CAJ | 학술논문

渗透测试技术大多局限于对传统操作系统及网络的测试评估，并未涉及移动互联网环境下安全问题。为此实现一种移动互联网环境下针对移动智能终端的渗透测试方案。该方案利用实际的移动互联网络环境搭建测试平台，通过模拟多种网络攻击对Android智能手机在吞吐量、网页响应时间、CPU使用率以及能耗等性能变化进行测试。结果表明，针对链路层的拒绝服务攻击，会话截取以及中间人攻击都能成功对Android系统实施攻击，对Android系统造成威胁。此外，泛洪类拒绝服务攻击对移动智能终端的电量的消耗非常明显。此研究成果为Android系统安全的检测和防御提供了依据。
삼투측시기술대다국한우대전통조작계통급망락적측시평고，병미섭급이동호련망배경하안전문제。위차실현일충이동호련망배경하침대이동지능종단적삼투측시방안。해방안이용실제적이동호련망락배경탑건측시평태，통과모의다충망락공격대Android지능수궤재탄토량、망혈향응시간、CPU사용솔이급능모등성능변화진행측시。결과표명，침대련로층적거절복무공격，회화절취이급중간인공격도능성공대Android계통실시공격，대Android계통조성위협。차외，범홍류거절복무공격대이동지능종단적전량적소모비상명현。차연구성과위Android계통안전적검측화방어제공료의거。
Penetration testing technology is mostly confined to testing and evaluating traditional operating systems and networks, but does not address the security issues in mobile internet environment.And for that, in the paper we implement a penetration testing scheme for intelligent mobile terminals in mobile internet environment. The scheme constructs the test platform using practical mobile internet environment, and tests the performances variation of Android-based smartphone in terms of throughput, webpage response time, CPU utilisation and power consumption, etc., by simulating multiple networks attacks.Results show that the attacks targeted at link-layer including the denial-of-service attack, man-in-the-middle attack and session hijacking attack are all success in attacking the Android system and cause menace on the system.Besides, the flooding type of DoS attack is very detrimental to power consumption of the smartphone.This research outcome provides a basis for the detection and prevention of Android system security.