System and method for detecting sensitive user input leakages in software applications

A system for detecting sensitive user input leakages in a software application comprising,

• a processor, memory and an interface, wherein said memory is configured to store:
• a layout parsing module which parses a user interface (UI) layout file of the software application to identify input fields and obtain information concerning the input fields from the UI layout file;
• an identification module which identifies the input fields that contain sensitive information and generates a list of sensitive input fields;
• and
• a taint analysis module which detects information leaks in the sensitive input fields based on the list of sensitive input fields and notifies a user of the information leaks in the sensitive input fields to avoid use of the software application by the user, wherein the taint analysis module identifies widget variables for sensitive input fields and associates the widget variables with corresponding UI layouts in order to avoid duplicate widgets.

A method for detecting sensitive user input leakages in a software application comprising the steps of:

• parsing a user interface (UI) layout file of the software application to identify input fields;
• obtaining information concerning the input fields from the UI layout file;
• identifying the input fields that include sensitive information and generating a list of sensitive input fields;
• performing a taint analysis based on the list of sensitive input fields;
• detecting information leaks in the sensitive input fields;
• and
• notifying a user of the information leaks in the sensitive input fields to avoid use of the software application by the user;
• wherein the step of identifying the input fields that include sensitive information comprises the steps of:
• analyzing attributes of the input fields;
• reviewing hints associated with the input fields and comparing the hints with a sensitive keyword database;
• and
• analyzing text labels for an input field and comparing the text labels with the sensitive keyword database;
• wherein the sensitive keyword database is generated by performing the steps of:
• crawling text in resource files from a plurality of software applications to obtain a list of text;
• utilizing natural language processing to analyze a grammar structure of the text in the list and generating a narrowed list by excluding certain words from the list based on the grammar structure;
• and
• identifying sensitive keywords in the narrowed list.