基于AHP的安卓应用安全信用指数度量方法

徐君锋; 王嘉捷; 朱克雷; 张普含; 马宇飞

doi:10.16511/j.cnki.qhdxxb.2018.26.007

PDF(1355 KB)

清华大学学报（自然科学版） ›› 2018, Vol. 58 ›› Issue (2) : 131-136. DOI: 10.16511/j.cnki.qhdxxb.2018.26.007

计算机科学与技术

基于AHP的安卓应用安全信用指数度量方法

徐君锋¹, 王嘉捷¹, 朱克雷¹, 张普含¹, 马宇飞²

作者信息 +

Credit index measurement method for Android application security based on AHP

XU Junfeng¹, WANG Jiajie¹, ZHU Kelei¹, ZHANG Puhan¹, MA Yufei²

Author information +

文章历史 +

摘要

在Android移动应用市场上，由于Android系统的高度开放性和广泛普及性，Android应用面临着被恶意注入、二次打包等严重安全风险。传统Android软件安全度量技术的度量精度可确定软件的安全等级，但无法满足软件信用精确度量和安全指数排序的现实需求。针对上述问题，该文通过对Android软件逆向分析，根据不同权限安全等级划分，给定安全范围内的安全系数，引入层次分析法（analytic hierarchy process，AHP）评估模型，对Android软件进行初步安全评分。同时结合Android软件的认证强度和第三方应用市场上的违规记录，再次使用AHP综合度量软件的最终安全信用指数。实验结果表明：该度量方法有效可行，可在精度允许的范围内，精确度量Android软件的安全信用指数。

Abstract

The openness and popularity of Android systems has resulted in, Android applications facing serious security risks such as malicious injection and re-packaging. The traditional measurement methods of Android software security can generally determine its security level for its security index measurement accuracy, but they cannot provide accurate software credit measurements and security index sorting. This paper assigns a safety coefficient to indicate the scope of security after a reverse analysis of the Android software for the security classification. Then, the analytic hierarchy process (AHP) evaluation model is used for a preliminary safety score of the Android software. Meanwhile, the Android software certification strength and the violation records in the external application market are used to calculate the final AHP security index twice. Tests show that this measurement method can accurately measure the security index of Android software products.

导出引用

徐君锋, 王嘉捷, 朱克雷, 张普含, 马宇飞. 基于AHP的安卓应用安全信用指数度量方法[J]. 清华大学学报（自然科学版）. 2018, 58(2): 131-136 https://doi.org/10.16511/j.cnki.qhdxxb.2018.26.007

XU Junfeng, WANG Jiajie, ZHU Kelei, ZHANG Puhan, MA Yufei. Credit index measurement method for Android application security based on AHP[J]. Journal of Tsinghua University(Science and Technology). 2018, 58(2): 131-136 https://doi.org/10.16511/j.cnki.qhdxxb.2018.26.007

中图分类号： TP319.4

参考文献

[1] 徐君锋, 吴世忠, 张利. Android软件安全攻防对抗技术及发展[J]. 北京理工大学学报, 2017, 37(2):163-167. XU J F, WU S Z, ZHANG L. Survey on attack and defense technologies of Android software security[J]. Transactions of Beijing Institute of Technology, 2017, 37(2):163-167. (in Chinese)[2] 卿斯汉. Android安全研究进展[J]. 软件学报, 2016, 27(1):45-71. QING S H. Research progress on Android security[J]. Journal of Software, 2016, 27(1):45-71. (in Chinese)[3] BAGHERI H, SADEGHI A, GARCIA J, et al. COVERT:Compositional analysis of Android inter-App permission leakage[J]. IEEE Transactions on Software Engineering, 2015, 41(9):866-886.[4] WANG W, WANG X, FENG D W, et al. Exploring permission-induced risk in Android applications for malicious application detection[J]. IEEE Transactions on Information Forensics and Security, 2014, 9(11):1869-1882.[5] CEN L, GATES C S, SI L, et al. A probabilistic discriminative model for Android malware detection with decompiled source code[J]. IEEE Transactions on Dependable and Secure Computing, 2015, 12(4):400-412.[6] YANG Z M, YANG M. LeakMiner:Detect information leakage on Android with static taint analysis[C]//Proceedings of the Third World Congress on Software Engineering. Wuhan, China:IEEE, 2012:101-104.[7] JING Y M, AHN G J, ZHAO Z M, et al. Towards automated risk assessment and mitigation of mobile applications[J]. IEEE Transactions on Dependable and Secure Computing, 2015, 12(5):571-584.[8] YERIMA S Y, SEZER S, MUTTIK I. High accuracy Android malware detection using ensemble learning[J]. IET Information Security, 2015, 9(6):313-320.[9] ZHENG M, SUN M S, LUI J C S. DroidTrace:A ptrace based Android dynamic analysis system with forward ution capability[C]//Proceedings of 2014 International Wireless Communications and Mobile Computing Conference. Nicosia, Cyprus:IEEE, 2014:128-133.[10] BARTEL A, KLEIN J, MONPERRUS M, et al. Static analysis for extracting permission checks of a large scale framework:The challenges and solutions for Analyzing android[J]. IEEE Transactions on Software Engineering, 2014, 40(6):617-632.[11] GUTJAHR W J. Software dependability evaluation based on Markov usage models[J]. Performance Evaluation, 2000, 40(4):199-222.[12] SHI E, PERRIG A, VAN DOORN L. BIND:A fine-grained attestation service for secure distributed systems[C]//Proceedings of 2005 IEEE Symposium on Security and Privacy. Oakland, USA:IEEE, 2005:154-168.[13] 乐洪舟, 张玉清, 王文杰, 等. Android动态加载与反射机制的静态污点分析研究[J]. 计算机研究与发展, 2017, 54(2):313-327. LE H Z, ZHANG Y Q, WANG W J, et al. Android static taint analysis of dynamic loading and reflection mechanism[J]. Journal of Computer Research and Development, 2017, 54(2):313-327. (in Chinese)[14] FERNANDES E, CRISPO B, CONTI M. FM 99.9, radio virus:Exploiting FM radio broadcasts for malware deployment[J]. IEEE Transactions on Information Forensics and Security, 2013, 8(6):1027-1037.[15] 宁卓, 胡婷, 孙知信. 基于动态分析的Android应用程序安全研究[J]. 计算机科学, 2016, 43(S2):324-328. NING Z, HU T, SUN Z X. Security survey on Android application based on dynamic analysis[J]. Computer Science, 2016, 43(S2):324-328. (in Chinese)[16] JARABEK C, BARRERA D, AYCOCK J. ThinAV:Truly lightweight mobile cloud-based anti-malware[C]//Proceedings of the 28th Annual Computer Security Applications Conference. Orlando, USA:ACM 2012:209-218.[17] 李舟军, 吴春明, 王啸. 基于沙盒的Android应用风险行为分析与评估[J]. 清华大学学报(自然科学版), 2016, 56(5):453-460. LI Z J, WU C M, WANG X. Assessment of Android application's risk behavior based on a sandbox system[J]. Journal of Tsinghua University (Science and Technology), 2016, 56(5):453-460. (in Chinese)

PDF(1355 KB)

Accesses

Citation

Detail

段落导航

收稿日期	出版日期
2017-08-11	2018-02-15
发布日期
2018-02-15

选择文件类型/文献管理软件名称

选择包含的内容

摘要

Abstract

关键词

Key words

引用本文

{{custom_sec.title}}

{{custom_sec.title}}

参考文献

访问统计

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

摘要

Abstract

关键词

Key words

引用本文

{{custom_sec.title}}

{{custom_sec.title}}

参考文献

访问统计