Binary Code Security Risk Assessment via Multi-Dimensional Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for determining security risks in binary software code are inadequate as they fail to provide a comprehensive and intuitive assessment of various security risk factors, leading to potential vulnerabilities in software services.

Innovation Solution

A method that analyzes binary software code for factors such as network connections, open-source components, APIs, exception handling, and cryptography, generating a security label that visually represents risk levels, allowing users to understand security risks across different aspects.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If existing methods for determining security risks in binary software code are used, then the analysis process is simple, but the assessment comprehensiveness is insufficient and cannot provide intuitive risk evaluation

Engineering Contradiction:
Improvesecurity risk assessment comprehensivenessVSAvoidanalysis system complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the security risk assessment into multiple independent analysis modules, each focusing on specific security dimensions such as information leakage risks, runtime errors, security vulnerabilities, and malicious code detection. This segmentation allows comprehensive assessment while maintaining manageable complexity through modular design.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces a multi-dimensional assessment framework that evaluates security risks across different dimensions (information leakage, runtime errors, vulnerabilities, malicious code) and presents results through visual indicators. This dimensional approach transforms the assessment from a single metric to a comprehensive multi-faceted evaluation.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

2Measurement precision

If comprehensive security analysis of binary software code is performed, then security risk assessment accuracy is improved, but the analysis time and computational resources increase

Engineering Contradiction:
Improvesecurity risk detection accuracyVSAvoidanalysis time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent implements a multi-level analysis approach where the system can perform partial analysis focusing on specific security concerns or conduct more comprehensive analysis depending on requirements. This allows flexibility in balancing analysis depth with time constraints, performing only the necessary level of scrutiny for each case.

Inventive Principle:
Principle #16Partial or excessive action

Solution Approach 2:

The system performs preliminary analysis to identify obvious security issues quickly, then prioritizes further detailed analysis based on initial findings. This staged approach allows the system to rapidly assess basic security posture and allocate additional analysis resources only where needed, reducing overall analysis time while maintaining accuracy for critical issues.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3716113B1Determining security risks in binary software code
Publication Date: 2023.07.26 BLACKBERRY LTD
  • EP3716113B1 patent drawingFigure 1~2
  • EP3716113B1 patent drawingFigure 3~4

AI summary

Systems, methods, and software can be used to analyze security risks of a binary software code. In some aspects, a computer-implemented method comprises: receiving, by at least one hardware processor, a binary software code; determining, by the at least one hardware processor, a security risk value for each of a plurality of security risk factors of the binary software code; for each of the plurality of security risk factors, determining, by the at least one hardware processor, a security confidence level of the respective security risk factor; and generating, by the at least one hardware processor, a security notification, wherein the security notification includes the security confidence levels corresponding to the plurality of security risk factors.