高级检索

    Android安全漏洞挖掘技术综述

    Survey of Android Vulnerability Detection

    • 摘要: 安全漏洞在Android系统的安全性中处于核心地位,因此如何有效挖掘Android系统安全漏洞,已成为增强移动终端安全性、保护用户安全和隐私的重要技术手段,具有重要的理论和现实意义.首先对Android领域2008—2015年间漏洞数量趋势和种类进行了汇总,然后分类分析了Android安全领域顶级会议上2012—2014年间的学术研究进展.在此基础上,给出了Android漏洞挖掘技术的总体概览,并针对漏洞挖掘领域中使用较多的污染流传播分析、可达路径分析、符号执行、Fuzzing测试等技术进行详细阐述,还对混合符号执行和定向Fuzzing等动静态结合的技术进行了介绍.最后对Android漏洞挖掘领域的开源工具进行了总结,并讨论了值得进一步深入研究的安全问题.

       

      Abstract: Vulnerability plays a critical role in Android security. Therefore it is very meaningful to do research on vulnerability detection techniques, which can enhance Android security and protect user’s privacy. In this paper, we firstly summary the number trends and categories of Android vulnerabilities from 2008 to 2015. Then we analyze the research progress of Android security from 2012 to 2014 and propose an overview of Android vulnerability detection techniques. After that, we detail the techniques frequently using in current researches, such as taint analysis, reachable path discovery, symbolic execution and fuzzing test. In addition, we also focus on the techniques combining static analysis and dynamic test such as concolic testing and directed fuzzing. At last, we conclude the status quo and open source tools in Android vulnerability detection, and propose valuable issues which are worth further studying.

       

    /

    返回文章
    返回