技术领域technical field
本发明属于Android系统级的安全问题，具体涉及一种针对如今Android权限系统无法区分正常或恶意软件而导致用户隐私信息泄露的基于KNN的用户位置隐私自感知机制的保护方法。The invention belongs to the security problem of the Android system level, and specifically relates to a protection method based on a KNN-based user location privacy self-aware mechanism for the leakage of user privacy information caused by the inability of the current Android permission system to distinguish between normal and malicious software.
背景技术Background technique
进入21世纪，人们渐渐步入数字化生活轨道，随着位置探测设备(例如手机、GPS、RFID、传感器等)和地理位置信息系统的开发、应用及推广，使得基于位置信息服务(Location-Based Service,LBS)的android应用程序越多越多，例如：办公、资讯、娱乐、购物等。正是基于用户位置信息，这些APP在给用户提供便利的同时，也带来了一系列由于用户位置隐私泄露所造成的威胁，如：通过用户位置信息推测出用户的身份、行动路线、家庭住址等。In the 21st century, people are gradually stepping into the track of digital life. With the development, application and promotion of location detection equipment (such as mobile phones, GPS, RFID, sensors, etc.) and geographic location information systems, location-based service (Location-Based Service) , LBS) more and more android applications, such as: office, information, entertainment, shopping, etc. Based on user location information, these APPs not only provide users with convenience, but also bring a series of threats caused by the leakage of user location privacy, such as: guessing the user's identity, action route, and home address through user location information Wait.
针对Android系统用户隐私泄露的问题，TaintDroid设计并实现了一种提高Android的安全性的方案,设计并实现了原型系统TaintDroid，该系统使用污点分析技术对用户的敏感数据进行保护以此来防止用户的隐私信息泄露；SecuDroid在原生Android系统(Google公司发布,没有经过第三方修改的安卓系统)基础上,研究采用数据流追踪技术检测用户敏感信息是否被泄露或滥用,在应用层、系统层以及内核层动态监控和拦截敏感行为。最后设计了SecuDroid移动操作系统,并通过实验验证SecuDroid可以有效检测隐私数据的使用及监控恶意行为。Aiming at the problem of user privacy leakage in the Android system, TaintDroid designed and implemented a solution to improve the security of Android, designed and implemented a prototype system TaintDroid, which uses taint analysis technology to protect users' sensitive data to prevent users from leakage of private information; SecuDroid is based on the native Android system (an Android system released by Google, which has not been modified by a third party), researches and uses data flow tracking technology to detect whether user sensitive information has been leaked or abused, at the application layer, system layer and The kernel layer dynamically monitors and intercepts sensitive behaviors. Finally, the SecuDroid mobile operating system is designed, and the experiments verify that SecuDroid can effectively detect the use of private data and monitor malicious behavior.
但是，此类方法存在以下不足：However, this method has the following disadvantages:
1.尽管TaintDroid等系统能够有效的检测到隐私信息的泄露，但是，检测晚于泄露时间，导致隐私信息已经被恶意软件泄露出去；1. Although TaintDroid and other systems can effectively detect the leakage of private information, the detection is later than the leakage time, resulting in the leakage of private information by malicious software;
2.目前的保护或检测机制都存在不现实的假设，导致无法在现实生活中使用。如：MockDroid系统给用户提供了基于操作系统的权限可以去阻止对Android上特定资源的访问，包括位置信息，但是这个应用程序将永远不会进行位置信息的更新，所以MockDroid虽然是一个解决方案但不具有实用性。2. There are unrealistic assumptions in the current protection or detection mechanism, which makes it impossible to use in real life. For example: MockDroid system provides users with operating system-based permissions to prevent access to specific resources on Android, including location information, but this application will never update location information, so MockDroid is a solution but Not practical.
发明内容Contents of the invention
针对上述不足和缺陷，本发明提出了一种基于KNN的用户位置隐私自感知机制的保护方法，包括以下步骤：In view of the above-mentioned deficiencies and defects, the present invention proposes a protection method based on a KNN-based user location privacy self-perception mechanism, including the following steps:
步骤1，将N个已知APP作为训练集合，根据AndroidManifest.xml中的权限将N个APP区分为正常APP件与非正常APP，则非正常APP属于需要虚假位置的APP集合，其中N＞100；Step 1. Take N known APPs as the training set, and divide the N APPs into normal APPs and abnormal APPs according to the permissions in AndroidManifest.xml, and the abnormal APPs belong to the APP set that requires false locations, where N>100 ;
针对正常APP，按照所述正常APP的功能列表、权限列表、是否需要精确位置信息将正常APP分为需要精确位置的APP集合和需要模糊位置的APP集合；For normal APPs, according to the function list, authority list, and whether precise location information is required for the normal APPs, the normal APPs are divided into a collection of APPs requiring precise locations and a collection of APPs requiring fuzzy locations;
步骤2，下载一个新的APP作为当前APP，利用KNN算法判断该当前APP属于需要虚假位置的APP或需要模糊位置的APP或需要精确位置的APP中的一类；Step 2, downloading a new APP as the current APP, and using the KNN algorithm to judge that the current APP belongs to the category of APPs requiring false locations, APPs requiring fuzzy locations, or APPs requiring precise locations;
步骤3，若所述的当前APP需要虚假位置或模糊位置，利用hook系统返回给该当前APP相应的位置信息。Step 3, if the current APP needs a false location or an ambiguous location, use the hook system to return the corresponding location information to the current APP.
进一步地，步骤2中所述的利用KNN算法判断该当前APP属于需要虚假位置的APP或需要模糊位置的APP或需要精确位置的APP中的一类是指：Further, using the KNN algorithm described in step 2 to determine that the current APP belongs to one of the APPs that require a false location, the APP that requires a fuzzy location, or the APP that requires a precise location refers to:
若最接近该当前APP的k个邻居里的APP中有大于k/2个的APP属于需要虚假位置的APP集合，则该当前APP也属于需要虚假位置的APP集合；若最接近该当前APP的k个邻居里的APP中有大于k/2个的APP属于需要模糊位置的APP集合，则该当前APP也属于需要模糊位置的APP集合；若最接近该当前APP的k个邻居里的APP中有大于k/2个的APP属于需要精确位置的APP集合，则该当前APP也属于需要精确位置的APP集合；If more than k/2 of the APPs in the k neighbors closest to the current APP belong to the APP set that requires false locations, then the current APP also belongs to the APP set that requires false locations; if the APP that is closest to the current APP Among the APPs in the k neighbors, more than k/2 APPs belong to the APP set requiring fuzzy location, then the current APP also belongs to the APP set requiring fuzzy location; if among the APPs in the k neighbors closest to the current APP, If more than k/2 APPs belong to the APP set requiring precise location, then the current APP also belongs to the APP set requiring precise location;
进一步地，步骤3中所述的利用hook系统返回给该当前APP相应的位置信息包括：Further, using the hook system described in step 3 to return the corresponding location information to the current APP includes:
步骤31，通过对所述的当前APP逆向分析得到返回地址信息的函数接口，并安装xposed框架，下载对应的XposedBridgeApi-xx.jar文件；在Android studio修改配置文件以及添加所需要的.jar文件Step 31, obtain the function interface of the return address information by reverse analyzing the current APP, install the xposed framework, download the corresponding XposedBridgeApi-xx.jar file; modify the configuration file and add the required .jar file in Android studio
步骤32，寻找函数方法所在的包，在handleLoadPackage中通过逆向得到返回地址信息的核心函数所在的包名；Step 32, find the package where the function method is located, and obtain the package name where the core function of the return address information is located by reverse engineering in handleLoadPackage;
步骤33，寻找所在的类名以及对应的函数方法，通过findAndHookMethod提供的Api寻找具体需要Hook和修改的函数；Step 33, find the class name and the corresponding function method, and use the Api provided by findAndHookMethod to find the specific function that needs to be hooked and modified;
步骤34，Hook后，在afterHookedMethod函数体中对当前APP分配虚假位置或模糊位置。Step 34, after Hooking, assign a false or fuzzy location to the current APP in the afterHookedMethod function body.
进一步地，该方法还包括：Further, the method also includes:
步骤4，针对安卓系统的保护系统，采用字节码混淆的方法阻止安卓系统对权利要求1所述方法的逆向分析。Step 4, for the protection system of the Android system, adopt the method of byte code obfuscation to prevent the reverse analysis of the Android system to the method described in claim 1.
进一步地，步骤4中所述的采用字节码混淆的方法阻止安卓系统对权利要求1所述方法的逆向分析包括：Further, the method of using bytecode obfuscation described in step 4 to prevent the reverse analysis of the Android system to the method described in claim 1 includes:
步骤41，将安卓系统的保护系统反编译，得到smali代码，针对smali文件进行混淆，然后将混淆后的smali文件重新编译成一个可执行的classes.dex；Step 41, decompile the protection system of the Android system to obtain the smali code, confuse the smali file, and then recompile the smali file into an executable classes.dex;
步骤42，将可执行文件classes.dex中被混淆指令所在的方法里所有的字节码存储在内存结构newcode中，同时将这些方法字节码用0填充；Step 42, storing all bytecodes in the method where the obfuscated instruction in the executable file classes.dex is located in the memory structure newcode, and filling these method bytecodes with 0;
步骤43，利用dex动态加载技术加载classes.dex文件，当其加载成功之后可以从DexFile系统类里获取可执行文件的加载地址；根据加载地址解classes.dex结构，找到被混淆方法所在的内存地址，然后newcode中存储的对应的方法的字节码填充回去，最终形成一个保护之后的应用程序Protected.apk。Step 43, use the dex dynamic loading technology to load the classes.dex file, and when it is loaded successfully, you can obtain the loading address of the executable file from the DexFile system class; resolve the classes.dex structure according to the loading address, and find the memory address where the obfuscated method is located , and then the bytecode of the corresponding method stored in newcode is filled back, and finally a protected application program Protected.apk is formed.
与现有技术相比，本发明具有以下技术效果：Compared with the prior art, the present invention has the following technical effects:
1.本发明设计的位置隐私自感知机制对android本身的框架并没有做任何的修改，与大多android应用程序(.apk)的开发模式相同，但可以起到保护用户位置隐私信息的效果，加之，该位置隐私自感知机制对于用户来说是透明的，对用户正常的操作不会造成影响；1. The location privacy self-awareness mechanism of the present invention design does not do any modification to the frame of android itself, is identical with the development mode of most android application program (.apk), but can play the effect of protecting user location privacy information, in addition , the location privacy self-awareness mechanism is transparent to the user and will not affect the normal operation of the user;
2.本发明不仅提出了针对不同android应用程序，采取不同的位置信息分派策略，更是结合了不同的模糊粒度和虚假粒度，能够有效地保护用户的位置隐私信息，防止了恶意软件获取用户位置信息，从而推测出用户的身份、家庭住址、行动路线、具体位置等信息；2. The present invention not only proposes different location information allocation strategies for different android applications, but also combines different fuzzy granularity and false granularity, which can effectively protect the user's location privacy information and prevent malicious software from obtaining the user's location Information, so as to infer the user's identity, home address, movement route, specific location and other information;
3.本发明提出的位置信息自感知机制可以做到一定程度的伸缩，对于不同类型android应用程序采取不同分派策略，而不是单一的策略，使得我们的位置信息保护系统的灵活性大大提高。3. The location information self-aware mechanism proposed by the present invention can be stretched to a certain extent, and different allocation strategies are adopted for different types of android applications instead of a single strategy, which greatly improves the flexibility of our location information protection system.
附图说明Description of drawings
图1为本发明的保护系统结构流程。Fig. 1 is the structural flow of the protection system of the present invention.
图2为KNN识别类别的样例图。Figure 2 is a sample diagram of KNN recognition categories.
图3为App的分类图。Figure 3 is a classification diagram of App.
具体实施方式Detailed ways
下面通过附图和实施例对本发明作进一步的说明。The present invention will be further described below by means of the accompanying drawings and examples.
实施例1Example 1
步骤1，本实施例在360应用市场中下载300个App作为训练集合，地址为：http://zhushou.360.cn/，并采用下述方法将训练集合分为正常App和非正常App：Step 1, this embodiment downloads 300 Apps in the 360 application market as a training set, the address is:http://zhushou.360.cn/ , and uses the following method to divide the training set into normal Apps and abnormal Apps:
1.使用apktool逆向App并得到权限列表。1. Use apktool to reverse the App and get the permission list.
首先，下载apktool相关工具，在PC平台上使用apktool逆向App，具体命令如下：First, download apktool related tools and use apktool reverse software on the PC platform. The specific commands are as follows:
apktool d xx.apkapktool d xx.apk
生成逆向文件后，在AndroidManifest.xml文件中提取权限生命列表，即AndroidManifest.xml中的<uses-permission/>标签中的声明。After generating the reverse file, extract the permission life list in the AndroidManifest.xml file, that is, the statement in the <uses-permission/> tag in AndroidManifest.xml.
2.判断App是否为正常App。2. Determine whether the App is a normal App.
具体的思想为：通过将App功能与其权限做对比，判断App是否正常。如：记事本程序申请了发送短信的权限，则判定App为非正常应用程序。The specific idea is to judge whether the App is normal by comparing the functions of the App with its permissions. For example, if the Notepad program has applied for the permission to send text messages, the App is determined to be an abnormal application.
步骤2，针对正常App，将App功能列表、权限列表、是否需要精确位置信息作为训练特征，从而得到300个App的训练集合。根据训练集合判断新App属于需要精确位置的App、需要模糊位置的App。具体的分类思想是：在距离空间里，如果一个样本的最接近的k个邻居里，绝大多数属于某个类别，则该样本也属于这个类别。在本文具体实现中，距离采用欧式距离，而k近邻搜索采用线性扫描，从而判断新App在k距离内属于哪一类的App最多，从而得到该App属于哪一类。图2给出了KNN识别图；图3给出了App的分类图。Step 2, for normal Apps, use the App function list, permission list, and whether precise location information is required as training features to obtain a training set of 300 Apps. According to the training set, it is judged that the new App belongs to the App that requires precise location or the App that requires fuzzy location. The specific classification idea is: in the distance space, if most of the k nearest neighbors of a sample belong to a certain category, then the sample also belongs to this category. In the specific implementation of this paper, the distance adopts the Euclidean distance, and the k-nearest neighbor search adopts linear scanning, so as to determine which category of apps the new app belongs to within the k distance, and thus obtain which category the app belongs to. Figure 2 shows the KNN recognition map; Figure 3 shows the App classification map.
步骤3，hook系统返回给App的位置信息。Step 3, the hook system returns the location information to the App.
通过逆向分析得到返回地址信息的函数接口，并安装xposed框架，并下载对应的XposedBridgeApi-xx.jar文件；在Android studio进行插件开发，首先修改配置文件以及添加所需要的.jar文件，具体为：Obtain the function interface of the return address information through reverse analysis, install the xposed framework, and download the corresponding XposedBridgeApi-xx.jar file; for plug-in development in Android studio, first modify the configuration file and add the required .jar file, specifically:
1.修改mainfest文件，增加meta-data元素；1. Modify the mainfest file and add meta-data elements;
2.添加.jar文件到libs文件，并Add AS Library；2. Add the .jar file to the libs file, and Add AS Library;
3.修改app目录下的build.gradle文件，添加provided files(‘libs/XposedBridgeApi-54.jar’)；3. Modify the build.gradle file in the app directory and add provided files('libs/XposedBridgeApi-54.jar');
4.新建assets文件夹写入xposed_init(包名+类名)；4. Create a new assets folder and write it into xposed_init (package name + class name);
上述准备完成后，新建一个java类寻找对应上面所要Hook的关键函数，修改系统返回给App的位置数据，从而在不影响App运行的情况下，模糊位置信息的目的。具体细节为：After the above preparations are completed, create a new java class to find the key functions corresponding to the above hooks, and modify the location data returned by the system to the App, so as to blur the purpose of location information without affecting the running of the App. The specific details are:
1.首先寻找函数方法所在的包，在handleLoadPackage中通过逆向得到返回地址信息的核心函数所在的包名；1. First find the package where the function method is located, and obtain the package name where the core function of the return address information is located by reverse engineering in handleLoadPackage;
2.寻找所在的类名以及对应的函数方法，通过findAndHookMethod提供的Api寻找具体需要Hook和修改的函数；2. Find the class name and the corresponding function method, and use the Api provided by findAndHookMethod to find the specific function that needs to be hooked and modified;
3.Hook后，在afterHookedMethod函数体中实现具体的分派位置信息的功能，即：针对具体的App分派不同的位置信息。3. After the Hook, implement the specific function of assigning location information in the afterHookedMethod function body, that is, assign different location information for specific Apps.
分派位置信息的细节如下：The details of assigning location information are as follows:
针对不同类别的App，保护系统提供模糊到市级单位、模糊到虚假位置等分派机制。针对非正常的应用程序，保护系统采用模糊到虚假位置的分派机制，即向其提供虚假的位置数据；针对不需要精确位置信息的应用程序，保护系统采用模糊到市级单位的分派机制，即向其提供市级单位的位置数据，如天气预报App；而对于需要精确位置的App，如：高德地图、百度地图等，直接返回精确位置信息即可。For different categories of apps, the protection system provides distribution mechanisms such as fuzzy to city-level units, fuzzy to false locations, etc. For abnormal applications, the protection system adopts a fuzzy allocation mechanism to false locations, that is, to provide false location data; for applications that do not require precise location information, the protection system adopts a fuzzy allocation mechanism to municipal units, namely Provide them with the location data of city-level units, such as weather forecast apps; and for apps that require precise locations, such as AutoNavi Maps, Baidu Maps, etc., just return the precise location information directly.
模糊到虚假位置，对于非正常App，将一个具体的位置信息模糊成一个相应的虚假位置信息，该位置信息是真实存在的，但其不是用户的真正位置信息；Blur to a false location, for an abnormal app, blur a specific location information into a corresponding false location information, the location information is real, but it is not the user's real location information;
模糊到市级单位，即将一个具体的位置信息模糊成市级单位，如：天气预报APP，若请求用户位置信息，可以将模糊其准确信息模糊到市级单位即可，而不需要精确到区、镇、街道等单位。Fuzzy to city-level units, that is, to blur a specific location information into city-level units, such as: weather forecast APP, if requesting user location information, you can blur the accurate information to city-level units, and do not need to be accurate to districts , towns, streets and other units.
步骤4，针对保护系统，采用新型的字节码混淆，阻止逆向分析。具体的细节如下：Step 4. For the protection system, a new type of bytecode obfuscation is used to prevent reverse analysis. The specific details are as follows:
1.将保护系统反编译，得到smali代码，针对smali文件进行混淆，然后将混淆后的smali文件重新编译成一个可执行的classes.dex1. Decompile the protection system to get the smali code, obfuscate the smali file, and then recompile the obfuscated smali file into an executable classes.dex
2.将可执行文件classes.dex中被混淆指令所在的方法里所有的字节码存储在内存结构newcode中，同时将这些方法字节码用0填充2. Store all bytecodes in the method where the obfuscated instruction in the executable file classes.dex is located in the memory structure newcode, and fill these method bytecodes with 0
利用dex动态加载技术加载classes.dex文件，当其加载成功之后可以从DexFile系统类里获取可执行文件的加载地址；根据加载地址解classes.dex结构，找到被混淆方法所在的内存地址，然后newcode中存储的对应的方法的字节码填充回去，最终形成一个保护之后的应用程序Protected.apk。Use the dex dynamic loading technology to load the classes.dex file. After it is loaded successfully, you can obtain the loading address of the executable file from the DexFile system class; solve the classes.dex structure according to the loading address, find the memory address where the obfuscated method is located, and then newcode The bytecode of the corresponding method stored in is filled back, and finally forms a protected application program Protected.apk.
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611029374.1ACN106570407B (en) | 2016-11-14 | 2016-11-14 | A kind of user location privacy based on KNN perceives the guard method of mechanism certainly |
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611029374.1ACN106570407B (en) | 2016-11-14 | 2016-11-14 | A kind of user location privacy based on KNN perceives the guard method of mechanism certainly |
| Publication Number | Publication Date |
|---|---|
| CN106570407A CN106570407A (en) | 2017-04-19 |
| CN106570407Btrue CN106570407B (en) | 2019-08-23 |
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201611029374.1AExpired - Fee RelatedCN106570407B (en) | 2016-11-14 | 2016-11-14 | A kind of user location privacy based on KNN perceives the guard method of mechanism certainly |
| Country | Link |
|---|---|
| CN (1) | CN106570407B (en) |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108260083B (en)* | 2017-12-18 | 2020-01-31 | 西安电子科技大学 | Privacy protection method based on location ambiguity |
| CN108234488A (en)* | 2017-12-29 | 2018-06-29 | 北京长御科技有限公司 | A kind of file tracking method and device |
| CN109150894A (en)* | 2018-09-12 | 2019-01-04 | 珠海豆饭科技有限公司 | A kind of method and system for identifying malicious user |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101909050A (en)* | 2010-06-07 | 2010-12-08 | 孟小峰 | Location privacy protection method for preventing location-dependent attack |
| CN102770780A (en)* | 2009-12-10 | 2012-11-07 | 诺基亚公司 | Method and apparatus for building a user-generated geographic location system |
| CN105320887A (en)* | 2015-10-12 | 2016-02-10 | 湖南大学 | Static characteristic extraction and selection based detection method for Android malicious application |
| CN105512558A (en)* | 2016-01-07 | 2016-04-20 | 北京邮电大学 | Android advertisement plug-in detection method based on characteristic of decompilation module |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8943415B2 (en)* | 2010-01-08 | 2015-01-27 | Microsoft Corporation | Third party control of location information access |
| CN104376262B (en)* | 2014-12-08 | 2018-01-09 | 中国科学院深圳先进技术研究院 | A kind of Android malware detection method based on Dalvik instructions and authority combination |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102770780A (en)* | 2009-12-10 | 2012-11-07 | 诺基亚公司 | Method and apparatus for building a user-generated geographic location system |
| CN101909050A (en)* | 2010-06-07 | 2010-12-08 | 孟小峰 | Location privacy protection method for preventing location-dependent attack |
| CN105320887A (en)* | 2015-10-12 | 2016-02-10 | 湖南大学 | Static characteristic extraction and selection based detection method for Android malicious application |
| CN105512558A (en)* | 2016-01-07 | 2016-04-20 | 北京邮电大学 | Android advertisement plug-in detection method based on characteristic of decompilation module |
| Title |
|---|
| Android平台位置隐私保护系统的设计与实现;姜秀平;《中国优秀硕士学位论文全文数据库信息科技辑》;20150915(第09期);第I138-46页 |
| Publication number | Publication date |
|---|---|
| CN106570407A (en) | 2017-04-19 |
| Publication | Publication Date | Title |
|---|---|---|
| Jung et al. | Repackaging attack on android banking applications and its countermeasures | |
| JP5061908B2 (en) | Program execution control method and apparatus, and execution control program | |
| KR101503785B1 (en) | Method And Apparatus For Protecting Dynamic Library | |
| TW201805806A (en) | Kernel-based detection of target application functionality using virtual address mapping | |
| KR20170087007A (en) | Electronic Apparatus for detecting Malware and Method thereof | |
| KR20090010872A (en) | Method and apparatus for managing access rights of an application in a CDC OS environment | |
| Liebergeld et al. | Android security, pitfalls and lessons learned | |
| US11882123B2 (en) | Kernel level application data protection | |
| Choi et al. | Personal information leakage detection method using the inference-based access control model on the Android platform | |
| CN106570407B (en) | A kind of user location privacy based on KNN perceives the guard method of mechanism certainly | |
| WO2018133654A1 (en) | Protected positioning method and device | |
| Liu et al. | An empirical study on android for saving non-shared data on public storage | |
| Parikh et al. | Aslr and rop attack mitigations for arm-based android devices | |
| CN105745896A (en) | Systems and methods for enhancing mobile security via aspect-oriented programming | |
| Wu et al. | Reducing security risks of suspicious data and codes through a novel dynamic defense model | |
| CN108985096B (en) | Security enhancement and security operation method and device for Android SQLite database | |
| Xie et al. | Android vault application behavior analysis and detection | |
| Chang et al. | Towards a multilayered permission‐based access control for extending Android security | |
| Tiwari et al. | Malware detection in android application by rigorous analysis of decompiled source code | |
| Jiang et al. | A security sandbox approach of android based on hook mechanism | |
| CN116451225A (en) | Application security detection method, device, computer equipment and storage medium | |
| Kim et al. | Detecting illegally-copied apps on android devices | |
| Wang et al. | Towards android application protection via kernel extension | |
| Sharma et al. | Permission-set based detection and analysis of android malware | |
| Saini et al. | Vulnerabilities in Android OS and Security of Android Devices |
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | Granted publication date:20190823 Termination date:20201114 | |
| CF01 | Termination of patent right due to non-payment of annual fee |