App Permission Circumvention Detection via Network Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern smartphone platforms face challenges in preventing unauthorized access to sensitive resources and data due to the use of side channels and covert channels, which allow apps to circumvent permission-based security mechanisms, compromising user privacy and violating regulatory standards.
Innovation Solution
A method for automatically identifying applications that circumvent permissions by logging network traffic, using dynamic and static analysis to detect unauthorized data transmission, and generating reports on apps that access protected data without proper permissions, employing user interaction simulators, network traffic loggers, and platform/kernel instrumentation to monitor and decode encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a permission-based model is implemented to regulate access to sensitive resources, then user control and data protection are improved, but the system becomes vulnerable to side channels and covert channels that circumvent these permissions
Solution Approach 1:
The patent introduces an intermediary monitoring system that sits between the permission-based security mechanism and the applications. This intermediary logs network traffic, captures data transmissions, and analyzes whether apps are using side channels or covert channels to circumvent permissions. The intermediary acts as a detector that doesn't change the permission model but monitors for bypass attempts.
Solution Approach 2:
The patent replaces manual security auditing with automated dynamic analysis. Instead of relying on developers to manually ensure permission compliance, the system uses automated tools that intercept network traffic, extract data, and dynamically analyze app behavior to detect permission circumvention. This substitutes human expertise with automated mechanical analysis.
2Difficulty of detecting and measuring
If comprehensive monitoring of network traffic and data flows is implemented to detect permission circumvention, then detection capability is improved, but system complexity and overhead increase
Solution Approach 1:
The patent segments the monitoring function into distinct modular components: network traffic capture module, data extraction module, analysis module, and reporting module. Each component handles a specific aspect of the monitoring process independently. This segmentation reduces overall system complexity by allowing each module to be optimized and maintained separately while working together to achieve comprehensive detection.
Solution Approach 2:
The patent implements monitoring at strategic partial points in the data flow rather than attempting to monitor every possible operation. By focusing on network traffic captures and specific data extraction points, the system achieves sufficient detection capability without the excessive complexity of comprehensive instrumentation at all system levels. This partial monitoring approach provides effective detection while managing system overhead.
Data Source
AI summary
A method for automatically identifying applications that circumvent permissions. The method includes logging network traffic transmitted by one or more computing devices while the one or more computing devices execute one or more applications, identifying, based on analyzing the logged network traffic and permissions granted to the one or more applications, those of the one or more applications that caused permission-protected data to be transmitted without having permission to access that data as circumventing permissions, and generating a report indicating the applications that were identified as circumventing permissions.