Browser Extension Vetting via Dynamic Code Rewriting and Taint Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Online marketplaces face challenges in ensuring the quality and security of web applications and browser extensions, as existing methods lack efficient automated vetting processes to detect potential threats or malicious code before listing them for consumer download.
Innovation Solution
A computer-implemented method and apparatus that rewrites the source code of digital goods to include tracking code, allowing automatic determination of whether the digital good violates predetermined conditions by executing the rewritten code, thereby deciding whether to list it in the marketplace, which includes dynamic behavior analysis and taint tracking to identify leaks of sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual vetting of digital goods is performed to ensure quality and security, then security and quality standards are met, but the process is time-consuming and complex
Solution Approach 1:
The system performs self-service by automatically analyzing digital goods through symbolic execution and taint tracking without requiring manual reviewer intervention. The automated vetting system evaluates security properties, detects malicious code, and makes listing decisions autonomously, eliminating the time-consuming manual review process while maintaining security standards.
Solution Approach 2:
The system performs preliminary security analysis by rewriting source code to include tracking code before the digital good is listed in the marketplace. This advance vetting through symbolic execution identifies potential security issues and malicious behavior patterns prior to consumer exposure, preventing security problems rather than reacting to them.
2Reliability
If comprehensive security analysis is performed on digital goods, then security threats are detected, but the vetting process complexity increases
Solution Approach 1:
The system replaces manual mechanical review processes with automated computational analysis. Symbolic execution engines and taint tracking algorithms automatically analyze digital good behavior, substituting human reviewers with machine-based security analysis that scales efficiently without proportionally increasing process complexity.
Solution Approach 2:
The system introduces tracking code as an intermediary element that instruments the digital good's execution. This tracking code acts as a mediator between the digital good and the analysis system, automatically capturing behavior data and taint propagation without requiring complex manual analysis procedures.
3Productivity
If automated vetting processes are implemented to reduce manual review time, then vetting speed increases, but the ability to detect sophisticated threats may be reduced
Solution Approach 1:
The system employs dynamic analysis through symbolic execution that adapts to the actual runtime behavior of digital goods. The vetting process dynamically traces execution paths, evaluates conditional logic, and identifies malicious behavior based on observed dynamics rather than static code inspection, maintaining high detection accuracy while enabling automated high-speed processing.
Solution Approach 2:
The system implements feedback loops where tracking code continuously monitors digital good execution and reports behavior to the analysis system. This real-time feedback mechanism enables the automated system to detect sophisticated threats by observing actual runtime patterns, making accurate security determinations at high speed through iterative behavioral assessment.
Data Source
AI summary
An online marketplace of digital goods is provided. A digital good proposed to be listed in the marketplace is received, where the source code for the received digital good includes scripting language code. The source code of the received digital good is rewritten to include tracking code to track behavior of the received digital good during execution of the re-written digital good, and the rewritten digital good is executed in a browser run by one or more processors of a computer system. One or more processors of the computer system automatically determine, based on evaluation of results of executing the re-written digital good, whether the digital good violates one or more predetermined conditions. Based on the determination of whether the digital good violates one or more of the predetermined conditions, an automatic determination is made whether to list the received digital good in the marketplace.