Software weakness analysis methods for the secured software

Abstract

With the recent rapid growth of mobile markets, a serious problem that sensitive personal information leaks through weaknesses of mobile applications emerges anew. Because, today's software, especially, exchanges data in the Internet environment, a possibility to receive malicious attack by hackers always exists. Such a weakness is a direct cause to software security infringement accidents causing serious economic losses. Therefore, it is important to remove weaknesses in the initial development stage. However, existing weakness list and analysis methods do not reflect the mobile environment's characteristics. This paper proposes a technique through which an effective analysis can be conducted by specializing traditional analysis methodology targeting weaknesses considering the characteristics of mobile applications. The proposed technique is classified into static analysis, dynamic analysis and hybrid analysis. The hybrid analysis is a technique through which mobile applications' weaknesses can be precisely inspected with small expenses by using the information collected from the static analysis process for dynamic analysis. This paper classified the weakness lists of mobile applications into four types, and verified three analysis methods through the application case of each weakness.