Application Leak Detection via Identifier Tagging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users of mobile devices, particularly those on Android platforms, face limited capabilities in protecting sensitive private data from malware-induced data leaks, as advancements in mobile device malware lead to increased attempts to leak user information, and existing security measures are inadequate in detecting and preventing such leaks.
Innovation Solution
A method and system for detecting application leaks by identifying known and unknown applications, assigning identifiers to their data, monitoring data usage, and determining if the unknown application is leaking data from the known application, with a leak detection module that generates notifications and creates a leak map to alert users of potential data leaks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security measures are used to protect sensitive data, then basic security is provided, but they are inadequate in detecting and preventing malware-induced data leaks
Solution Approach 1:
The patent introduces an intermediary component (leak detection module with identifier system) that mediates between applications and data flows. This module appends unique identifiers to data packets and monitors inter-application data transfers, enabling detection of leaks without requiring complex analysis of application behavior or data content. The intermediary approach simplifies the security system while improving reliability.
Solution Approach 2:
The system performs preliminary actions by pre-assigning unique identifiers to applications and appending them to data before data leaks can occur. This proactive tagging of data with source application identifiers enables automatic tracking and detection of unauthorized data flows, eliminating the need for complex post-hoc analysis and improving detection reliability.
2Measurement precision
If comprehensive monitoring of all applications is implemented to detect data leaks, then detection accuracy improves, but system performance and user experience deteriorate
Solution Approach 1:
The patent segments the monitoring task by assigning unique identifiers to individual applications and their data flows. Instead of monitoring all applications collectively, the system divides detection into discrete, independently trackable data packets with source identifiers. This segmentation enables precise detection of specific leaks while maintaining system performance through efficient, targeted monitoring.
Solution Approach 2:
The system creates lightweight copies of data identifiers rather than duplicating or deeply analyzing the actual data content. By appending and tracking identifier metadata alongside data flows, the system achieves accurate leak detection without the computational overhead of analyzing data payloads, thus maintaining high detection accuracy while preserving system performance.
3Measurement precision
If identifier appending is performed on all data to track applications, then data flow tracking accuracy improves, but data processing overhead increases
Solution Approach 1:
The patent employs lightweight, disposable identifier tags that are appended to data packets and processed efficiently through the system. These identifier objects are designed to be computationally inexpensive to create, store, and process, enabling accurate data flow tracking without significant energy consumption or processing overhead.
Data Source
AI summary
A method for detecting application leaks is described. In one embodiment, the method may include the method may include identifying a first application as a known application, assigning a first identifier to the first application, appending the first identifier to data generated by the first application, identifying a second application as an unknown application, assigning a second identifier to the second application, identifying a data usage by the second application, appending the second identifier to data associated with the data usage by the second application, and determining whether the data usage by the second application is associated with the data generated by the first application based at least in part on the first identifier and the second identifier. In some cases, the data usage includes at least one of generating data, modifying data, and transmitting data.