Auditing Program Calls via Static-Dynamic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for auditing program calls in computer systems are inefficient, as they either require extensive workloads or miss infrequent calls, and existing tools are not capable of detecting all security threats, especially when dealing with dynamic link libraries (DLLs) and shared libraries.
Innovation Solution
A method that combines static and dynamic analysis to identify call relationships, using similarity analysis to supplement dynamic analysis results, reducing the workload and improving detection of all callers by organizing related programs and applying access control policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis is used to identify callers of a designated program, then detection capability is improved, but workload increases and infrequent calls are missed
Solution Approach 1:
The patent performs static analysis beforehand to build a comprehensive caller list from program code, import/export tables, and call graphs. This preliminary action captures all potential callers including those that make infrequent calls, eliminating the need for prolonged dynamic analysis and reducing overall workload while maintaining complete detection capability.
Solution Approach 2:
The patent combines static analysis results (caller list) with dynamic analysis results (authorized caller list) to produce a complete security audit. This merging allows the system to leverage the comprehensive detection of static analysis while incorporating the runtime accuracy of dynamic analysis, resolving the contradiction between detection completeness and workload.
2Productivity
If static analysis is used to identify callers, then workload is reduced, but detection completeness deteriorates
Solution Approach 1:
Static analysis is performed as a preliminary step to generate a comprehensive caller list that includes all potential callers. This preliminary action ensures complete detection coverage before the actual security audit, allowing the system to maintain low workload during the main audit process while preserving detection completeness.
Solution Approach 2:
The patent merges static analysis results (which provide complete caller identification) with dynamic analysis results (which provide authorized caller verification). This combination ensures that no callers are missed while maintaining efficient workload management throughout the audit process.
3Ease of operation
If access control is not implemented on DLL calls, then ease of operation is improved, but security deteriorates
Solution Approach 1:
The patent implements an automated feedback mechanism where the system generates an authorized caller list, compares it against the complete caller list, and automatically identifies unauthorized calls. This feedback loop provides security verification without manual intervention, maintaining ease of operation while ensuring robust security through automated policy enforcement.
4Reliability
If comprehensive caller identification is performed, then security is improved, but device complexity increases
Solution Approach 1:
The patent segments the security audit process into distinct phases: static analysis to generate caller list, dynamic analysis to generate authorized caller list, and comparison to identify unauthorized calls. This segmentation reduces system complexity by breaking down the comprehensive security task into manageable, independent components that can be executed separately and combined.
Data Source
AI summary
An embodiment includes generating a caller list of callers that issue requests for calling a designated program at runtime. The embodiment also includes generating an authorized caller list of authorized callers allowed to call the designated program, wherein the authorized callers are selected from among callers on the caller list. The embodiment also includes generating an authorization key for each of the authorized callers that the designated program will require as a condition for completing call requests.