Method and system for evaluating security of application

1. A method of evaluating security of an application, the method comprising:

storing pattern-information-by-perspective for analyzing a file package based on an obfuscation perspective and a vulnerability perspective;

registering the file package to be distributed to users for installing and executing an application;

analyzing the registered file package based on the pattern-information-by-perspective, the analyzing including (1) identifying files included in the registered file package by decomposing the registered file package and (2) identifying a file to be analyzed for each of the obfuscation perspective and the vulnerability perspective based on extensions of the identified files;

generating first analysis information of the obfuscation perspective and second analysis information of the vulnerability perspective for each file that is identified for a corresponding one of the obfuscation perspective and the vulnerability perspective, based on results of the analyzing;

providing the first analysis information of the obfuscation perspective and the second analysis information of the vulnerability perspective; and

verifying and adjusting a level of security applied to the registered file package based on the first and second analysis information,

wherein the pattern-information-by-perspective includes pattern information of the obfuscation perspective, and the pattern information of the obfuscation perspective includes pattern information for identifying whether an obfuscation is applied with respect to each item from the file that is identified from among the files included in the registered file package based on the obfuscation perspective.

2. The method of claim 1 , wherein whether the obfuscation is applied with respect to each item includes whether the obfuscation is applied to each of a method and a class included in the file that is identified based on the obfuscation perspective, and

the generating comprises,

identifying the method and the class to which the obfuscation is applied from the file that is identified based on the obfuscation perspective, based on the pattern information of the obfuscation perspective, and

generating, for each target file, the first analysis information of the obfuscation perspective including (1) a number of methods to which the obfuscation is applied, (2) a number of classes to which the obfuscation is applied, and (3) a dangerous grade determined based on the number of methods to which the obfuscation is applied and the number of classes to which the obfuscation is applied.

3. The method of claim 1 , wherein whether the obfuscation is applied with respect to each item includes whether the obfuscation is applied to each piece of information corresponding to at least one item of a section header, a string, a string table, a symbol table, or a code that is included in the file identified based on the obfuscation perspective, and the generating comprises,

identifying items to which the obfuscation is applied from the file that is identified based on the obfuscation perspective, based on the pattern information of the obfuscation perspective, and

generating, for each target file, the first analysis information of the obfuscation perspective including (1) a type of an item to which the obfuscation is applied and (2) a dangerous grade determined based on the type of the item to which the obfuscation is applied.

4. The method of claim 1 , further comprising:

generating third analysis information associated with a reference relationship between the files included in the registered file package,

wherein the providing further provides the third analysis information associated with the reference relationship.

5. The method of claim 1 , wherein the registered file package includes Android Application Package (APK), and the generating comprises,

searching for an application class from a dex file included in the APK,

verifying whether an Application Programming Interface (API) for loading another dex file further included in the APK is called based on a class and a method that are called from a body instruction included in the application class, and

determining that the obfuscation is applied to the dex file in response to a result of the verifying associated with the API indicating that the API for loading the another dex file has been called.

6. The method of claim 5 , wherein the searching for the application class comprises:

extracting a class name of the application class from an AndroidManifest.xml file included in the APK; and

identifying the application class from the dex file based on the extracted class name.

7. The method of claim 5 , wherein the verifying associated with the API comprises:

generating a call list of all of calls in the body instruction of the method included in the application class; and

verifying whether a class loader class and a load class method are called from the generated call list.

8. The method of claim 1 , wherein the generating comprises:

identifying an Executable and Linkable Format (ELF) file included in the registered file package;

first-determining whether the obfuscation is applied to at least one of an ELF header, a section header, a section, or a segment included in the ELF file; and

second-determining a security grade of the ELF file based on a result of the first-determining.

9. The method of claim 8 , wherein the generating further comprises setting a normal value range of at least one item among a size of a section header, a number of section headers, and a size of a section that are included in the ELF header, and the first-determining comprises,

extracting a value of the at least one item from the ELF header, and

determining that the obfuscation is applied to the ELF header in response to the extracted value being outside the set normal value range.

10. The method of claim 8 , wherein the first-determining comprises:

collecting addresses of functions through an export symbol entry included in a dynamic linking symbol table section (.dynsym section) among sections included in the ELF file;

extracting a value associated with a size of an execution code from a header of a section (.text section) including the execution code from a section header table included in the ELF file; and

determining whether the obfuscation is applied to the header of the section (.text section) including the execution code based on (1) the extracted value and (2) the size of the execution code calculated through the collected addresses and the extracted value.

11. The method of claim 1 , wherein the generating comprises:

identifying a Portable Executable (PE) file included in the registered file package;

extracting a body instruction of a method from a text section included in the PE file by referring to a metadata table included in the PE file; and

determining whether the obfuscation is applied to the method by analyzing the extracted body instruction.

12. The method of claim 11 , wherein the extracting comprises:

acquiring a class list by parsing the metadata table;

mapping a class and a method based on the class list; and

extracting a body instruction of the mapped method by parsing a header of the PE file.

13. The method of claim 11 , wherein the determining comprises:

determining whether the obfuscation is applied to a method corresponding to the extracted body instruction by analyzing matching of an instruction operation code (opcode) included in the extracted body instruction.

14. A non-transitory computer-readable recording medium storing instructions that, when executed by a processor, cause the processor to perform a method of evaluating security of an application, the method comprising:

storing pattern-information-by-perspective for analyzing a file package based on an obfuscation perspective and a vulnerability perspective;

registering the file package to be distributed to users for installing and executing an application;

analyzing the registered file package based on the pattern-information-by-perspective, the analyzing including (1) identifying files included in the registered file package by decomposing the registered file package and (2) identifying a file to be analyzed for each of the obfuscation perspective and the vulnerability perspective based on extensions of the identified files;

generating first analysis information of the obfuscation perspective and second analysis information of the vulnerability perspective for each file that is identified for a corresponding one of the obfuscation perspective and the vulnerability perspective, based on results of the analyzing;

providing the first analysis information of the obfuscation perspective and the second analysis information of the vulnerability perspective; and

verifying and adjusting a level of security applied to the registered file package based on the first and second analysis information,

wherein the pattern-information-by-perspective includes pattern information of the obfuscation perspective, and the pattern information of the obfuscation perspective includes pattern information for identifying whether an obfuscation is applied with respect to each item from the file that is identified from among the files included in the registered file package based on the obfuscation perspective.

15. A system for evaluating security of an application, the system comprising:

at least one memory configured to store non-transitory computer-readable instructions;

at least one processor configured to execute the non-transitory computer-readable instructions such that the at least one processor is configured to,

store pattern-information-by-perspective for analyzing a file package based on an obfuscation perspective and a vulnerability perspective,

register the file package to be distributed to users for installing and executing the application,

analyze the registered file package based on the pattern-information-by-perspective by (1) identifying files included in the registered file package by decomposing the registered file package and (2) identifying a file to be analyzed for each of the obfuscation perspective and the vulnerability perspective based on extensions of the identified files, and

generate first analysis information of the obfuscation perspective and second analysis information of the vulnerability perspective for each file that is identified for a corresponding one of the obfuscation perspective and the vulnerability perspective, based on a result of the analyzing, and

provide the first analysis information of the obfuscation perspective and the second analysis information of the vulnerability perspective,

verify and adjust a level of security applied to the registered file package based on the first and second analysis information,

wherein the pattern-information-by-perspective includes pattern information of the obfuscation perspective, and the pattern information of the obfuscation perspective includes pattern information for identifying whether an obfuscation is applied with respect to each item from the file that is identified from among the files included in the registered file package based on the obfuscation perspective.

16. The system of claim 15 , wherein the file package includes Android Application Package (APK), and

the at least one processor is further configured to,

search for an application class from a dex file included in the APK, and

verify whether an Application Programming Interface (API) for loading another dex file further included in the APK is called based on a class and a method that are called from a body instruction included in the application class, and

determine that the obfuscation is applied to the dex file in response to a result of the verification associated with the API indicating that the API for loading the another dex file has been called.

17. The system of claim 15 , wherein the at least one processor is configured to

identify an Executable and Linkable Format (ELF) file included in the registered file package,

first-determine whether the obfuscation is applied to at least one of an ELF header, a section header, a section, or a segment include in the ELF file, and

second-determine a security grade of the ELF file based on a result of the first-determining.

18. The system of claim 15 , wherein the at least one processor is further configured to

identify a Portable Executable (PE) file included in the registered file package,

extract a body instruction of a specific method from a text section included in the PE file by referring to a metadata table included in the PE file, and

determine whether the obfuscation is applied to the specific method by analyzing the extracted body instruction.