WO2017121172A1 - 一种Java代码中数据流的跟踪装置和方法 - Google Patents

一种Java代码中数据流的跟踪装置和方法 Download PDF

Info

Publication number
WO2017121172A1
WO2017121172A1 PCT/CN2016/103890 CN2016103890W WO2017121172A1 WO 2017121172 A1 WO2017121172 A1 WO 2017121172A1 CN 2016103890 W CN2016103890 W CN 2016103890W WO 2017121172 A1 WO2017121172 A1 WO 2017121172A1
Authority
WO
WIPO (PCT)
Prior art keywords
bytecode
code
propagation
java
tracking
Prior art date
Application number
PCT/CN2016/103890
Other languages
English (en)
French (fr)
Inventor
金果
Original Assignee
上海斐讯数据通信技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海斐讯数据通信技术有限公司 filed Critical 上海斐讯数据通信技术有限公司
Publication of WO2017121172A1 publication Critical patent/WO2017121172A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G06F9/44589—Program code verification, e.g. Java bytecode verification, proof-carrying code
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G06F9/44521—Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading

Definitions

  • the present invention relates to the field of computer networks, and in particular, to a device and method for tracking data streams in Java code.
  • Data flow tracking technology is a security technology widely used in the field of information security.
  • the stain tracking system requires a simulator, such as a Quick EMUlator (QEMU) to run the target application.
  • QEMU Quick EMUlator
  • the tracking system is modified at the intermediate instruction level during implementation. For an x86 instruction, only one taint update operation is required. Based on the intermediate instruction, a corresponding multiple smear propagation update operation will be generated, and most of the operations are performed. The operation is a tracking update of the internal variables of QEMU, which is useless operation, resulting in a large performance overhead.
  • the technical problem to be solved by the present invention is to provide a device and method for tracking data streams in Java code, which can reduce the performance overhead of data stream tracking.
  • a technical solution adopted by the present invention is to provide a tracking device for data streams in Java code, the device comprising a determining module for determining, in the JAVA execution environment, when the JAVA bytecode is loaded, determining the to-be-tracked a bytecode; an instruction insertion module, configured to insert a data identifier propagation instruction in the bytecode, where the data identifier propagation instruction is used to identify the bytecode to be tracked, and to identify the identifier The bytecode is tracked; the tracking module is configured to identify and track the bytecode to be tracked according to the data identifier propagation instruction.
  • a technical solution adopted by the present invention is to provide a method for tracking a data stream in a Java code, the method comprising: determining, by a JAVA execution environment, a byte code to be tracked when loading a JAVA byte code; Inserting, in the bytecode, a data identifier propagation instruction, where the data identifier propagation instruction is used to identify the bytecode to be tracked, and track the identified bytecode; according to the data The identifier propagation instruction identifies and tracks the bytecode to be tracked.
  • the tracking device of the data stream in the Java code of the present invention is used for determining the byte code to be tracked when the JAVA byte code is loaded in the JAVA execution environment; inserting the data identifier propagation in the byte code An instruction, the data identifier propagation instruction is configured to identify the bytecode to be tracked, and track the identified bytecode; and use the data identifier to propagate the instruction to the byte to be tracked.
  • the code is identified and tracked; thus enabling tracking of the data stream with less overhead.
  • FIG. 1 is a schematic structural diagram of a first embodiment of a data stream tracking apparatus in the Java code of the present invention
  • FIG. 2 is a schematic structural diagram of a second embodiment of a data stream tracking apparatus in the Java code of the present invention
  • FIG. 3 is a flow chart showing a first embodiment of a method for tracking data streams in the Java code of the present invention.
  • FIG. 1 is a schematic structural diagram of a first embodiment of a data stream tracking apparatus in Java code provided by the present invention.
  • the tracking device 100 for data flow in the Java code includes: a determining module 110, an identifying module 120, and a tracking module 130.
  • the determining module 110 is configured to determine, by the JAVA execution environment, the bytecode to be tracked when the JAVA bytecode is loaded.
  • the JAVA execution environment on the terminal specifically, for example, the dalvik virtual machine first needs to translate the JAVA program into a byte code, the byte code is an intermediate code, and then The bytecode is loaded in turn, and it is determined that there is a bytecode for implementing the unauthorized behavior, for example, caching the username and password without authorization, uploading the user contact information, deleting the image on the local storage, etc. Unauthorized actions are dangerous operations that require monitoring and analysis.
  • the instruction insertion module 120 is configured to insert a data identifier propagation instruction in the bytecode, where the data identifier propagation instruction is used to identify the bytecode to be tracked, and the identified bytecode Tracking.
  • the JAVA execution environment adds an identification control code and a propagation control code to the bytecode to mark the bytecode to be tracked, and then traces the identified bytecode.
  • the tracking module 130 is configured to identify and track the bytecode to be tracked according to the data identifier propagation instruction.
  • the byte code to be tracked according to the identifier control code is identified, and the pair is recorded.
  • the operation should be performed; the identified bytecode is tracked according to the propagation control code.
  • the operation corresponding to the bytecode may be presented to the user to warn or remind the user.
  • the invention modifies the implementation source of the execution environment of the JAVA virtual machine.
  • interpreting and executing the JAVA code inserting relevant control code for identifying and tracking the bytecode, that is, tracking the data flow from the JAVA level, avoiding the slave machine
  • the underlying system instruction stream is smeared and updated, thereby avoiding tracking of a large number of intermediate instructions, reducing tracking overhead and improving tracking efficiency.
  • the tracking device of the data stream in the Java code of the present invention is used for determining the byte code to be tracked when the JAVA byte code is loaded in the JAVA execution environment; inserting the data identifier propagation in the byte code An instruction, the data identifier propagation instruction is configured to identify the bytecode to be tracked, and track the identified bytecode; and use the data identifier to propagate the instruction to the byte to be tracked.
  • the code is identified and tracked; thus enabling tracking of the data stream with less overhead.
  • FIG. 2 is a schematic structural diagram of a second embodiment of a data flow tracking apparatus in Java code provided by the present invention.
  • the tracking device 200 for data flow in the Java code includes a determination module 210, an instruction insertion module 220, and a tracking module 230.
  • the determining module 210 includes an unlicensed bytecode determining unit 211 for determining, by the JAVA execution environment, a bytecode for implementing an unauthorized behavior when loading the JAVA bytecode.
  • the JAVA execution environment on the terminal specifically, for example, the dalvik virtual machine first needs to translate the JAVA program into a byte code, the byte code is an intermediate code, and then Load the bytecode in turn.
  • the unlicensed bytecode determining unit 211 finds the bytecode that implements the unauthorized behavior, that is, the bytecode to be tracked, for example, caches the username and password without authorization, and uploads User contact information, deletion of pictures on local storage, etc. These unauthorized actions are dangerous operations, need to be monitored and analyzed.
  • the instruction insertion module 220 includes a first code insertion unit 221 and a second code insertion unit 222.
  • the first code insertion unit 221 is configured to insert an identifier control code into the bytecode, where the identifier control code is used to identify the bytecode to be tracked, and specifically, to record the to-be-tracked
  • the bytecode corresponds to the operation.
  • Table 1 gives some examples of control codes for identifying bytecodes, where the first column is the pseudocode identifying the control code, the second column is the operation performed by the code, and the third column is the code. Description of the meaning.
  • the bytecode corresponding to the abnormal operation can be passed to the parameter a.
  • the parameter c can be set to a value with a high bit of 1 low and a low bit, or a high bit of 0 and a low bit of 1, to enable the high or low of the data used in the abnormal operation. Passed to parameter a.
  • the second code insertion unit 222 is configured to insert a propagation control code into the bytecode, where the propagation control code is used to track the identified bytecode.
  • Table 2 gives some examples of propagation control codes for tracking bytecodes, where the first column is the pseudocode that propagates the control code, the second column is the operation performed by the code, and the third column is the A description of the meaning of the code.
  • Propagation control code Propagating the actions performed by the control code
  • Const-op a C a C
  • R is the function return value Copy the tag of a to the return value
  • Throw-op a E a
  • E is the current exception Copy the tag of a to the return value
  • the sensitive data originally carried by the variable a is cleared, that is, the bytecode information carried by it is cleared.
  • the bytecode information carried by a is passed to the system by the return value.
  • the tracking module 230 is configured to identify the bytecode to be tracked according to the identifier control code, and track the identified bytecode according to the propagation control code.
  • the tracking device of the data stream in the Java code further includes a rule definition module 240, configured to pre-define the identifier insertion rule and the identifier propagation rule;
  • the instruction insertion module 220 further includes an identification rule reading unit 223, configured to read a pre-defined identification insertion rule, so that the first code insertion unit 221 inserts an identification control code in the bytecode according to the predefined identification insertion rule;
  • the instruction insertion module 220 further includes a tracking rule reading unit 224, The predefined identification propagation rules are read so that the second code insertion unit 222 inserts a propagation control code in the bytecode according to the predefined identification propagation rules.
  • identification control codes and propagation control codes will be added for different services and different operational behaviors.
  • business characteristics such as game business or instant messaging service
  • possible tracking of operational behavior such as cache user name and password, or delete pictures
  • identify identification record rules and identification propagation logic to insert different Control code.
  • the tracking device of the data stream in the Java code further includes a display module 250, configured to display an operation corresponding to the identified bytecode.
  • the prompt information may be given by means of text, and the operation corresponding to the identified byte code is displayed, that is, an operation with a security risk exists to prompt or warn the user.
  • the invention modifies the implementation source of the execution environment of the JAVA virtual machine.
  • interpreting and executing the JAVA code inserting relevant control code for identifying and tracking the bytecode, that is, tracking the data flow from the JAVA level, avoiding the slave machine
  • the underlying system instruction stream is smeared and updated, thereby avoiding tracking of a large number of intermediate instructions, reducing tracking overhead and improving tracking efficiency.
  • the tracking device of the data stream in the Java code of the present invention is used for determining the byte code to be tracked when the JAVA byte code is loaded in the JAVA execution environment; inserting the data identifier propagation in the byte code An instruction, the data identifier propagation instruction is configured to identify the bytecode to be tracked, and track the identified bytecode; and use the data identifier to propagate the instruction to the byte to be tracked.
  • the code is identified and tracked; thus enabling tracking of the data stream with less overhead.
  • FIG. 3 is a schematic flowchart diagram of a first embodiment of a method for tracking data streams in a Java code provided by the present invention.
  • the steps of the method include:
  • S301 The JAVA execution environment determines the bytecode to be tracked when the JAVA bytecode is loaded.
  • the intelligent terminal based on the Android system runs the JAVA application
  • the JAVA execution environment on the terminal specifically, for example, the dalvik virtual machine first needs to translate the JAVA program into byte code, the byte code is the intermediate code, and then The bytecode is loaded, at which point the bytecode used to implement the unauthorized behavior, ie the bytecode to be tracked, is determined.
  • the user name and password are cached, user contact information is uploaded, and pictures on the local storage are deleted.
  • S302 Insert a data identifier propagation instruction in the bytecode, where the data identifier propagation instruction is used to identify the bytecode to be tracked, and track the identified bytecode.
  • the step is specifically implemented as: inserting an identifier control code into the bytecode, where the record control code is used to identify the bytecode to be tracked, that is, an operation for recording the bytecode to be tracked; And inserting a propagation control code in the bytecode, the propagation control code for tracking the identified bytecode.
  • Table 3 gives some examples of control codes for identifying bytecodes, where The first column is the pseudo code that identifies the control code, the second column is the operation performed by the code, and the third column is a description of the meaning of the code.
  • the bytecode corresponding to the abnormal operation can be passed to the parameter a.
  • the parameter c can be set to a value with a high bit of 1 low and a low bit, or a high bit of 0 and a low bit of 1, to enable the high or low of the data used in the abnormal operation. Passed to parameter a.
  • Table 4 gives some examples of propagation control codes for tracking bytecodes, where the first column is the pseudocode that propagates the control code, the second column is the operation performed by the code, and the third column is the A description of the meaning of the code.
  • Propagation control code Propagating the actions performed by the control code
  • Const-op a C a C
  • R is the function return value Copy the tag of a to the return value
  • Throw-op a E a
  • E is the current exception Copy the tag of a to the return value
  • the sensitive data originally carried by the variable a is cleared, that is, the bytecode information carried by it is cleared.
  • the bytecode information carried by a is passed to the system by the return value.
  • S303 Identify and track the bytecode to be tracked according to the data identifier propagation instruction.
  • the bytecode to be tracked is identified according to the identifier control code, and the identified bytecode is tracked according to the propagation control code.
  • an identifier insertion record rule and an identifier propagation rule are defined in advance; the data identifier propagation instruction is inserted in the bytecode, and the data identifier propagation instruction includes an identifier control code and a propagation control code, specifically Inserting an identification control code into the bytecode according to the identity insertion rule; inserting a propagation control code into the bytecode according to the identity propagation rule.
  • the operation corresponding to the identified byte code is further included.
  • the prompt information may be given by means of text, and the operation corresponding to the identified byte code is displayed, that is, an operation with a security risk exists to prompt or warn the user.
  • the invention modifies the implementation source of the execution environment of the JAVA virtual machine.
  • interpreting and executing the JAVA code inserting relevant control code for identifying and tracking the bytecode, that is, tracking the data flow from the JAVA level, avoiding the slave machine
  • the underlying system instruction stream is smeared and updated, thereby avoiding tracking of a large number of intermediate instructions, reducing tracking overhead and improving tracking efficiency.
  • the tracking method of the data stream in the Java code of the present invention determines the byte code to be tracked when loading the JAVA byte code; inserts the data identifier propagation instruction in the byte code, The data identifier propagation instruction is configured to identify the bytecode to be tracked, and track the identified bytecode; according to the data identifier The propagation instruction identifies and tracks the bytecode to be tracked; thereby enabling tracking of the data stream with less overhead.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Quality & Reliability (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种Java代码中数据流的跟踪装置和方法，该装置包括：确定模块，用于JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码；指令***模块，用于在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪；跟踪模块，用于根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪。本发明能够以比较小的开销实现数据流的跟踪。

Description

一种Java代码中数据流的跟踪装置和方法 技术领域
本发明涉及计算机网络领域，特别是涉及一种Java代码中数据流的跟踪装置和方法。
背景技术
目前信息技术已进入移动智能互联网时代，智能移动终端由于其便携性、成本低等优点日益成为用户进行各类网络活动的主要终端形态。相比传统移动终端，智能移动终端拥有更高性能的处理器、更高的移动网络数据传输能力以及开放的第三方移动终端操作***，因此借助智能移动终端可以开展大量业务应用，处理更多的个人隐私数据，如通话与短信信息，地理位置，社交网络账户，银行帐号，个人密码，照片视频等等。同时，这些个人隐私数据也吸引了众多不法攻击者的注意力，导致恶意软件增长速度惊人。因此，怎么通过对用户的访问数据进行跟踪以保证隐私数据的安全，是广大厂商迫切需要解决的问题。
数据流跟踪技术是一种在信息安全领域被广泛使用的安全技术。采用字节级的污点标记对低级的机器状态(CPU寄存器、物理内存、磁盘块等等)进行标记，同时拦截和分析***指令流，分析出指令流对污点标记的影响从而更新和维护污点标记。为了获得数据流跟踪所需的细粒度分析能力，污点跟踪***需要采用模拟器，例如快速仿真器(Quick EMUlator，QEMU)运行目标应用程序。该跟踪***在实现时都是在中间指令级进行修改，对于一条x86指令，原本只需要进行一次污点更新操作，基于中间指令实现，将会产生对应的多次污点传播更新操作，而其中大部分操作都是对QEMU内部变量进行的跟踪更新，是无用的操作，导致性能开销比较大。
发明内容
本发明主要解决的技术问题是提供一种Java代码中数据流的跟踪装置和方法，能够减少数据流跟踪的性能开销。
为解决上述技术问题，本发明采用的一个技术方案是：提供一种Java代码中数据流的跟踪装置，该装置包括确定模块，用于JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码；指令***模块，用于在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识，并对所述标识过的字节码进行跟踪；跟踪模块，用于根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪。
为解决上述技术问题，本发明采用的一个技术方案是：提供一种Java代码中数据流的跟踪方法，该方法包括：JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码；在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪；根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪。
区别于现有技术，本发明的Java代码中数据流的跟踪装置，用于JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码；在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪；根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪；从而能够以更小的开销实现数据流的跟踪。
附图说明
图1是本发明Java代码中数据流的跟踪装置的第一实施方式的结构示意图；
图2是本发明Java代码中数据流的跟踪装置的第二实施方式的结构示意图；
图3是本发明Java代码中数据流的跟踪方法的第一实施方式的流程示意图。
具体实施方式
下面结合具体实施方式对本发明的技术方案作进一步更详细的描述。显然，所描述的实施例仅仅是本发明的一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动的前提下所获得的所有其他实施例，都应属于本发明保护的范围。
参阅图1，图1是本发明提供的Java代码中数据流的跟踪装置的第一实施方式的结构示意图。
该Java代码中数据流的跟踪装置100包括：确定模块110，标识模块120，跟踪模块130。
其中，确定模块110，用于JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码。
具体的，基于安卓***的智能终端在运行JAVA应用程序时，终端上的JAVA执行环境，具体的，例如dalvik虚拟机首先需要将JAVA程序翻译成字节码，该字节码是中间代码，然后依次加载字节码，此时确定存在用于实现未授权行为的字节码，例如，没有授权时对用户名与密码做缓存，上传用户联系人信息，删除本地存储器上的图片等操作，这些未授权行为都属于危险操作、需要进行监控和分析。
指令***模块120，用于在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪。
具体的，JAVA执行环境在字节码中加入标识控制代码和传播控制代码，以便标书所述待跟踪的字节码，然后跟踪所述标识过的字节码。
针对不同的业务和不同的操作行为，将加入不同的标识控制代码和传播控制代码。
跟踪模块130，用于根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪。
具体的，根据标识控制代码对待跟踪的字节码进行标识，记录其对 应的操作；根据传播控制代码对标识过的字节码进行跟踪。
可选的，对于跟踪过的字节码，可以将字节码对应的操作展示给用户，以便警告或者提醒用户。
本发明修改了JAVA虚拟机执行环境的实现源码，在对JAVA代码进行解释执行时，***用于标识和跟踪字节码的相关控制代码，即从JAVA层面实现数据流的跟踪，避免了从机器底层的***指令流做污点标记和更新，从而避免了对大量中间指令的跟踪，减少了跟踪开销，提高了跟踪效率。
区别于现有技术，本发明的Java代码中数据流的跟踪装置，用于JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码；在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪；根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪；从而能够以更小的开销实现数据流的跟踪。
参阅图2，图2是本发明提供的Java代码中数据流的跟踪装置的第二实施方式的结构示意图。
该Java代码中数据流的跟踪装置200包括：确定模块210，指令***模块220，跟踪模块230。
其中，确定模块210包括未授权字节码确定单元211，用于JAVA执行环境在加载JAVA字节码时，确定用于实现未授权行为的字节码。
具体的，基于安卓***的智能终端在运行JAVA应用程序时，终端上的JAVA执行环境，具体的，例如dalvik虚拟机首先需要将JAVA程序翻译成字节码，该字节码是中间代码，然后依次加载字节码。未授权字节码确定单元211在JAVA执行环境加载字节码时，发现实现未授权行为的字节码、即待跟踪的字节码，例如，没有授权就对用户名与密码做缓存，上传用户联系人信息，删除本地存储器上的图片等操作，这些未授权行为都属于危险操作、需要进行监控和分析。
指令***模块220，包括第一代码***单元221和第二代码***单元222。
其中，第一代码***单元221，用于在所述字节码中***标识控制代码，所述标识控制代码用于标识所述待跟踪的字节码，具体的，用于记录所述待跟踪的字节码对应的操作。
例如，下表1给出了一些用于标识字节码的控制代码例子，其中，第一列是标识控制代码的伪代码，第二列是该代码执行的操作，第三列是对该代码的含义描述。
表1 标识控制代码列表
Figure PCTCN2016103890-appb-000001
例如，通过控制代码“move-op-E a”，能够将异常操作对应的字节码传递给参数a。
例如，通过控制代码“binary-op a b c”，将参数c设置为高位为1低位为0的值，或者高位为0低位为1的值，能够将异常操作中使用的数据的高位或者低位传递给参数a。
其中，第二代码***单元222，用于在所述字节码中***传播控制代码，所述传播控制代码用于跟踪所述标识过的字节码。
例如，下表2给出了一些用于跟踪字节码的传播控制代码例子，其中，第一列是传播控制代码的伪代码，第二列是该代码执行的操作，第三列是对该代码的含义描述。
表2 传播控制代码列表
传播控制代码 传播控制代码执行的操作 传播控制代码的含义
const-op a C a＝C，C为常量 清除a带有的标记
move-op a b a＝b 将b的标记复制给a
move-op-R a a＝R，R为函数返回值 将返回值的标记复制给a
return-op a R＝a，R为函数返回值 将a的标记复制给返回值
throw-op a E＝a，E为当前异常 将a的标记复制给返回值
例如，通过控制代码“const-op a C”，对变量a原先所携带的敏感数据被清除，即其携带的字节码信息进行清除。
例如，通过控制代码“return-op a”，将a携带的字节码信息通过返回值传递给***。
跟踪模块230，用于根据标识控制代码对待跟踪的字节码进行标识，以及根据传播控制代码对标识过的字节码进行跟踪。
可选的，该Java代码中数据流的跟踪装置进一步还包含规则定义模块240，用于预先定义标识***规则和标识传播规则；指令***模块220还包括标识规则读取单元223，用于读取预先定义的标识***规则，以便第一代码***单元221根据所述预先定义的标识***规则，在所述字节码中***标识控制代码；指令***模块220还包括跟踪规则读取单元224，用于读取预先定义的标识传播规则，以便第二代码***单元222根据所述预先定义的标识传播规则，在所述字节码中***传播控制代码。
具体的，针对不同的业务和不同的操作行为，将加入不同的标识控制代码和传播控制代码。在本方案之前需要根据业务特性，例如是游戏业务或者即时消息业务，以及可能跟踪的操作行为，例如是缓存用户名和密码、或者是删除图片，定义标识记录规则和标识传播逻辑，以便***不同的控制代码。
可选的，该Java代码中数据流的跟踪装置进一步还包含展示模块250，用于展示所述标识过的字节码对应的操作。
具体的，可以通过文本的方式给出提示信息，展示所述标识过的字节码对应的操作，即存在安全隐患的操作，以便提示或者警告用户。
本发明修改了JAVA虚拟机执行环境的实现源码，在对JAVA代码进行解释执行时，***用于标识和跟踪字节码的相关控制代码，即从JAVA层面实现数据流的跟踪，避免了从机器底层的***指令流做污点标记和更新，从而避免了对大量中间指令的跟踪，减少了跟踪开销，提高了跟踪效率。
区别于现有技术，本发明的Java代码中数据流的跟踪装置，用于JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码；在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪；根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪；从而能够以更小的开销实现数据流的跟踪。
参阅图3，图3是本发明提供的Java代码中数据流的跟踪方法第一实施方式的流程示意图。
该方法的步骤包括：
S301：JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码。
其中，基于安卓***的智能终端在运行JAVA应用程序时，终端上的JAVA执行环境，具体的，例如dalvik虚拟机首先需要将JAVA程序翻译成字节码，该字节码是中间代码，然后依次加载字节码，此时确定用于实现未授权行为的字节码、即待跟踪的字节码。例如，没有授权就对用户名与密码做缓存，上传用户联系人信息，删除本地存储器上的图片等操作，这些未授权行为都属于危险操作、需要进行监控和分析。
S302：在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪。
该步骤具体实现为：在所述字节码中***标识控制代码，所述记录控制代码用于标识所述待跟踪的字节码、即用于记录所述待跟踪字节码对应的操作；以及在所述字节码中***传播控制代码，所述传播控制代码用于跟踪所述标识过的字节码。
例如，下表3给出了一些用于标识字节码的控制代码例子，其中， 第一列是标识控制代码的伪代码，第二列是该代码执行的操作，第三列是对该代码的含义描述。
表3 标识控制代码列表
Figure PCTCN2016103890-appb-000002
例如，通过控制代码“move-op-E a”，能够将异常操作对应的字节码传递给参数a。
例如，通过控制代码“binary-op a b c”，将参数c设置为高位为1低位为0的值，或者高位为0低位为1的值，能够将异常操作中使用的数据的高位或者低位传递给参数a。
例如，下表4给出了一些用于跟踪字节码的传播控制代码例子，其中，第一列是传播控制代码的伪代码，第二列是该代码执行的操作，第三列是对该代码的含义描述。
表4 传播控制代码列表
传播控制代码 传播控制代码执行的操作 传播控制代码的含义
const-op a C a＝C，C为常量 清除a带有的标记
move-op a b a＝b 将b的标记复制给a
move-op-R a a＝R，R为函数返回值 将返回值的标记复制给a
return-op a R＝a，R为函数返回值 将a的标记复制给返回值
throw-op a E＝a，E为当前异常 将a的标记复制给返回值
例如，通过控制代码“const-op a C”，对变量a原先所携带的敏感数据被清除，即其携带的字节码信息进行清除。
例如，通过控制代码“return-op a”，将a携带的字节码信息通过返回值传递给***。
S303：根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪。
具体的，根据标识控制代码对待跟踪的字节码进行标识，以及根据传播控制代码对标识过的字节码进行跟踪。
进一步的，在步骤S301之前，预先定义标识***记录规则和标识传播规则；所述在所述字节码中***数据标识传播指令，所述数据标识传播指令包含标识控制代码和传播控制代码具体为：根据标识***规则，在所述字节码中***标识控制代码；根据所述标识传播规则，在所述字节码中***传播控制代码。
具体的，针对不同的业务和不同的操作行为，将加入不同的记录控制代码和传播控制代码。在本方案之前需要根据业务特性，例如是游戏业务或者即时消息业务，以及可能跟踪的操作行为，例如是缓存用户名和密码、或者是删除图片，定义标识记录规则和标识传播逻辑，以便***不同的控制代码。
可选的，步骤S303之后进一步还可以包含展示所述标识过的字节码对应的操作。具体的，可以通过文本的方式给出提示信息，展示所述标识过的字节码对应的操作，即存在安全隐患的操作，以便提示或者警告用户。
本发明修改了JAVA虚拟机执行环境的实现源码，在对JAVA代码进行解释执行时，***用于标识和跟踪字节码的相关控制代码，即从JAVA层面实现数据流的跟踪，避免了从机器底层的***指令流做污点标记和更新，从而避免了对大量中间指令的跟踪，减少了跟踪开销，提高了跟踪效率。
区别于现有技术，本发明的Java代码中数据流的跟踪方法，JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码；在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪；根据所述数据标识 传播指令对所述待跟踪的字节码进行标识和跟踪；从而能够以更小的开销实现数据流的跟踪。
以上所述仅为本发明的实施方式，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (10)

  1. 一种Java代码中数据流的跟踪装置，其特征在于，包括：
    确定模块，用于JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码；
    指令***模块，用于在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪；
    跟踪模块，用于根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪。
  2. 根据权利要求1所述的Java代码中数据流的跟踪装置，其特征在于：所述确定模块包括未授权字节码确定单元，用于所述JAVA执行环境在加载JAVA字节码时，确定用于实现未授权行为的字节码。
  3. 根据权利要求1或2所述的Java代码中数据流的跟踪装置，其特征在于，所述指令***模块包括：
    第一代码***单元，用于在所述字节码中***标识控制代码，所述标识控制代码用于标识所述待跟踪的字节码；
    第二代码***单元，用于在所述字节码中***传播控制代码，所述传播控制代码用于跟踪所述标识过的字节码。
  4. 根据权利要求3所述的Java代码中数据流的跟踪装置，其特征在在于，还包括规则定义模块，用于预先定义标识***规则和标识传播规则；
    所述指令***模块还包括标识规则读取单元，用于读取预先定义的标识***规则，以便所述第一代码***单元根据所述预先定义的标识***规则，在所述字节码中***标识控制代码；
    所述指令***模块还包括跟踪规则读取单元，用于读取预先定义的标识传播规则，以便所述第二代码***单元根据所述预先定义的标识传播规则，在所述字节码中***传播控制代码。
  5. 根据权利要求1或2所述的Java代码中数据流的跟踪装置，其特征在在于，还包括展示模块，用于展示所述标识过的字节码对应的操作。
  6. 一种Java代码中数据流的跟踪方法，其特征在于，包括：
    JAVA执行环境在加载JAVA字节码时，确定待跟踪的字节码；
    在所述字节码中***数据标识传播指令，所述数据标识传播指令用于对所述待跟踪的字节码做标识、并对所述标识过的字节码进行跟踪；
    根据所述数据标识传播指令对所述待跟踪的字节码进行标识和跟踪。
  7. 根据权利要求6所述的Java代码中数据流的跟踪方法，其特征在于，所述确定待跟踪的字节码具体为：确定用于实现未授权行为的字节码。
  8. 根据权利要求6或7所述的Java代码中数据流的跟踪方法，其特征在于，所述数据标识传播指令包含标识控制代码和传播控制代码，所述标识控制代码用于标识所述待跟踪的字节码，所述传播控制代码用于跟踪所述标识过的字节码。
  9. 根据权利要求8所述的Java代码中数据流的跟踪方法，其特征在于，预先定义标识***规则和标识传播规则；所述在所述字节码中***数据标识传播指令，所述数据标识传播指令包含标识控制代码和传播控制代码具体为：根据标识***规则，在所述字节码中***标识控制代码；根据所述标识传播规则，在所述字节码中***传播控制代码。
  10. 根据权利要求6或7所述的Java代码中数据流的跟踪方法，其特征在于，还包括展示所述标识过的字节码对应的操作。
PCT/CN2016/103890 2016-01-12 2016-10-29 一种Java代码中数据流的跟踪装置和方法 WO2017121172A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610017833.8A CN105677426A (zh) 2016-01-12 2016-01-12 一种Java代码中数据流的跟踪装置和方法
CN201610017833.8 2016-01-12

Publications (1)

Publication Number Publication Date
WO2017121172A1 true WO2017121172A1 (zh) 2017-07-20

Family

ID=56300089

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/103890 WO2017121172A1 (zh) 2016-01-12 2016-10-29 一种Java代码中数据流的跟踪装置和方法

Country Status (2)

Country Link
CN (1) CN105677426A (zh)
WO (1) WO2017121172A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110704874A (zh) * 2019-09-27 2020-01-17 西北大学 一种基于数据溯源的隐私泄露防护方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105677426A (zh) * 2016-01-12 2016-06-15 上海斐讯数据通信技术有限公司 一种Java代码中数据流的跟踪装置和方法

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104765687A (zh) * 2015-04-10 2015-07-08 江西师范大学 基于对象跟踪和污点分析的j2ee程序漏洞检测方法
CN105677426A (zh) * 2016-01-12 2016-06-15 上海斐讯数据通信技术有限公司 一种Java代码中数据流的跟踪装置和方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7111285B2 (en) * 2001-07-17 2006-09-19 Liquid Machines, Inc. Method and system for protecting software applications against static and dynamic software piracy techniques
CN102034045B (zh) * 2010-12-15 2012-11-28 上海交通大学 低计算机***资源开销的软件漏洞检测***
CN104778419A (zh) * 2015-04-15 2015-07-15 华中科技大学 云环境下基于动态数据流跟踪的用户隐私数据保护方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104765687A (zh) * 2015-04-10 2015-07-08 江西师范大学 基于对象跟踪和污点分析的j2ee程序漏洞检测方法
CN105677426A (zh) * 2016-01-12 2016-06-15 上海斐讯数据通信技术有限公司 一种Java代码中数据流的跟踪装置和方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110704874A (zh) * 2019-09-27 2020-01-17 西北大学 一种基于数据溯源的隐私泄露防护方法
CN110704874B (zh) * 2019-09-27 2023-06-20 西北大学 一种基于数据溯源的隐私泄露防护方法

Also Published As

Publication number Publication date
CN105677426A (zh) 2016-06-15

Similar Documents

Publication Publication Date Title
TWI696950B (zh) 用於偵測在計算設備上執行的應用軟體的高階功能的方法，及其系統和電腦程式
US10701030B2 (en) Real-time monitoring of web page code
Dai et al. Who moved my data? privacy protection in smartphones
US11645383B2 (en) Early runtime detection and prevention of ransomware
US9230099B1 (en) Systems and methods for combining static and dynamic code analysis
CN107480527B (zh) 勒索软件的防范方法及***
US9852294B1 (en) Systems and methods for detecting suspicious applications based on how entry-point functions are triggered
US9202057B2 (en) Systems and methods for identifying private keys that have been compromised
US8281410B1 (en) Methods and systems for providing resource-access information
Ntantogian et al. Evaluating the privacy of Android mobile applications under forensic analysis
CN106101113B (zh) 一种云计算数据安全标记管理方法及***
US20140201806A1 (en) Runtime risk detection based on user, application, and system action sequence correlation
JP2010113705A (ja) 仮想化されたブロック入出力切り替えによるアプリケーション管理のエージェントレス・エンフォースメント
Baumann et al. Disguised chromium browser: Robust browser, flash and canvas fingerprinting protection
CA2915068C (en) Systems and methods for directing application updates
Rizzo et al. Babelview: Evaluating the impact of code injection attacks in mobile webviews
US20170126736A1 (en) Computer network defense system
US9311481B1 (en) Systems and methods for classifying package files as trojans
WO2017121172A1 (zh) 一种Java代码中数据流的跟踪装置和方法
US9245132B1 (en) Systems and methods for data loss prevention
US9807111B1 (en) Systems and methods for detecting advertisements displayed to users via user interfaces
Gurkok Cyber forensics and incident response
US9253214B1 (en) Systems and methods for optimizing data loss prevention systems
Fan et al. Quantitative analysis for privacy leak software with privacy petri net
Wadali et al. How Efficient Is Blockchain While Dealing with Android Malware? A Review Paper

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16884724

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16884724

Country of ref document: EP

Kind code of ref document: A1