面向混合移动应用安全性的数据流分析技术研究

近年来，针对移动应用的安全威胁呈现出日益增长的趋势。混合移动应用的出现，增加了跨语言环境的交互通道，引入了更多潜在的不安全攻击通道。数据流分析技术的目标是透视移动应用执行过程的数据流向，是发掘移动应用中潜在的恶意窃取和恶意注入通路的重要手段。目前针对混合移动应用安全性的研究才刚起步，而数据流分析方法多针对单语言环境进行，无法打通混合移动应用整体数据流通路，在静态分析和动态跟踪方法上面临低效和语言多态性分析困难的问题，同时针对第三方代码分析的扩展性差。我们的目标是针对混合移动应用不安全数据通路研究高效的数据流分析技术，将重点研究混合移动应用的不安全数据通路、跨语言环境的WebView数据通道的分析和跟踪方法、可扩展的第三方代码分析技术、跨组件的数据流分析技术、动静态相结合的高效数据流分析方法，进而应用到混合移动应用的不安全数据检测中。为保护混合移动应用的用户安全奠定研究和应用基础。

Recently, along with the growing security threats for mobile applications, the emergence of hybrid mobile applications introduce ever increasing security vulnerabilities through the cross-language interaction. Data-flow analysis is a technique to explore the potential behavior of harmful theft and malicious injection through monitoring the data flowing process during the execution of a mobile application. Currently, the security research for hybrid mobile applications is in its early stage, most existing data-flow analysis methods can only deal with a specific language, which cannot support the cross-language data-flow process for the hybrid mobile applications. For both static and dynamic tracking methods, the inefficiency problem and the difficulty for language-polymorphism analysis exists. Meanwhile, the scalability for those third-party libraries is poor. .This proposal intends to study efficient data-flow analysis techniques for hybrid mobile applications, which cover the following five aspects: the identification of those insecure data paths in hybrid mobile applications, the data-flow tracking and analyzing methods for the cross-language WebView data interface, the scalable analysis techniques for the third-party libraries, the cross-component data-flow analysis techniques, the efficient data-flow technique that integrate both static and dynamic methods. The successful application of these research results can lay a solid foundation for both industrial applications and further researches in the security area for the hybrid mobile applications.