File Tree Structure Analysis for Device Compromise Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to accurately and efficiently determine whether a computing device has been compromised, such as through rooting or jailbreaking, which can lead to security breaches and data access violations.
Innovation Solution
A computer-implemented method that analyzes file tree structure information to identify anomalies indicative of device compromise, using a device model or logic rules developed from training data, including permissions and expected tree-based structures, to determine if a device has been compromised and take appropriate actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional compromise detection methods are used, then detection capability is limited, but system complexity and detection time increase
Solution Approach 1:
The patent extracts and analyzes specific file tree structure characteristics (node names, paths, permissions, file types) separately from the entire file system. By focusing on relevant structural features rather than examining the whole system, the method achieves accurate compromise detection while keeping the detection mechanism simple and efficient.
Solution Approach 2:
The patent pre-establishes a database of legitimate file tree structures and compromise indicators before actual detection occurs. This preliminary preparation allows the detection system to quickly compare current file tree structures against known patterns, enabling fast and accurate compromise identification without complex real-time analysis.
2Measurement precision
If comprehensive file system analysis is performed, then detection accuracy improves, but processing time increases
Solution Approach 1:
The method extracts only the essential file tree structure information (node names, paths, permissions, file types) needed for compromise detection, rather than performing comprehensive analysis of all file system attributes. This selective extraction maintains detection accuracy while significantly reducing processing time.
Solution Approach 2:
The patent applies partial action by analyzing only the specific file tree structure elements that are indicative of compromise (such as unauthorized nodes, abnormal paths, restricted permission changes) rather than examining every file and folder on the device. This approach achieves sufficient detection accuracy with minimal processing time.
3Reliability
If device compromise is detected late, then security breaches occur, but early detection requires more resources
Solution Approach 1:
The system performs preliminary setup by establishing baseline file tree structures and compromise indicator databases before actual security monitoring begins. This preparation enables the system to efficiently and reliably detect compromises in real-time without requiring excessive computational resources during ongoing operation.
Solution Approach 2:
The patent replaces complex, resource-intensive traditional compromise detection methods with a more efficient file tree structure analysis approach. By substituting the detection mechanism with one that analyzes structural patterns rather than examining individual files deeply, the system achieves both high reliability and high productivity.
Data Source
AI summary
Methods and devices for determining whether a computing device has been compromised. File tree structure information for the computing device is obtained that details at least a portion of a tree-based structure of folders and files in a memory on the computing device. It is then determined from the file tree structure information that the computing device is compromised and, based on the determination that the computing device has been compromised, an action is taken.