Android malicious AD threat analysis and detection techniques

Android第三方广告框架应用广泛,但Android系统漏洞和Android第三方广告框架的逻辑缺陷严重威胁着Android市场安全。攻击者可以通过恶意广告获取敏感数据、触发敏感操作,甚至是以应用程序的权限执行任意代码。该文总结了4种Android恶意广告攻击方式,并针对这4种方式设计了一种基于后向切片算法和静态污点分析的Android第三方广告框架静态测量方法,以及一种基于API Hook和靶向API Trace的Android恶意广告敏感行为动态检测方法。基于以上研究,该文设计并实现了Android恶意广告威胁分析与检测系统,通过实例证明该系统能够有效地分析Android第三方广告框架可能存在的安全隐患,并能够动态检测Android恶意广告的敏感行为。Android third-party advertising frameworks are deployed in almost every Android app. The vulnerabilities of the Android OS and these advertising frameworks greatly impact the security of the Android market. The attacker can get the users' private data, trigger sensitive operations and execute arbitrary code on the device. This paper summarizes four classes of attacks in Android third-party advertising frameworks and gives two detection algorithms to discover these four classes of vulnerabilities. The first detection algorithm statically analyzes the advertising frameworks using a backward slicing algorithm and a static forward tainting analysis. The second algorithm dynamically detects malicious behavior in advertising frameworks using API hooking and targeted API tracing. An Android malicious ad security threat analysis and detection system is designed and implemented based on these two algorithms. Tests show that this system effectively discovers potential vulnerabilities in advertising frameworks and dynamically detects malicious behavior in advertisements. ? 2016, Press of Tsinghua University. All right reserved.国家自然科学基金资助项目EI中文核心期刊要目总览(PKU)中国科技核心期刊(ISTIC)中国科学引文数据库(CSCD)5468-4775