Detecting Collusion-Based Security Policy Violations in Software Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods are reactive and focus on individual software programs, failing to detect security policy violations that may occur when multiple software applications collude, which is particularly concerning on mobile devices that handle sensitive data and privacy-sensitive functions.
Innovation Solution
Evaluating inter-application data flows based on predetermined security policies to identify potential violations, using application signatures and data flow analysis to determine compliance, and providing certifications or indications of policy satisfaction for sets of applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware detection methods are used, then individual application security can be assessed, but collusion-based security policy violations among multiple applications cannot be detected
Solution Approach 1:
The patent segments the security evaluation process into two distinct phases: (1) individual application analysis to extract data flow signatures, and (2) inter-application collusion detection by combining signatures from multiple applications. This segmentation allows the system to maintain precise individual application assessment while adding the capability to detect collusion-based violations that individual analysis cannot identify.
Solution Approach 2:
The patent transitions from single-dimensional individual application analysis to multi-dimensional inter-application collusion detection by analyzing data flows across application boundaries. This dimensional expansion enables the system to detect security violations that emerge only when multiple applications interact, such as when one application's data flow complements another's to create a policy violation.
2Reliability
If inter-application data flow analysis is performed, then collusion-based violations can be detected, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by extracting and storing data flow signatures from individual applications before performing inter-application collusion detection. This pre-processing step creates reusable application profiles that capture data flow characteristics, which can then be efficiently combined and evaluated against security policies without re-analyzing entire application codebases, thereby reducing the complexity of the evaluation system.
Solution Approach 2:
The patent introduces data flow signatures as an intermediary representation between individual applications and the security policy evaluation system. These signatures serve as abstracted intermediaries that capture essential data flow characteristics without requiring direct analysis of complex inter-application interactions, thereby simplifying the evaluation process while maintaining detection accuracy.
3Reliability
If comprehensive security evaluation of application sets is performed, then data privacy and integrity are enhanced, but evaluation time and computational resources increase
Solution Approach 1:
The patent performs preliminary extraction and storage of data flow signatures from individual applications, creating reusable profiles that capture essential security characteristics. When evaluating application sets for collusion, the system combines these pre-computed signatures rather than re-analyzing entire applications, significantly reducing evaluation time while maintaining comprehensive security assessment of data privacy and integrity.
Data Source
AI summary
Sets of multiple software programs selected from a set of candidate software programs are evaluated to determine if the applications can collude to violate a security policy and exhibit other undesirable properties. Intra- and inter-application data and control flows can be stored and newly introduced applications assessed based on stored data and control flows. An application provider can certify sets of applications as satisfying a security policy based on consideration of inter-application flows.