Application Reputation Scoring via Deviation Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Security systems face challenges in accurately distinguishing between legitimate and rogue applications signed with a common key, leading to potential security risks due to key leaks, which can result in false positives or false negatives in blocking or allowing application execution.

Innovation Solution

A method to calculate a difference score for application packages signed with a common key, comparing their content to an average score, and flagging packages with significant deviations as potential security risks, generating alerts and updating reputations to prevent malicious applications from being installed or executed.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security systems use rule-based security policies to rate applications, then security risks can be identified, but false positives occur blocking legitimate applications

Engineering Contradiction:

Improvesecurity risk identification accuracyVSAvoidfalse positives blocking legitimate applications

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The system calculates a difference score by comparing application content characteristics (APIs, GUI elements, package naming) against the average profile of applications signed by the same developer. This feedback mechanism allows the system to dynamically adjust security ratings based on statistical deviations rather than static rules, reducing false positives while maintaining detection of actual threats

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent transforms the security evaluation from binary rule-based decisions to a continuous scoring system. By calculating difference scores based on multiple content parameters (API usage, GUI elements, naming conventions) and comparing against statistical averages, the system creates a nuanced reputation score that better distinguishes legitimate variations from malicious behavior

Inventive Principle:

Principle #35Parameter changes

2Object-affected harmful factors

If security systems block applications with significant deviations, then rogue applications can be prevented, but legitimate applications with unique characteristics may be blocked

Engineering Contradiction:

Improverogue application executionVSAvoidlegitimate application diversity

Core Design Contradiction:

Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

The system applies security blocking selectively based on the magnitude of deviation. By setting a threshold at two standard deviations from the mean, the system blocks only the most extreme outliers while allowing moderate variations. This partial action approach prevents rogue applications with significant deviations while preserving legitimate applications with moderate uniqueness

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent analyzes specific local characteristics of applications (API usage patterns, GUI element styles, package naming conventions) rather than treating all applications uniformly. By examining these localized content features and comparing them against developer-specific baselines, the system can identify rogue applications with different local qualities while preserving legitimate applications with acceptable local variations

Inventive Principle:

Principle #3Local quality

3Measurement precision

If difference scores are calculated for all application packages, then security risks can be detected, but computing resources are consumed

Engineering Contradiction:

Improvesecurity risk detection accuracyVSAvoidcomputing system resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system pre-calculates and stores the average content characteristics for each developer's application portfolio before evaluating new applications. This preliminary action creates a ready-made baseline that speeds up subsequent difference score calculations, reducing the computational burden when evaluating individual application packages while maintaining detection precision

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9894045B1Determining application reputation based on deviations in security rating scores

Publication Date: 2018.02.13 CA TECH INC

AI summary

The present disclosure relates to detecting security risks from application packages signed using a key based on differences detected between application packages. An example method generally includes calculating a difference score for a first application package signed using the key. The difference score may be based on differences detected between content of the first application package and content of one or more second application packages signed using the key. A computing system calculates an average difference score from the individual difference scores. Upon determining that the difference score for a specific application package of the second application packages exceeds the average difference score by a threshold amount, the computing system sets a reputation associated with the specific application package to an unknown reputation and generates an alert indicating that the specific application package is a potential security risk.