安卓应用程序误用用户信息的监测与控制
作者:

Monitoring and Control for Android Application in Misusing Users’ Private Information
Author:
  • 摘要
  • | |
  • 访问统计
  • |
  • 参考文献 [10]
  • |
  • 相似文献 [20]
  • |
  • 引证文献
  • | |
  • 文章评论
    摘要:

    针对Android应用程序常被不完全地审查,不充分的隔离,且毫无限制地被用户安装所引起的用户私有敏感信息的泄露,通过采用动态污点分析技术监测敏感信息何时通过不可信的应用程序离开系统,同时根据需要采用无害的影子数据遮蔽敏感信息,或者阻断泄露私有信息的通信,防止应用程序访问用户希望保密的数据,在系统的层面上实现实时监测和控制Android应用程序使用用户私有敏感信息.

    Abstract:

    Smartphone applications are frequently incompletely vetted, poorly isolated and installed by users without restraint. Such behavior causes users' private sensitive information leakage. By means of employing dynamic taint analysis technology, our work detects when sensitive data leaves the system via untrusted applications. Meanwhile, according to the need, it uses harmless data to cover the sensitive information, or cuts off the exfiltration communication. Then it can prevent an application to access the data which user wants to keep confidential, achieve real-time monitoring and control for Android applications in misusing the user private information from system level.

    参考文献
    1 Hornyack P, Han SY, Jung JY, Schechter S, Wetherall D. These Aren't the Droids You're Looking For: Retrofitting Android to Protect Data from Imperious Applications. ACM, 2011:1-6.
    2 Leek T, Baker G, Brown R, Zhivich M, Lippmann R. Coverage Maximization using Dynamic Taint Tracing. [Technical Report] TR-1112. MIT Lincoln Laboratory. 2007: 2-3.
    3 Masri W, Podgurski A, Leon D. Detecting and debugging insecure information flows. International Symposium on Software Reliability Engineering (ISSRE 2004). 2004. 198-209.
    4 Kong J, Zou CC, Zhou H. Improving software security via runtime instruction-level taint checking. ASID'06, Proc. of the 1st Workshop on Architectural and System Support for Improving Software Dependability. 2008. 18-24.
    5 Newsome J, Song D. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. Proc. of the Network and Distributed System Security Symposium (NDSS 2005). 2005. 55-59.
    6 Qin F, Wang C, Li Z, seop Kim H, Zhou Y, Wu Y. LIFT: A low-overhead practical information flow tracking system for detecting security attacks. MICRO '06: Proc. of the 39th Annual IEEE/ACM International Symposium on Microarchitecture. 2009. 135-148.
    7 Pietraszek T, Berghe CV. Defending against injection attacks through context-sensitive string evaluation. Proc. of Recent Advances in Intrusion Detection (RAID 2005). 2005. 3-8.
    8 Nguyen-Tuong A, Guarnieri S, Greene D, Shirley J, Evans D. Automatically hardening web applications using precise tainting. 20th IFIP International Information Security Conference. 2005. 3-5.
    9 周凌.基于信息流的动态污点分析技术研究[学位论文].成都:电子科技大学, 2010:24-25.
    10 Enck W, Gilbert P, Chun BG, Cox LP, Jung J, Mcdaniel P. Sheth AN. TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones. Proc. of the USENIX Symposiumon Operating Systems Design and Implementation. 2010. 1-7.
    引证文献
引用本文

廖明华.安卓应用程序误用用户信息的监测与控制.计算机系统应用,2014,23(6):215-219

复制
相关视频

分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2013-10-24
  • 最后修改日期:2013-11-22
  • 在线发布日期: 2014-06-20
文章二维码
您是第12855721位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京海淀区中关村南四街4号 中科院软件园区 7号楼305房间,邮政编码:100190
电话:010-62661041 传真: Email:csa (a) iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号