Collective Record Replay for Application Security Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current permission systems in modern operating systems are vulnerable to malicious applications that can compromise user privacy and violate security policies, with existing monitoring methods being costly, time-consuming, and limited by data collection quantity or performance overhead.
Innovation Solution
A method and system for application monitoring through collective record and replay, where execution traces are recorded from multiple user devices at a runtime library and replayed to determine if an application poses a security risk, using probabilistic logging to reduce overhead and identify malicious usage of non-deterministic data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual review of each application is performed to prevent malicious applications, then security reliability is improved, but productivity and time consumption deteriorate
Solution Approach 1:
The system performs preliminary monitoring and recording of application execution traces in the wild before formal review. By collecting and analyzing execution data from multiple users' devices, the system pre-identifies potentially malicious applications, enabling faster and more informed manual review decisions without compromising security reliability
Solution Approach 2:
The system creates copies of application execution traces from multiple user devices and analyzes these copies centrally. This allows comprehensive security analysis without interfering with the actual application execution on user devices, maintaining security reliability while enabling parallel processing and improved review productivity
2Reliability
If event logging and crash reports are used to monitor applications, then security monitoring capability is improved, but quantity of collected data deteriorates
Solution Approach 1:
The system merges execution trace data from multiple independent user devices into a centralized collection. By combining traces from many users running the same application, the system achieves comprehensive security monitoring capability while each individual user's device generates minimal data overhead
Solution Approach 2:
The system transitions from monitoring a single application instance to monitoring the same application across multiple dimensional instances (different user devices). This multi-dimensional approach amplifies the security monitoring capability while the data collection burden remains distributed and minimal per user
3Reliability
If online taint flow analysis is used to monitor applications, then security analysis capability is improved, but performance overhead on end user deteriorates
Solution Approach 1:
The system extracts the heavy computational analysis workload from individual user devices and relocates it to a centralized server. Execution traces are collected locally with minimal overhead, but the computationally intensive taint flow analysis is performed externally, maintaining security analysis capability while minimizing performance overhead on end-user devices
Solution Approach 2:
The system introduces a centralized server as an intermediary between user devices and security analysis. The server acts as a mediator that collects execution traces from multiple devices and performs the computationally expensive taint flow analysis, shielding end users from performance overhead while maintaining comprehensive security analysis capability
Data Source
AI summary
Methods and systems for application monitoring through collective record and replay are disclosed herein. The method includes recording a number of execution traces for an application from a number of user devices at a runtime library, wherein the number of execution traces relates to non-deterministic data. The method also includes replaying the number of execution traces to determine whether a behavior of the application creates a security risk.