Dynamic Threat Detection Rules for Mobile Device Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The dynamic nature of mobile device compromises, such as rooting or software modifications, poses a challenge for enterprises to detect compromised devices effectively, as existing detection methods are not adaptable to changing operating systems and device configurations.
Innovation Solution
A software development kit (SDK) with dynamically updateable threat detection rules that can be embedded within applications, allowing the threat detection client and runtime environment to obtain and apply new rules from a remotely executed service without updating the application binary, enabling continuous detection and remedial actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional static detection methods are used, then the application structure remains simple and update-free, but the detection capability cannot adapt to changing operating systems and device configurations
Solution Approach 1:
The patent segments the detection system into two independent parts: a static application binary and a dynamic rule set. The rule set is separated from the application code, allowing it to be updated independently without requiring application updates. This segmentation enables the detection logic to adapt to new threats and OS changes while the application structure remains stable.
Solution Approach 2:
The patent introduces an intermediary component (the separate rule set and rule loading mechanism) that mediates between the static application and the dynamic detection requirements. This intermediary layer allows the application to adapt to changing conditions without modifying its core code, resolving the contradiction between adaptability and structural simplicity.
2Reliability
If frequent application updates are implemented to improve detection rules, then detection capability is enhanced, but deployment complexity and update overhead increase
Solution Approach 1:
The patent makes the detection rules dynamic by separating them from the application binary. Rules can be loaded, updated, and reloaded at runtime without requiring application reinstallation or updates. This dynamic approach allows rapid response to new threats while eliminating the time loss associated with frequent application updates.
Solution Approach 2:
The patent implements preliminary action by pre-defining the rule loading mechanism and infrastructure during application development. This allows the application to be prepared for future rule updates without requiring actual updates at that time, enabling rapid deployment of new detection rules when needed while minimizing update overhead.
3Reliability
If comprehensive detection rules are implemented to cover all possible compromises, then detection coverage is improved, but rule management and system complexity increase
Solution Approach 1:
The patent applies dynamics by making the rule set modular and dynamically loadable. Instead of embedding all detection rules statically in the application, rules are externalized and can be selectively loaded based on device type, OS version, and threat landscape. This reduces the complexity of managing comprehensive rules while maintaining broad detection coverage.
Solution Approach 2:
The patent changes the parameters of rule management by transitioning from static, hard-coded rules to dynamic, configurable rules that can be adjusted based on device parameters, OS versions, and emerging threats. This allows comprehensive coverage without proportionally increasing management complexity, as rules can be selectively applied based on relevant parameters.
Data Source
AI summary
Examples for detecting a compromised device are described. A set of threat detection rules can instruct an application on the client device how to detect whether the client device is compromised. The rules can be updated dynamically and without updating the application that is performing the compromise detection. The rules can be encoded in an interpreted scripting language and executed by a runtime environment that is embedded within the application.