Code Injection Detection via Property List Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for detecting code injection threats are not adapted for use on devices with compromised security and are computationally intensive, making them ineffective on jailbroken devices, which are vulnerable to malicious attacks and unauthorized modifications.
Innovation Solution
A method and system that perform a security check process on a computer system to identify property list files, analyze them for target identifiers, and determine if they indicate a code injection threat, with actions taken to prevent execution or notify authorities if a threat is detected, including checking for previous threats and security status restoration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional code injection detection techniques are used, then detection capability is provided, but they are computationally intensive and not adapted for devices with compromised security
Solution Approach 1:
The patent extracts only the critical security checks needed for code injection detection from a full security analysis system. Instead of performing comprehensive computational security scanning, the system selectively checks for the presence and characteristics of property list files that indicate code injection, thereby reducing computational overhead while maintaining detection capability on resource-constrained devices
Solution Approach 2:
The patent applies local quality by focusing detection efforts on specific file types (property list files) and specific indicators within those files rather than performing blanket security scanning of all system files. This targeted approach reduces overall computational requirements while maintaining effective detection of code injection threats in the most vulnerable areas
2Reliability
If security protections are enforced to prevent unauthorized changes, then system integrity is maintained, but techniques can be developed to defeat and circumnavigate these protections
Solution Approach 1:
The patent implements preliminary action by performing security checks on property list files before they can execute or cause harm. The system proactively identifies suspicious property list files and prevents their execution, thereby maintaining system integrity by stopping attacks before they can circumnavigate standard protections
Solution Approach 2:
The patent uses property list file analysis as an intermediary detection mechanism between the user space applications and the core operating system protections. By monitoring and analyzing property list files—which are commonly used in code injection attacks—the system provides an additional layer of security that detects threats before they can defeat standard permission and protection mechanisms
3Measurement precision
If comprehensive security checks are performed on all files, then detection accuracy is improved, but processing time and computational resources increase significantly
Solution Approach 1:
The patent segments the security detection process into two distinct phases: a fast preliminary phase that checks only property list files for indicators of code injection, and a more comprehensive phase that would analyze additional files if threats are detected. This segmentation allows the system to achieve high detection accuracy for the most common attack vectors while minimizing processing time for the majority of cases where no threat exists
Data Source
AI summary
A computer-implemented method for detecting a code injection threat may include: performing a search process on a memory of a computer system to identify property list files; in response to an identification of a property list file, retrieving the property list file; performing an analysis process on the property list file to identify a target identifier; in response to an identification of the target identifier in the property list file, determining whether the target identifier corresponds to an electronic application stored in the memory of the computer system; in response to determining that the target identifier corresponds to the electronic application, determining that the property list file is indicative of a code injection threat to the electronic application; and in response to the determination that the property list file is indicative of a code injection threat to the electronic application, performing a security action based on the property list.