EMULATOR FOR DYNAMICALLY ANALYZING BEHAVIOR INFORMATION OF AN ANDROID APPLICATION, A DYNAMIC BEHAVIOR INFORMATION ANALYZING SYSTEM INCLUDING THE SAME, AND A COMPUTER-READABLE RECORDING MEDIUM INCLUDING A DYNAMIC BEHAVIOR INFORMATION ANALYZING PROGRAM OF THE ANDROID APPLICATION CAPABLE OF PROVIDING A REAL TIME NOTICE

摘要

PURPOSE: An emulator for dynamically analyzing behavior information of an android application, a dynamic behavior information analyzing system including the same, and a computer-readable recording medium including a dynamic behavior information analyzing program of the android application are provided to detect and notify the collection, change, and leakage of important information in a wire/wireless terminal by using a dynamic analyzing agent and a dynamic analyzing emulator.;CONSTITUTION: An information monitor(6) extracts and logs behavior information about the access, change, and leakage of real time personal information when an android application is executed in a wire terminal environment. A system resource logger(7) extracts and logs behavior information tracing a Dalvik call stack, file system read and write information, and network transceiving data information when the android application is executed. An event logger(8) extracts and logs behavior information of a system event, a touch event, a GPS(Global Positioning System) event. An analysis engine(5) analyzes a malicious code based on the collected behavior information to generate a result report.;COPYRIGHT KIPO 2013;[Reference numerals] (10) Dynamic analysis emulator; (1a) System adapter; (1b) Script player; (1c) Dynamic analysis UI application; (2a) Android framework; (2b) Core library; (2c) Dalvik VM; (3) Service queue; (30) Code analyzer; (3a) DB cursor; (3b) Event log queue; (3c) I/O log queue; (3d) Data log queue; (4) Real-time personal information external leakage notification; (40) Dynamic analysis manager; (5) Analysis engine; (5a) Dynamic analysis rule; (5b) Logging information filter; (5c) Result report; (6) Information monitor; (6a) Leakage detection; (6b) Data transformation trace; (6c) Data access detection; (7) System resource logger; (7a) Network I/O; (7b) Storage I/O; (7c) Call stack trace; (8) Event logger; (8b) Touch; (8c) System; (9a) Analysis result DB; (9b) Data log DB; (9c) I/O log; (9d) Event DB; (AA) Application execution; (BB) Script making; (CC) Emulator linkage; (DD) Agent linkage; (EE) Execution Opcode analysis; (FF) Function calling analysis; (GG) Class inheritance relation analysis