Privacy Leak Detection in .NET Framework via Method Call Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for effective detection of privacy leaks in software applications using the .NET framework on mobile devices, as malicious or well-intentioned applications can gather and transmit sensitive user information without user consent, posing a risk to user privacy.
Innovation Solution
The method involves disassembling binary applications into human-readable CIL or MSIL code, constructing a method call graph to identify source and sink API call chains, and alerting for potential privacy leaks if common methods are found between these chains, indicating unauthorized data collection or transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If binary applications are disassembled into human-readable code and method call graphs are constructed to detect privacy leaks, then detection accuracy is improved, but analysis complexity and processing time increase
Solution Approach 1:
The patent segments the binary code into method call chains, separating source APIs (data collection) from sink APIs (data transmission). By breaking down the complex binary into manageable method-level units and organizing them into call chains, the system achieves detailed privacy leak detection while maintaining manageable analysis complexity through structured decomposition.
Solution Approach 2:
The patent introduces method call graphs as an intermediary representation between the binary code and the privacy leak detection logic. This intermediate structure translates complex binary relationships into a graph format that can be systematically analyzed to identify connections between data collection and transmission operations, simplifying the detection process.
2Difficulty of detecting and measuring
If method call graphs are constructed to identify source and sink API call chains, then detection capability is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary actions by pre-identifying source APIs (data collection functions) and sink APIs (data transmission functions) before analyzing the method call graph. This pre-categorization allows the system to quickly trace connections between data collection and transmission without re-analyzing all code, significantly reducing processing time while maintaining detection capability.
Solution Approach 2:
The patent extracts only the relevant method call chains that connect source and sink APIs from the complete method call graph. By filtering and extracting only the critical paths that indicate privacy leaks, the system avoids processing entire codebases unnecessarily, reducing analysis time while focusing computational resources on the most suspicious code paths.
Data Source
AI summary
A binary application suitable for the .Net framework is disassembled into human readable code. Or, CIL or MSIL code is obtained. The methods are put into a representation indicating which methods of the code call other methods. A source method call chain having a source API and a sink method call chain having a sink API are discerned from the representation. APIs are put into the same format as the methods to allow matching. A method in common between the two call chains indicates that a privacy leak exists. The application is downloaded from a remote server to a computing device where the analysis occurs.