Adaptive dynamic analysis method, adaptive dynamic analysis platform, and device equipped with the same

1. An adaptive dynamic analysis method for an application running in a container environment of a Linux host, the adaptive dynamic analysis method comprising:

stopping execution of a first activity of the application, and acquiring analysis information for malicious code diagnosis of the application;

conducting dynamic analysis using the analysis information;

acquiring environment information to execute a second activity based on the dynamic analysis; and

performing an execution environment update of the application by reflecting the environment information, and executing the application to enable the second activity to run,

wherein the step of the stopping of execution of the first activity of the application and the acquiring of analysis information comprises controlling a container manager process to stop the execution of the first activity,

wherein the container manager process creates the container environment in the Linux host, and accesses a process of the application running in the container environment to acquire the analysis information, and

wherein the container manager process is a parent process of an init process running in the container environment and the container manager process stops the init process to stop the execution of the first activity.

2. The adaptive dynamic analysis method of claim 1 , wherein the step of the stopping of execution of the first activity of the application and the acquiring of analysis information further comprises acquiring the analysis information including so file generated in a Linux container by execution of the first activity of the application.

3. The adaptive dynamic analysis method of claim 1 , wherein the step of the stopping of execution of the first activity of the application and the acquiring of analysis information further comprises acquiring the analysis information including dex file generated in a Linux container by execution of the first activity of the application.

4. The adaptive dynamic analysis method of claim 1 , wherein the step of the stopping of execution of the first activity of the application and the acquiring of analysis information further comprises acquiring the analysis information including tracing information of the first activity.

5. The adaptive dynamic analysis method of claim 1 , wherein the step of the acquiring of environment information to execute the second activity further comprises determining whether analysis coverage expansion is required to acquire additional analysis information for dynamic analysis of the application as a result of the dynamic analysis, and acquiring the environment information when determined that the analysis coverage expansion is required.

6. An adaptive dynamic analysis platform comprising:

a Linux host; and

a container running on the Linux host,

wherein the Linux host includes a dynamic analysis process, the dynamic analysis process including stopping execution of a first activity of an application running in the container, acquiring analysis information for malicious code diagnosis of the application, conducting dynamic analysis using the analysis information, acquiring environment information to execute a second activity based on the dynamic analysis, performing an execution environment update of the application by reflecting the environment information, and executing the application to enable the second activity to run,

wherein the Linux host further includes a container manager process which creates a container environment in the Linux host,

wherein the dynamic analysis process includes controlling the container manager process to stop execution of the first activity, and accessing a process of the application running in the container environment to acquire the analysis information, and

wherein the container manager process is a parent process of an init process running in the container environment and the container manager process stops the init process to stop the execution of the first activity.

7. The adaptive dynamic analysis platform of claim 6 , wherein the dynamic analysis process further includes acquiring the analysis information including so file generated in the container by execution of the first activity of the application.

8. The adaptive dynamic analysis platform of claim 6 , wherein the dynamic analysis process further includes acquiring the analysis information including dex file generated in the container by execution of the first activity of the application.

9. The adaptive dynamic analysis platform of claim 6 , wherein the dynamic analysis process further includes acquiring the analysis information including tracing information of the first activity.

10. The adaptive dynamic analysis platform of claim 6 , wherein the dynamic analysis process further includes determining if analysis coverage expansion is required to acquire additional analysis information for dynamic analysis of the application as a result of the dynamic analysis, and acquiring the environment information when determined that the analysis coverage expansion is required.

11. The adaptive dynamic analysis platform of claim 6 , wherein the dynamic analysis process further includes identifying execution coverage of the first activity in the application to determine if additional analysis of the application is required.

12. A device equipped with an adaptive dynamic analysis platform, wherein the adaptive dynamic analysis platform comprises:

a Linux host; and

a container running on the Linus host,

wherein the Linux host includes a dynamic analysis process, the dynamic analysis process including stopping execution of a first activity of an application running in the container, acquiring analysis information for malicious code diagnosis of the application, conducting dynamic analysis using the analysis information, acquiring environment information to execute a second activity based on the dynamic analysis, performing an execution environment update of the application by reflecting the environment information, and executing the application to enable the second activity to run,

wherein the Linux host further includes a container manager process which creates a container environment in the Linux host,

wherein the dynamic analysis process includes controlling the container manager process to stop execution of the first activity, and accessing a process of the application running in the container environment to acquire the analysis information, and

wherein the container manager process is a parent process of an init process running in the container environment and the container manager process stops the init process to stop the execution of the first activity.