关键词: 信息流, 污点跟踪, 敏感信息, 信息泄露

Abstract:

In response to the sensitive information leakage problem of Android applications, a detection scheme based on fine-grained information flow tracking strategies and static taint tracking technology was proposed. According to the syntax and semantic of Smali code, the internal call graph of application, the Android communication mechanism, and the fine-grained taint track rules were constructed, the taint analysis was executed as well on the application according to the different leak manner and the propagation strategies. The sensitive information leakage was determined by the taint analysis result. Experiments show that the scheme can detect a variety of ways of sensitive data leakage effectively, improve the detection accuracy and flexibility, and reduce the uncomprehensive of information flow path and false positive rate in the process of detection.

Key words: information flow, taint tracking, sensitive information, information leakage