CAJ | 학술논문

针对当前Android系统第三方应用程序组件中普遍存在的各种安全问题，分析了引起这种问题的原因。提出了一种基于静态分析Android应用程序中四种组件的属性信息和Java系统服务中的敏感API（Application Programming Interface）调用信息，通过构建Android应用程序的函数调用关系图，检测组件入口函数和和敏感API之间可能存在的不安全的静态可执行路径。该方案主要利用反编译、XML（extensible markup language）文件解析和正则表达式匹配技术以获取应用程序的组件和敏感API的调用信息。实验结果表明了该方案的可行性和有效性。
침대당전Android계통제삼방응용정서조건중보편존재적각충안전문제，분석료인기저충문제적원인。제출료일충기우정태분석Android응용정서중사충조건적속성신식화Java계통복무중적민감API（Application Programming Interface）조용신식，통과구건Android응용정서적함수조용관계도，검측조건입구함수화화민감API지간가능존재적불안전적정태가집행로경。해방안주요이용반편역、XML（extensible markup language）문건해석화정칙표체식필배기술이획취응용정서적조건화민감API적조용신식。실험결과표명료해방안적가행성화유효성。
In order to reduce the variety of security issues of Android application components widespread in the third markets, the article analyzed the cause of this issues at first, and then proposed a detection method by static detecting the attribute information of four components and sensitive Java system services APIs (Application Programming Interface) in Android application, perform static executable path detection to detect security risks that might exist from components entry function to services APIs in the Android application components by constructing a function calling graph. The system mainly use decompile, XML (extensible markup language) file parsing and regular expression matching techniques to obtain information about the application's components and sensitive APIs. Experimental results show the feasibility and effectiveness of this system.