Research On Privacy Leakage Detection Of Android Fragments Based On Intercomponent Data Flow Analysis

In recent years,with the popularity of mobile applications,the number of malicious applications has also increased significantly,and they may obtain and disseminate private data,such as geographic location and contact information,without the authorization of users.The leakage of such information may have various impacts on the daily life and work of users.Therefore,privacy leak detection,as one of the important means of privacy security for Android users,has received extensive research attention.Academia has proposed many privacy leakage detection frameworks.Although these frameworks can detect applications by constructing accurate and complete environment methods,they ignore the implicit control flow of fragments in applications.As a result,many instances of privacy leakage cannot be detected.To address this issue,this thesis carried out the following research work:1.As a means to determine the scope of static analysis,the environment method often misses some implicit control flow in the application during design,or cannot accurately simulate the actual execution process of the application.Therefore,in response to these problems,this thesis proposes a new environment method construction strategy.The environment method built by this strategy will accurately simulate the control flow interaction between the dynamic Fragment and the Activity according to the loading point and unloading point of the dynamic Fragment,so as to solve two special types of problems caused by the interaction between the two.At the same time,this environment method also connects various implicit control flows in the component in a more reasonable way,such as the Activity life cycle method,the Fragment life cycle method,etc.,so as to provide a relatively complete simulation model for the component.Finally,this environmental method provides a solid foundation for the static detection framework of Android applications discussed later in the text.2.Since most of the current static analysis tools do not capture the data flow interaction between Activity and Fragment,the more profound privacy leakage behavior across Fragments between components will become even more concealed.In order to solve this problem,this thesis designs and implements the IccFragDroid framework.During the implementation of the framework,this thesis introduces a dynamic and static Fragment collection algorithm to collect dynamic and static Fragments.At the same time,this thesis also designs an innovative callback method collection algorithm to specifically solve the complex situation that the callback method contains Fragment and the callback method is embedded in the Fragment lifecycle method.This thesis also modified the intermediate representation source files of Fragment,repairing the ”broken” data flow between Activity and Fragment,so that the analysis framework can track the data flow between the two.Finally,by constructing a component-level DDG and generating an application-level DDG based on the ST,this thesis conducted a security analysis across Fragments between components.3.This thesis conducts four different experiments on the IccFragDroid framework,namely Fragment coverage evaluation,efficiency analysis,benchmark set detection,and real-world application set detection.After experimental verification,the IccFragDroid tool has a good performance in cross-Fragment privacy leakage detection for applications,especially in the FragFlowBench data set,which has a recall rate of 90% for privacy leakage samples.