




版權(quán)說明:本文檔由用戶提供并上傳,收益歸屬內(nèi)容提供方,若內(nèi)容存在侵權(quán),請(qǐng)進(jìn)行舉報(bào)或認(rèn)領(lǐng)
文檔簡(jiǎn)介
桂林電子科技大學(xué)信息科技學(xué)院畢業(yè)設(shè)計(jì)(論文)外文翻譯(原文)系(部): 信息工程系專業(yè): 軟件工程學(xué)生姓名: 學(xué)號(hào): 指導(dǎo)教師單位計(jì)算機(jī)科學(xué)與工程學(xué)院名: 職稱:教授2016年5月26日外文原文HowAndroidconqueredthemobileworldinjustthreeyearsNetworkWorld(Online),2010TheadventoftheDroidseenbymanyasturningpointforGoogleinmobilemarketIt'seasytoforgetthatnotsolongago,noonewassureifAndroidwouldeverberelevant.Afterall,theAndroidexplosionhasreallyonlyeruptedoverthepastyear,roughlytwoyearsafterAndroidmadeitsdebutinthefallof2007.SinceJanuaryalone,Androidhasdoubleditstotalmarketshareinthemobileoperatingsystemmarket,anddevicesbasedonAndroidaccountedforawhopping44%ofsmartphonespurchasedinthethirdquarterof2010,accordingtoresearchfirmChangeWave.ResearchfirmGartnerhasprojectedthatbytheendoftheyearsalesofAndroiddeviceswillexceedthosebasedontheBlackBerryOSandtheiPhoneOS,meaningthatAndroidwilltrailonlySymbianastheworld'smost-usedmobileoperatingsystem.Butforthefirsttwoyearsofitsexistence,Androidhadatoughtimemakingmajorwaves.ThefirstdevicetobebasedonAndroid,T-Mobile'sHTCG1,madeitsdebutinthefallof2008andwasmostlyovershadowedbymorehigh-profilesmartphonessuchastheAppleiPhoneandtheBlackBerryStorm.MorganSlain,theCEOofmobileapplicationsdeveloperSplashData,saysthatthislackofinitialsuccessledalotofapplicationdeveloperstohesitatebeforeinvestingtoomanyresourcesindevelopingfortheplatform,despitethefactthatitwasfreeandopensource."WestartedearlydoingAndroiddevelopmentbutatfirstitwasallhypeandnosales,"hesays."Itwasanewplatformforus.Itseemedtohavealotofpotentialbutitwasfrustratingthatthereweren'tanysalescominginforus.ScottWebster,whohasbeencoveringAndroidforthepastthreeyearasoneofthefoundersofthepopularAndroidGuysblog,sayshegotasimilarvibefromdevelopershetalkedtoduringAndroid'searlyyears."Theinitialbuzzfromdeveloperswas,'Wedon'tknowwhatthisisyet,'"hesays."Therewasahugewait-and-seeapproach."GooglepluggedalargechunkofcashintobringingapplicationdevelopersonboardwithAndroidbyofferingatotalof$10millioninprizesaspartofitsAndroidDeveloperChallengeduringAndroid'sinitiallaunch.Slainsaysthatwhilehiscompanyandmanyothersenteredthechallenge,theywerestillgreatlyunsureofAndroid'slong-termpotentialsincetheoperatingsystemwasn'tyetavailableonanymarqueedevicesandtherewasasensethatAndroidwas"allbuzz"withoutanythingtobackitup.That'snottosaythatAndroidasadevelopmentplatformwasnotenticing.SinceAndroidisaLinuxplatformthatusesJavaasitsprogramminglanguage,mostsoftwaredevelopersonthemarketfoundthatwritingprogramsfortheoperatingsystemwasabreeze.GooglealsowentoutofitswaytomakepostinganewapplicationontheAndroidMarketasnap,asthecompanydoesnotscreenapplicationssenttothestoreandwillonlyremovethemifithasreceivedlegitimatecustomercomplaints."GoogledidalotofthingsrightwhenitdesignedAndroid,"saysIDCanalystSteveDrake."Theymadeitopen,theymadeitveryclean,theytriedtokeepitsimpleintermsofitscodeandofferingsandtheymovedveryquicklytomakesureeachnewversionoftheOScontainedrealimprovements."Sotheoperatingsystemitselfwasfine.Nowallitneededwasadevicetodrivepopularity.EntertheDroidAndroidgotitsbigbreaklastNovemberwiththereleaseoftheMotorolaDroidontheVerizonnetwork.TheDroid'sreleasewasimportantbecauseitmarkedthefirsttimethatanAndroid-baseddevicewasbeingsupportedbyeitherofthenation'stwolargestwirelesscarriers.VerizondecidedtoaggressivelymarkettheDroidasabetteralternativetotheAppleiPhonebypointingoutthattheDroidhadaphysicalkeyboardandtheabilitytorunsimultaneousapplications.AndwhiletheDroiddidn'tsellasmanyunitsastheiPhone,itdidsellwellover1million,thusputtingAndroidfirmlyonthemobileoperatingsystemmap.SlainsaysthattheimpactoftheDroidonhiscompany'ssaleswasimmediateandsignificant."Wenoticedadifferenceliterallyovernight,"hesays."AndeversincetheDroidlaunchit'sbeenaconsistentlystrongplatform."PaulCarton,thevicepresidentofresearchatChangeWave,notesthatinterestinMotorolaproductsamongcorporateusersdoubledbetweenAugust2009andNovember2009,asthenumberofcorporateuserssurveyedbyChangeWavewhoplannedtobuyMotorolaproductssurgedfrom5%to10%overthespanofthreemonths."WeweresurprisedbythemonstrousleapinMotorolainterestlastyear,"Cartonsays."Doyouseeanythingelsethatlookslikethatayearago?It'sallbecauseofAndroid."Verizondecidedtoapplythe"Droid"brandtoseveralotherAndroidphonesonitsnetwork,includingtheHTCDroidIncredible,theMotorolaDroidXandtheMotorolaDroidPro.CouplethiswiththefactthatthefirstWiMAX-basedphoneavailableintheUnitedStateswasalsobasedonAndroidandyouhaveseveralhigh-profiledevicesthathavemadeAndroidanationalbrand.Andwhat'smore,peopleseemtobeverypleasedwithAndroiddevicesas67%ofAndroiduserssurveyedbyChangeWavesaidtheywereverysatisfiedwiththeoperatingsystem,secondonlytothe71%ofiPhoneuserswhosaidtheyweresatisfiedwiththeiPhoneOS.Lookingahead,itseemsthatAndroidwilltrytomakeheadwayintotherapidlygrowingmarketfortabletcomputersthatiscurrentlybeingdominatedbyApple'siPad.AlthoughAndroidhasalreadybeenusedastheoperatingsystemfortabletssuchastheSamsungGalaxy,Googleisworkingonanewversionofthesoftwarethatwillbeoptimizedforlarge-screendevicesinwaysthatcurrentversionsaren't.WebstersaysitwillbeinterestingtoseehowmuchGoogletinkerswithAndroidtomakeitabetterfitfortablets."Willtheychangetheexperienceforswipingandfordragginganddropping?"hewonders."We'llhavetowaituntilnextyear,though,becauseitcouldbesixmonthsbeforeweseetabletoptimizationforAndroid."VulHunter:TowardDiscoveringVulnerabilitiesinAndroidApplicationsIEEEMicro2015Vol.35No.1P44-53WiththeprosperityoftheAndroidappeconomy,manyappshavebeenpublishedandsoldinvariousmarkets.However,shortdevelopmentcyclesandinsufficientsecuritydevelopmentguidelineshaveledtomanyvulnerableapps.Althoughsomesystemshavebeendevelopedforautomaticallydiscoveringspecificvulnerabilitiesinapps,theireffectivenessandefficiencyareusuallyrestrictedbecauseoftheexponentialgrowthofpathstoexamineandsimplifiedassumptions.Inthisarticle,theauthorsproposeanewstatic-analysisframeworkforfacilitatingsecurityanalyststodetectvulnerableappsfromthreeaspects.First,theyproposeanapppropertygraph(APG),anewdatastructurecontainingdetailedandpreciseinformationfromapps.Second,bymodelingapp-relatedvulnerabilitiesasgraphtraversals,theauthorsconductgraphtraversalsoverAPGstoidentifyvulnerableappsforeasingtheidentificationprocess.Third,theyreducetheworkloadofmanualverificationbyremovinginfeasiblepathsandgeneratingattackinputswheneverpossible.TheyhaveimplementedtheframeworkinasystemnamedVulHunterwith9,145linesofJavacodeandmodeledfivetypesofvulnerabilities.Checking557popularappsthatarerandomlycollectedfromGooglePlayandhaveatleast1millioninstallations,theauthorsfoundthat375apps(67.3percent)haveatleastonevulnerability.WiththemobileInternet'sprosperity,recentyearshavewitnessedanunprecedentednumberofAndroidapplications("apps”)publishedandsoldinappmarkets.However,shortdevelopmentcyclesandinsufficientsecuritydevelopmentguidelineshaveledtomanyvulnerableapps.Afteranalyzing2,107appsfromcompaniesontheForbesGlobal2000,HPresearchrecentlyfoundthat90percentofappsarevulnerable(/1FK7I5b).Motivatedbyrecentresearch1,weproposeanewstatic-analysisframeworktofacilitatevulnerabilitydiscoveryforappsbyextractingdetailedandpreciseinformationfromapps,easingtheidentificationprocess,andreducingthemanual-verificationworkload.Moreprecisely,wedesignanoveldatastructurecalledtheapppropertygraph(APG),whichsmoothlyintegratesabstractsyntaxtrees(ASTs),aninterprocedurecontrol-flowgraph(ICFG),amethod-callgraph(MCG),andasystemdependencygraph(SDG)torepresenteachapp.AlthoughtheAPGismotivatedbythecodepropertygraph(CPG)1,theAPGdiffersfromtheCPGduetothesignificantdifferencebetweenappsandCsourcecodes(seethe“RelatedWorkinVulnerabilityDiscovery”sidebarfordetails).Forexample,theAPGemploystheICFG,MCG,andSDGtocharacterizethefrequentinterprocedureandintercomponentcommunicationsinapps.TheAPGalsoincorporatespermissionsandotheruniquefeaturesinappsasproperties.Toeasetheidentificationprocess,wemodelcommonvulnerabilitiesofappsreportedintheCommonVulnerabilitiesandExposures(CVE)systemasgraphtraversalsanddetectvulnerableappsbyconductinggraphtraversalsoverAPGs.NotethateachappneedstobeprocessedjustonceforextractingAPGandthenwecanconductvariousgraphtraversals,includingthoseextractedfromnewvulnerabilitypatterns.Moreover,toreducethemanual-verificationworkload,weemploysymbolicexecutiontofilteroutinfeasiblepathsandsuggestattackinputswheneverpossible.IncreatingtheAPG,wetackledmanychallenges,includingdealingwithobjectreferencesandinheritanceinShimpleIRcodesandhandlingAndroid'sevent-drivenmechanism.Also,weproposeanapproachtoconvertShimpleIRcodestoSMT-Lib2codessothattheexistingSMTsolvercanbeused.Finally,weimplementedtheframeworkinVulHunterwith9,145linesofJavacodes.Wemodeledfivecommonvulnerabilitiesasgraphtraversalsandcheckedthesecurityof577popularapps,eachofwhichhasmorethan1millioninstallations.Theresultshowsthat375appshaveatleastonevulnerability.Figure1depictsthemajorstepsinourframework,whichhasthreenecessarystepsandthreeoptionalsteps,dependingonthetypeofvulnerability.VulHunterhasimplementedallthesesteps.Weusearealvulnerableapp,GoSMSPro(com.jb.gosms,v3.72),toillustratehowVulHunterworks.Thisapphasanexportedservice,CellValidateService,whichsendsashortmessageservice(SMS)accordingtoincomingintents.Becausethisservicedoesnotsanitizeincomingintents,anadversarycansendacraftedintentfortriggeringGoSMStosendanSMStoanarbitrarydestinationaddress.Figure2illustratesthevulnerablecodesnippet,thecorrespondingShimpleIRcode,anditsAPG.VulHunterfirstconstructsanapp'sAPGaccordingtoitsAndroidManifest.xmlandclasses.dexandthenstoresitinagraphdata-base,whichusesgraphstructures(includingnodes,edges,andpropert
溫馨提示
- 1. 本站所有資源如無特殊說明,都需要本地電腦安裝OFFICE2007和PDF閱讀器。圖紙軟件為CAD,CAXA,PROE,UG,SolidWorks等.壓縮文件請(qǐng)下載最新的WinRAR軟件解壓。
- 2. 本站的文檔不包含任何第三方提供的附件圖紙等,如果需要附件,請(qǐng)聯(lián)系上傳者。文件的所有權(quán)益歸上傳用戶所有。
- 3. 本站RAR壓縮包中若帶圖紙,網(wǎng)頁內(nèi)容里面會(huì)有圖紙預(yù)覽,若沒有圖紙預(yù)覽就沒有圖紙。
- 4. 未經(jīng)權(quán)益所有人同意不得將文件中的內(nèi)容挪作商業(yè)或盈利用途。
- 5. 人人文庫網(wǎng)僅提供信息存儲(chǔ)空間,僅對(duì)用戶上傳內(nèi)容的表現(xiàn)方式做保護(hù)處理,對(duì)用戶上傳分享的文檔內(nèi)容本身不做任何修改或編輯,并不能對(duì)任何下載內(nèi)容負(fù)責(zé)。
- 6. 下載文件中如有侵權(quán)或不適當(dāng)內(nèi)容,請(qǐng)與我們聯(lián)系,我們立即糾正。
- 7. 本站不保證下載資源的準(zhǔn)確性、安全性和完整性, 同時(shí)也不承擔(dān)用戶因使用這些下載資源對(duì)自己和他人造成任何形式的傷害或損失。
最新文檔
- 深度解析教育科技行業(yè)未來發(fā)展方向
- 教育機(jī)構(gòu)如何利用游戲化平臺(tái)提高教學(xué)效果
- 企業(yè)培訓(xùn)中多媒體技術(shù)的應(yīng)用與創(chuàng)新-以智慧教室為例
- 新版培訓(xùn)課件模板圖片
- 碧桂園張家港拓客內(nèi)部培訓(xùn)89
- 全民健身設(shè)施補(bǔ)短板工程實(shí)施方案在城市老舊小區(qū)健身設(shè)施改造中的應(yīng)用研究
- 全球鈾礦資源市場(chǎng)前景與2025年核能產(chǎn)業(yè)綠色低碳發(fā)展戰(zhàn)略報(bào)告
- 公交優(yōu)先戰(zhàn)略在2025年城市交通擁堵治理中的可持續(xù)發(fā)展報(bào)告
- Carpetimycin-B-生命科學(xué)試劑-MCE
- 成都文理學(xué)院《游戲美術(shù)設(shè)計(jì)》2023-2024學(xué)年第一學(xué)期期末試卷
- 倉儲(chǔ)部標(biāo)簽管理制度
- 數(shù)字化情報(bào)資源管理-洞察闡釋
- 電氣自動(dòng)化 霓虹燈廣告屏的PLC控制設(shè)計(jì)
- 穿透式管理模式在建設(shè)項(xiàng)目中的應(yīng)用與探索
- 車庫門維修合同范本
- 2025年度事業(yè)單位公開招聘考試《綜合應(yīng)用能力(E類)公共衛(wèi)生管理》試卷真題及解析
- 三市耐多藥肺結(jié)核病患者管理狀況剖析與優(yōu)化策略探究
- 公司貿(mào)易合規(guī)管理制度
- CJ/T 461-2014水處理用高密度聚乙烯懸浮載體填料
- 社區(qū)工作者綜合能力考試基礎(chǔ)知識(shí)試題及答案
- T/CBMCA 046-2023潔凈室用裝配式隔墻及吊頂系統(tǒng)技術(shù)要求
評(píng)論
0/150
提交評(píng)論