面向服务端私有Web API的自动发现技术研究

陈佳; 郭山清

doi:10.11959/j.issn.2096-109x.2016.00134

您当前的位置：

首页 >

文章列表页 >

面向服务端私有Web API的自动发现技术研究

学术论文 | 更新时间：2024-06-03

- 面向服务端私有Web API的自动发现技术研究
- Toward discovering and exploiting private server-side Web API
- 网络与信息安全学报 2016年2卷第12期页码：27-38
- 作者机构：
  
  1. 山东大学计算机科学与技术学院，山东济南 250101
  2. 山东大学教育部直属密码学和信息安全重点实验室，山东济南 250101
- 作者简介：
  
  [ "陈佳（1993-），男，福建福州人，山东大学硕士生，主要研究方向为移动安全。" ]
  [ "郭山清（1976-），男，山东滨州人，山东大学副教授、博士生导师，主要研究方向为应用安全、网络安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;TheNationalNaturalScienceFoundationofChina(91546203);山东省重点研发计划基金资助项目;The Key Science Technology Project of Shandong Province(2015GGE27033);山东省自主创新及成果转化专项基金资助项目;The Independent Innovation Foundation of Shandong Province(2014CGZH1106);山东省自然基金面上资助项目;The Independent Innovation Foundation of Shandong Province(ZR2014FM020)
- DOI：10.11959/j.issn.2096-109x.2016.00134
  中图分类号： TP393
- 网络首发：2016-12，
  
  纸质出版：2016-12-15
- 稿件说明：
移动端阅览
陈佳, 郭山清. 面向服务端私有Web API的自动发现技术研究[J]. 网络与信息安全学报, 2016,2(12):27-38.

Jia CHEN, Shan-qing1 GUO. Toward discovering and exploiting private server-side Web API[J]. Chinese Journal of Network and Information Security, 2016, 2(12): 27-38.
陈佳, 郭山清. 面向服务端私有Web API的自动发现技术研究[J]. 网络与信息安全学报, 2016,2(12):27-38. DOI： 10.11959/j.issn.2096-109x.2016.00134.

Jia CHEN, Shan-qing1 GUO. Toward discovering and exploiting private server-side Web API[J]. Chinese Journal of Network and Information Security, 2016, 2(12): 27-38. DOI： 10.11959/j.issn.2096-109x.2016.00134.

摘要

移动应用和服务器交互的接口大多都采用Web API进行通信，但这些移动应用所引入的Web API会带来一些新的安全问题。为方便研究这些Web API的安全问题，在常规的Android程序测试框架的基础上，设计并实现了一个自动发现APK中面向服务器端Web API接口的系统，该系统有助于开展对服务器端私有Web API接口方面的安全研究。

Abstract

Most of the interfaces for mobile application and server interaction use the Web API for communication

but the Web API introduced by these mobile applications may introduce new security issues.To facilitate the study of the security of Web API

a system for automatically discovering the server-side Web API interface in APK files based on the conventional Android program testing framework was designed and implemented.This system can help to develop the research on private server-side Web API interface security.

关键词

Keywords

references

BOSOMWORTH D . Mobile marketing statistics compilation [EB/OL ] . http://www.smartinsights.com/mobile-marketing/mobile-marketinganalytics/mobile-marketing-statistics/ http://www.smartinsights.com/mobile-marketing/mobile-marketinganalytics/mobile-marketing-statistics/ .

SOUNTHIRARAJ D , SAHS J , GREENWOOD , et al . SMV-HUNTER:large scale,automated detection of SSL/TLS man-in-the-middle vulnerabilities in Android App[C]//The 21st Annual Network and Distributed System Security Symposium .

LU L , LI Z , WU Z , et al . Chex:statically vetting android apps for component hijacking vulnerabilities[C]//The 2012 ACM conference on Computer and communications security . 2012 : 229 - 240 .

ENCK W , GILBERT P , CHUN B G , et al . Taintdroid:an informa-tion-flow tracking system for realtime privacy monitoring on smartphones[C]//The 9th Usenix Conference on Operating Systems Design and Implementation . 2016 : 1 - 6 .

FAHL S , HARBACH M , MUDERS T , et al . Why eve and mallory love Android:an analysis of Android SSL (in) security[C]//The 2012 ACM Conference on Computer and Communications Security . 2012 : 50 - 61 .

CAI F , CHEN H , WU Y , et al . Appcracker:widespread vulnerabili-ties in user and session authentication in mobile Apps[C]//Mobile Security Technologies Workshop . 2015 .

DEVELOPERS A . Transmitting network data using volley [EB/OL ] . http://developer.android.com/training/volley/index.html http://developer.android.com/training/volley/index.html .

YANG W , PRASAD M R , XIE T . A grey-box approach for mated GUI-model generation of mobile applications[C]//In Fun-damental Approaches to Software Engineering . 2013 : 250 - 265 .

AMALFITANO D , FASOLINO A R , TRAMONTANA P , et al . Using GUI ripping for automated testing of Android applica-tions[C]//The 27th IEEE/ACM International Conference on Auto-mated Software Engineering . 2012 : 258 - 261 .

HAO S , LIU B , NATH S , et al . PUMA:programmable UI-automation for large-scale dynamic analysis of mobile Apps[C]//The 12th Annual International Conference on Mobile Systems,Applications,and Services . 2014 : 204 - 217 .

CHOUDHARY S R , GORLA A , ORSO A . Automated test input generation for Android:are we there yet?[C]//ArXiv Preprint ArXiv:1503 . 2015 .

WEB SECURITY P . Burp suite [EB/OL ] . https://portswigger.net/burp/ https://portswigger.net/burp/ .

EGELE M , KRUEGEL C , KIRDA E , et al . PiOS:detecting privacy leaks in iOS applications[C]//Network and Distributed System Se-curity Symposium (NDSS) . 2011 .

ARZT S , RASTHOFER S , FRITZ C , et al . Flowdroid:precise context,flow,field,object-sensitive and lifecycle-aware taint analy-sis for android Apps [C]//ACM SIGPLAN Notices . 2014 : 259 - 269 .

WEI F , ROY S , OU X , et al . Amandroid:a precise and general inter-component data flow analysis framework for security vetting of android Apps[C]//The 2014 ACM Sigsac Conference on Com-puter and Communications Security . 2014 : 1329 - 1341 .

CUI X , WANG J , HUI L C , et al . Wechecker:efficient and precise detection of privilege escalation vulnerabilities in android Apps[C]//The 8th ACM Conference on Security＆ Privacy in Wireless and Mo-bile Networks . 2015 : 25 .

CUI X , YU D , CHAN P , et al . Cochecker:detecting capability and sensitive data leaks from component chains in an-droid[C]//Information Security and Privacy . 2014 : 446 - 453 .

LUO T , HAO H , DU W , et al . Attacks on WebView in the Android system[C]//The 27th Annual Computer Security Applications Conference . 2011 : 343 - 352 .

CHAOSHUN Z , WUBING W , RUI W , et al . Automatic forgery of cryptographically consistent messages to identify security vulner-abilities in mobile services[C]//The 23rd ISOC Network and Dis-tributed System Security Symposium (NDSS) . 2016 .

MACHIRY A , TAHILIANI R , NAIK M Dynodroid:an input gen-eration system for Android Apps[C]//The 9th Joint Meetingon Foundations of Software Engineering . 2013 : 224 - 234 .

[EB/OL]http://developer.android.com/tools/help/monkey.html [EB/OL]http://developer.android.com/tools/help/monkey.html .

ANAND S , NAIK M , HARROLD M J , et al . Automated concolic testing of smartphone Apps[C]//The ACM Sigsoft 20th Interna-tional Symposium on the Foundations of Software Engineering . 2012 : 59 .

MAHMOOD R , MIRZAEI N , MALEK S . EvoDroid:segmented evolutionary testing of android Apps[C]//The 22nd ACM Sigsoft International Symposium on Foundations of Software . 2014 : 599 - 609 .

浏览量

2918

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于机器学习算法的主机恶意代码检测技术研究

多维度iOS隐私泄露评估模型研究

恶意代码动态分析对抗与反对抗技术综述

基于大语言模型的AppArmor安全策略自动生成方法

针对5G核心网协议的自动化漏洞挖掘方法