Research on multi-dimensional iOS privacy disclosure evaluation model

Yue-xiu XING; Ai-qun HU; Yong-jian WANG; Ran ZHAO

doi:10.11959/j.issn.2096-109x.2016.00043

您当前的位置：

首页 >

文章列表页 >

Research on multi-dimensional iOS privacy disclosure evaluation model

Papers | 更新时间：2024-06-03

- Research on multi-dimensional iOS privacy disclosure evaluation model
- Chinese Journal of Network and Information Security Vol. 2, Issue 4, Pages: 73-79(2016)
- 作者机构：
  
  1. 东南大学信息安全研究中心，江苏南京210096
  2. 公安部第三研究所，上海200031
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2016.00043
  CLC： TN929.53
- Online First：2016-04，
  
  Published：15 April 2016
- 稿件说明：
移动端阅览
Yue-xiu XING, Ai-qun HU, Yong-jian WANG, et al. Research on multi-dimensional iOS privacy disclosure evaluation model[J]. Chinese Journal of Network and Information Security, 2016, 2(4): 73-79.
DOI：

Yue-xiu XING, Ai-qun HU, Yong-jian WANG, et al. Research on multi-dimensional iOS privacy disclosure evaluation model[J]. Chinese Journal of Network and Information Security, 2016, 2(4): 73-79. DOI： 10.11959/j.issn.2096-109x.2016.00043.

摘要

针对目前iOS平台隐私泄露检测缺乏系统性的评估方法，提出了一种多维度iOS隐私泄露评估模型。该模型分为综合静态分析、动态分析和网络数据分析方法，从多维度对应用程序隐私泄露行为进行特征抽取和评估。实验测试了30款来自苹果App Store不同类型的应用程序，发现超过50%的应用程序会读取用户位置信息，约40%的应用程序存在未经用户同意发送数据到服务器的情况。该模型弥补了单一使用静态分析或动态分析方法的局限性，有效解决了隐私泄露的量化问题。

Abstract

The existing iOS platform is lacking ofsystematic assessment methods of privacy leak detection.To solve this problem

a multi-dimensional iOSprivacy disclosure evaluation model was presented.This model combined static analysis

dynamic analysis and network data analysis method to extract the features of the application’s pri-vacy disclosure behavior and evaluate it form multiple dimensions way.The model on 30 different types of apps from the iOS App Store and found out that more than 50% of all investigated apps aretracking users’ locations were evaluated

almost 40% of all send data to a server without the user’s consent.The model makes up for the limitations of single static analysis or dynamic analysis methods

solves the quantization problem of privacy disclosure effectively.

关键词

Keywords

references

Smartphone OS market share,2015 Q2 [EB/OL ] . http://www.idc.com/prodserv/smartphone-os-market-share.jsp http://www.idc.com/prodserv/smartphone-os-market-share.jsp .

EGELE M , KRUEGEL C , KIRDA E , et al . PiOS:detecting privacy leaks in iOS applications [C ] // NDSS .c 2011 : 289 - 291 .

GILBERT P , CHUN B G , LANDON P , et al . Automating privacy testing of smartphone applications:technical report:CS-2011-02 [R ] . Duke University , 2011 .

KURTZ A , WEINLEIN A , SETTGAST C , et al . DiOS:dynamic privacy analysis of iOS applications:friedrich-alexander-universität erlangen-nürnberg,dept of computer science,CS-2014-03 [R ] . 2014 .

PENG L , CUI B J . A comparative study on software vulnerability static analysis techniques and tools [C ] // Information Theory and In-formation Security .c 2010 : 521 - 524 .

EPIFANI M , PASQUALE S . Learning iOS Forensics [M ] // Bir-mingham:Packt Publishing Ltd , 2015 : 153 - 170 .

iOS developer library [EB/OL ] . https://developer.apple.com/library/ios/navigation/#section=Frameworks＆topic=AssetsLibrary https://developer.apple.com/library/ios/navigation/#section=Frameworks＆topic=AssetsLibrary .

NYGARD S . Class-dump [EB/OL ] Managerial Finance , http://stevenygard.com/pro-jects/class-dump/.2013 http://stevenygard.com/pro-jects/class-dump/.2013 .

AGARWAL Y , HALL M . Protect my privacy:detecting and miti-gating privacy leaks on iOS devices using crowdsourcing [C ] // The Intemational Conference on Mobile Systems,Application,and Ser-vices .c 2013 : 97 - 110 .

Dumpdecrypted [EB/OL ] . https://github.com/stefanesser/dumpde-crypted https://github.com/stefanesser/dumpde-crypted .

FairPlay [EB/OL ] . https://en.wikipedia.org/wiki/FairPlay https://en.wikipedia.org/wiki/FairPlay .

Hopper [EB/OL ] . http://www.hopperapp.com/.2015 http://www.hopperapp.com/.2015 .

FREEMAN J . Mobile substrate [EB/OL ] . http://www.cydiasubstrate.com http://www.cydiasubstrate.com .

Tshark [EB/OL ] . https://www.wireshark.org/docs/man-pages/tshark.html https://www.wireshark.org/docs/man-pages/tshark.html .

Views

2382

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on host malcode detection using machine learning

Toward discovering and exploiting private server-side Web API

Survey on malicious code dynamic analysis evasion and anti-evasion techniques

Automatic generation of AppArmor security policies based on large language models

Automated vulnerability discovery method for 5G core network protocol

Related Author

Gui-xiang SONG

Dong ZHANG

Yao ZHANG

Gang LIU

Shan-qing1 GUO

Jia CHEN

ZHOU Yilin

YANG Xiuzhang

Related Institution

Key Laboratory of Cryptologic Technology and Information Security,Ministry of Education,Shandong University

School of Computer Science and Technology,Shandong University

State Key Laboratory of Public Big Data, Guizhou University

School of Cyber Science and Engineering, Wuhan University

Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education

⁰