameters for calling the application program; The file and the function parameters are used to monitor the running process of the application program, so as to obtain the sensitive behavior of the application program during operation.

This embodiment provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided in the foregoing method embodiments, for example including : During the process of running the application program on the virtual machine loaded with modified system source code, extract the function parameters for calling the application program; according to the pre-stored policy matching file and the function parameters, the application program The running process is monitored to obtain the sensitive behavior of the application when it is running.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

The devices and other embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may Located in one place, or can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative effort.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, not to limit them; although the embodiments of the present invention have been described in detail with reference to the foregoing embodiments, those skilled in the art The skilled person should understand that: it is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the present invention The scope of the technical solution of each embodiment of the embodiment.

Claims (10)

1. a kind of processing method of monitoring application program, which is characterized in that including：

During the virtual machine after being loaded with modification system source code runs the application program, extraction is called described using journey The function parameter of sequence；

According to pre-stored strategy matching file and the function parameter, the operational process of the application program is carried out Monitoring, to obtain the sensitive behavior when application program is run.

2. according to the method described in claim 1, it is characterized in that, it is described according to pre-stored strategy matching file and The function parameter is monitored the operational process of the application program, to obtain the sensitivity when application program is run Behavior, including：

The function parameter is sent to journal output module, the journal output module is previously stored with the strategy matching text Part, the strategy matching file include sensitive behavior sample characteristics；

Parse the function parameter in the journal output module, and by the analysis result of the function parameter and the sensitivity Behavior sample feature is compared；

According to the comparison as a result, to obtain the sensitive behavior when application program is run.

3. according to the method described in claim 2, it is characterized in that, it is described according to the comparison as a result, to be answered described in acquisition After sensitive behavior when being run with program, the method further includes：

By the sensitive behavior got and the strategy matching file generated in the same report.

4. according to the method described in claim 1, it is characterized in that, the function parameter includes：The input value of the function and Return value.

5. according to the method described in claim 1, it is characterized in that, the sensitive behavior includes being directed to the virtual machine testing screen The sensitive behavior of the sensitive behavior, network behavior covered, the sensitive behavior of file operation, the sensitive behavior of privacy behavior, network are answered Sensitive behavior, the sensitive behavior of system process.

6. a kind of processing unit of monitoring application program, which is characterized in that including：

Extraction unit, for during the virtual machine after being loaded with modification system source code runs the application program, extracting Call the function parameter of the application program；

Monitoring unit is used for according to pre-stored strategy matching file and the function parameter, to the application program Operational process is monitored, to obtain the sensitive behavior when application program is run.

7. device according to claim 6, which is characterized in that the monitoring unit is specifically used for：

The function parameter is sent to journal output module, the journal output module is previously stored with the strategy matching text Part, the strategy matching file include sensitive behavior sample characteristics；

Parse the function parameter in the journal output module, and by the analysis result of the function parameter and the sensitivity Behavior sample feature is compared；

According to the comparison as a result, to obtain the sensitive behavior when application program is run.

8. device according to claim 7, which is characterized in that the monitoring unit also particularly useful for：

By the sensitive behavior got and the strategy matching file generated in the same report.

9. device according to claim 6, which is characterized in that the function parameter includes：The input value of the function and Return value.

10. device according to claim 6, which is characterized in that the sensitive behavior includes being directed to the virtual machine testing The sensitive behavior of shielding, the sensitive behavior of network behavior, the sensitive behavior of file operation, the sensitive behavior of privacy behavior, network The sensitive behavior of application, the sensitive behavior of system process.