Method and apparatus for detecting leak of information resource of device
A method and apparatus for detecting a leak of an information resource of a device. Source code is obtained from an application and is analyzed to determine whether at least one information resource from among information resources of a device is transmittable to outside the device by tracking a task performed on the at least one information resource, thereby detecting whether the application is externally leaking an information resource from the device.
1. A method of detecting a leak of an information resource of a device, the method comprising:
obtaining source code from an application;
determining, by a processor, whether at least one information resource from among information resources of the device is a candidate information resource that is determined for transmission availability to outside of the device;
tracking a task performed with respect to the candidate information resource based on the source code; and
determining whether the at least one information resource is transmittable to outside of the device, based on the tracking.
2. The method of claim 1 , wherein the determining comprises determining that at least one information resource from among information resources determined to be accessible by the application is the candidate information resource, based on the source code.
3. The method of claim 1 , further comprising obtaining additional information including access authority information about information resources accessible by the application from the application,
wherein the determining comprises determining that at least one information resource from among the information resources accessible by the application is the candidate information resource, based on the additional information.
4. The method of claim 1 , wherein the candidate information resource is determined based on a predetermined criterion.
5. The method of claim 4 , wherein one or more information resources are addable to or excludable from the candidate information resource based on an input of a user.
6. The method of claim 1 , further comprising converting the source code to an intermediate language code by using an intermediate language,
wherein the tracking comprises tracking the task performed with respect to the candidate information resource based on the intermediate language code.
7. The method of claim 6 , wherein the converting comprises grouping one or more instructions included in the source code according to a predetermined criterion, and converting the grouped one or more instructions by matching the grouped one or more instructions with one intermediate language instruction.
8. The method of claim 6 , wherein the converting comprises converting one instruction included in the source code to a combination of one or more intermediate languages instructions according to a predetermined criterion.
9. An apparatus to detect a leak of an information resource of a device, the apparatus comprising:
a processor, comprising:
an application obtainer to obtain source code from an application;
an application analyzer to determine whether at least one information resource from among information resources of the device is a candidate information resource that is determined for transmission availability to outside of the device, and tracking a task performed with respect to the candidate information resource based on the source code; and
an information leak determiner to determine whether the at least one information resource is transmittable to outside the device, based on the tracking.
10. The apparatus of claim 9 , wherein the candidate information resource comprises at least one information resource from among information resources determined to be accessible by the application based on the source code.
11. The apparatus of claim 9 , wherein the application obtainer further obtains additional information comprising access authority information about information resources accessible by the application, and
the candidate information resource comprises at least one information resource from among the information resources accessible by the application based on the additional information.
12. The apparatus of claim 9 , wherein the candidate information resource is determined based on a predetermined criterion.
13. The apparatus of claim 12 , wherein one or more information resources are addable to or excludable from the candidate information resource based on an input of a user.
14. The apparatus of claim 9 , further comprising an intermediate language converter to convert the source code to an intermediate language code by using an intermediate language,
wherein the application analyzer tracks a task performed with respect to the candidate information resource based on the intermediate language code.
15. The apparatus of claim 14 , wherein the intermediate language converter groups one or more instructions included in the source code according to a predetermined criterion, and converts the grouped one or more instructions by matching the grouped one or more instructions with one intermediate language instruction.
16. The apparatus of claim 14 , wherein the intermediate language converter converts one instruction included in the source code to a combination of one or more intermediate languages instructions according to a predetermined criterion.
17. A non-transitory computer-readable recording medium having recorded thereon a program to execute the method of claim 1 .