Patent ID: 11928220
Assignee: FOUNDATION OF SOONGSIL UNIVERSITY INDUSTRY COOPERATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G  H

Claim 6:
7. A device for evaluating a risk of data leakage in a mobile application, the device comprising:
a file extracting unit configured to extract a DEX (Dalvik Executable) file and a so (Shared Object) file by decompressing an APK file of the mobile application;
a DEX parsing unit configured to extract DEX code information from the DEX file by parsing the DEX file;
an ELF translating unit configured to translate a content of the so file into IR (Intermediate Representation);
an IR parsing unit configured to extract IR code information from the translated IR;
a call-reference structure generating unit configured to generate a call-reference structure between the DEX file and the so file by processing the extracted DEX code information and the extracted IR code information; and
a risk analyzing unit configured to output weakness information according to a risk designated in advance based on the generated call-reference structure,
wherein the risk analyzing unit comprises:
an inspecting unit configured to compare a list of specific functions and methods classified according to risks with the generated call-reference structure to inspect whether a corresponding function exists;
a path generating unit configured to track and generate all reachable paths, when the corresponding function exists in the generated call-reference structure;
a loss searching unit configured to search whether a point moving to an I/O (Input/Output, L) of a system exists;
an information generating unit configured to produce the weakness information according to the risk designated in advance, when the point moving to the I/O exists; and
an output unit configured to document the weakness information according to a standard format and output the documented weakness information as a final output.