Application Source Identification on Non-Rooted Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying the source of application installations on non-rooted devices is challenging due to the lack of root access, which hinders effective malware detection and privacy risk assessment, as the Installer field in telemetry data often returns NULL, especially in non-rooted Android devices.
Innovation Solution
A method and apparatus that use an application source identifier to extract a process identifier (PID) from log messages associated with application installations, convert it to a package name, and submit this information to a security service over a network to determine the application source and confidence level, enabling security actions such as user notifications or uninstall options.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mobile security apps are run on non-rooted devices to maintain device security and user privacy, then device security and user privacy are preserved, but the ability to identify application sources is lost because the Installer field returns NULL
Solution Approach 1:
The patent uses log messages as an intermediary to indirectly obtain application source information. Instead of directly accessing the Installer field through root access, the security app extracts PID from log messages generated during application installation, then uses the PID to query the application source from a package manager or other system components that don't require root access.
Solution Approach 2:
The patent replaces the mechanical system of direct file system access (which requires root permissions) with an information-based system using log message analysis and package name querying. This substitution allows the security app to obtain installation source information through software-based methods that work within non-rooted device constraints.
2Measurement precision
If root access is granted to security applications to enable direct access to Installer field, then application source identification becomes accurate, but device security and user privacy are compromised
Solution Approach 1:
The patent introduces log messages as an intermediary layer between the security app and the application installation data. By analyzing log messages that contain PID information and then querying package names through system APIs, the patent achieves accurate application source identification without requiring direct root access to the Installer field, thus maintaining device security while obtaining precise installation source information.
3Ease of operation
If the Installer field is used directly to identify application sources, then the process is simple and fast, but it fails on non-rooted devices where the field returns NULL
Solution Approach 1:
The patent segments the application source identification process into multiple steps: extracting PID from log messages, querying package name from PID, and then determining the application source from package name. This segmentation allows the system to work around the NULL Installer field issue on non-rooted devices by using alternative data sources and methods that are compatible with restricted permission environments.
Data Source
AI summary
A method and apparatus for identifying an application source from which an application is installed on a non-rooted computing device. An application source identifier of a security application that does not have root access to an operating system monitors for an application installation. The application source identifier extracts a process identifier (PID) of the application being installed from a log message associated with the application installation and determines a package name from the PID. The PID identifies an application source from which the application is installed. The application source identifier receives, based on the package name, a confidence level for the application source from a security service over a network.