Article Details

Abstract

This paper proposes a systematic security testing strategy of “six dimensions and four categories of technologies” to address the coverage blind spots in the front-end testing of mobile applications (APP) during the current cybersecurity classified protection assessment. First, this paper summarizes the key assessment points that are easily overlooked by combing the security expansion requirements of mobile internet and relevant clauses of the secure computing environment. Secondly, based on general APP security testing guidelines and security testing practices, this paper constructs a technical system with static analysis, dynamic monitoring, penetration testing, and compliance auditing as the core. The relevant results are mapped directly to the classified protection assessment report, forming a closed-loop process of “once assessment, multi-dimensional compliance”. This strategy effectively fills the security assessment gap of APP front-end in the classified protection assessment and provides a reference for assessment institutions to carry out assessment work.

Keywords

MLPS 2.0; mobile application front-end; security testing strategy; static analysis; dynamic monitoring; compliance auditing

References

1. [1] Grand View Research. Mobile Application Market Size, Share & Trends Analysis Report By Store (Google Store, APPle Store, Others), By Application (Gaming, Music & Entertainment, Health & Fitness, Social Networking), And Region, Segment Forecasts, 2024 - 2030 [EB/OL].[2025-4-10].https://www.grandviewresearch.com/industry-analysis/mobile-Application-market.
2. [2] Bangbang Security. Q1 2025 Mobile Application Security Risk Report [EB/OL]. [April 10, 2025] https://www.bangcle.com/detail/cat_id/24/id/1351.html.
3. [3] National Information Security Standardization Technical Committee Information technology, basic requirements for network security level protection: GB/T 22239-2019 [S]. China Standard Press, 2019
4. [4] Wang Haoyu, Guo Yao, Ma Ziang, etc Automated detection and classification methods for third-party libraries of large-scale mobile applications [J]. Journal of Software, 2017, 28 (6): 1373-1388
5. [5] Xu Xiaori, Liu Danlin Government Regulation in Personal Information Protection: Institutional Arrangements, Enforcement Challenges, and Overall Optimization [J]. Changbai Journal, 2023 (4): 129-140
6. [6] Shen Jing Security Analysis of SSL Implementation in Android Mobile Applications [D]. Nanjing: Nanjing University of Posts and Telecommunications, 2016
7. [7] Fu Yiyang, Zhou Danping Analysis of Android Security Mechanisms [J]. Information Network Security, 2011 (9): 23-25
8. [8] Vetting the Security of Mobile Applications: NIST SP 800-163[R/OL].[2025-05-14].https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-163.pdf.
9. [9] OWASP. Mobile Application Security Testing Guide(MASTG): Version 1.7.0 [R/OL].[2025-5-14].https://owasp.org/www-project-mobile-APP-security/.
10. [10] Lu Chengdan Design and Implementation of a Mobile APP Security Detection Platform [D]. Hangzhou: Hangzhou University of Electronic Science and Technology, 2018
11. [11] Sun Yongqing, Lu Zhen, Shen Liang Research on Penetration Testing Technology for Level Protection Mobile Application Software [C]//Proceedings of the 2020 China Network Security Level Protection and Critical Information Infrastructure Protection Conference Nanning: Third Research Institute of the Ministry of Public Security, 2020:43-47, 68
12. [12] Zhao Yifan, Cao Chenye, Liu Bin, etc Analysis of Personal Information Security Detection in Mobile Apps [J]. Information Construction, 2021 (5): 62-63
13. [13] Cao Fei Research on Malicious Software Detection Based on Android Memory Images [D]. Chongqing: Chongqing University, 2016
14. [14] Cheng Ruxue Research on Regulatory Rules for Cross border Flow of Personal Information under the Background of Digital Economy [J]. Hebei Enterprise, 2025 (6): 124-128

About the authors

Tian Yuan (1988-), male, Han ethnicity, from Changtu, Liaoning, assistant researcher, master's degree, research direction: information security; Tang Changlei (1992-), male, Han nationality, from Mingguang, Anhui, engineer, bachelor's degree, research direction: information security.