| 摘要: |
| 移动应用软件安全检测和防护是软件安全领域中的研究热点.传统的安全解决方案是安全厂商将其开发的APP安装到用户终端进行保护，但对于安全意识薄弱的普通用户而言，他们不了解安全威胁的严重性和安全管理APP的重要性，终端缺少安全威胁的防御能力，需要从威胁发生的源头和传播途径进行保护.从威胁发生的源头、途径和终端出发，实现了基于编程风格的源代码作者溯源追踪、移动应用安全加固及渠道监测、基于深度学习的移动应用安全检测，构建移动应用安全生态链，保障用户个人信息安全.在实际应用环境中验证了所提出方法的有效性，结果显示，该方法能够达到应用全方位安全防护的目的.另外，也对未来的研究方向进行了展望. |
| 关键词: 移动应用安全 源代码作者溯源 安全加固 渠道监测 安全检测 |
| DOI：10.13328/j.cnki.jos.005342 |
| 分类号: |
| 基金项目:国家自然科学基金（U1536119，61401038） |
|
| Construction Method on Mobile Application Security Ecological Chain |
|
YANG Xin-Yu, XU Guo-Ai
|
|
School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China
|
| Abstract: |
| Mobile application security detection and protection is an active research topic in the domain of software security. The traditional security solution is to install the APP developed by security vendors on user terminals. However, for the normal users lacking of security awareness, they do not understand the seriousness of security threat and the importance of security management, thus leading to insufficient terminal security defense. It is necessary to take protection from the threat source and transmission route. This paper implements various security measures including source code authorship attribution based on coding style, mobile application security reinforcement and channel monitoring, and mobile application security detection based on deep learning over the view of threat source, transmission route and threatened terminal. A mobile application security ecological chain is also constructed to protect users' personal information security. The paper verifies the effectiveness of proposed method in the practical application environment. The results show that it can achieve the goal of all-around application security protection. Future work in this research area is also discussed. |
| Key words: mobile application security authorship attribution of source code security reinforce channel monitoring security detection |
