SoProtector: Safeguard Privacy for Native SO Files in Evolving Mobile IoT Applications

摘要: Android Apps have become the most important mobile applications in evolving IoT systems, whose security and privacy are confronted with ever more challenges, since such devices as smartphones involve too much personal information. Meanwhile, developers prefer to put core functions (e.g., encryption function T9 search function) of native layer for execution efficiency. However, there no automated analysis tools protect layer, especially those dynamically loaded third-party SO libraries. In order solve previous problem, which is confusing, we propose a novel scalable system, called SoProtector, prevent from leaking via data flow between Java layers. For detection malicious implanted libraries, SoProtector realizes real-time engine. We derive malware features three steps: 1) present binary files family grayscale image; 2) use ARM instructions set reversely obtain code file using Python opcode sequence; 3) each transformed form assembly language by IDA Pro, includes gdl an accompaniment. Our experiment, involved 3400 applications, demonstrates that able detect sinks, sources, smudges. It effectively inspects blocks at least 82% loading dynamically, it has relatively low overhead meantime, compared existing static FlowDroid AndroidLeaks).