Dynamic Information Tracking Precision for Mobile Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic systems for fixing security vulnerabilities in mobile or web applications incur significant overhead due to the need for precise information tracking and computationally expensive taint analysis, making them impractical, while value-based tracking is less precise and may miss vulnerabilities.
Innovation Solution
Implement a hybrid approach that performs precise information tracking with source-sensitive, character-level taint analysis when sensitive values are predicted to be modified before reaching a data sink, and switches to value-based tracking when modification is unlikely, using a dynamic probabilistic oracle to determine the appropriate method based on confidence levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If precise information tracking with taint analysis is performed, then measurement precision is improved, but device complexity and overhead increase significantly
Solution Approach 1:
The system dynamically switches between two information tracking modes based on predicted modification probability: precise tracking mode when modification is likely, and value-based tracking mode when modification is unlikely. This dynamic adaptation resolves the contradiction by applying high precision only when necessary, reducing overall system overhead while maintaining security effectiveness.
Solution Approach 2:
The system changes the tracking parameter (precision level) based on the predicted modification probability of sensitive values. When probability exceeds a threshold, precise tracking with taint analysis is activated; otherwise, value-based tracking is used. This parameter adaptation allows the system to optimize between precision and complexity based on actual runtime conditions.
2Device complexity
If value-based tracking is used, then device complexity is reduced, but measurement precision deteriorates and vulnerabilities may be missed
Solution Approach 1:
The system dynamically selects the appropriate tracking mode based on the predicted modification probability of each sensitive value. This prevents the system from consistently using the simpler but less precise value-based tracking, instead adapting to context to maintain high precision when modifications are likely while using low-cost tracking when safe.
Solution Approach 2:
The system applies precise tracking only partially - specifically to sensitive values that are predicted to be modified - rather than universally applying it to all values. This partial application of the more complex tracking mechanism maintains precision where needed while avoiding unnecessary overhead elsewhere.
3Measurement precision
If precise information tracking is applied to all values, then measurement precision is maintained, but productivity decreases due to high overhead
Solution Approach 1:
The system dynamically adjusts tracking precision based on the predicted modification probability of each sensitive value. By switching between precise and value-based tracking modes in runtime, the system maintains high precision for critical paths while improving overall productivity by avoiding unnecessary precise tracking on values that won't be modified.
Solution Approach 2:
The system changes the tracking parameter (precision level) based on the predicted modification probability of sensitive values. When probability exceeds a threshold, precise tracking is activated; otherwise, value-based tracking is used. This parameter adaptation allows the system to optimize between precision and productivity based on actual runtime conditions.
Data Source
AI summary
An improved information tracking procedure is provided. A precise information tracking procedure is performed for a sensitive value when an application is predicted to modify the sensitive value prior to the sensitive value reaching a data sink. The sensitive value comprises an attribute that may be linked to external knowledge to reveal sensitive information about an individual. In response to the application not being predicted to modify the sensitive value prior to the sensitive value reaching the data sink, a value-based information tracking procedure is performed. The value-based information tracking procedure comprises storing one or more values that are observed at a data source, and then determining whether or not each of these one or more values are observed at the data sink.