Function Call Interception for Application Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The rapid development and frequent updates of applications on computers and mobile devices lead to vulnerabilities, such as buffer overflows and incorrect API usage, making it difficult to identify and address security issues without access to source code, and existing solutions rely on recommendations rather than proactive measures.
Innovation Solution
A system and method that intercepts function calls to identify vulnerabilities by modifying executable code to include interception code, analyzing function call data against safe execution criteria, and identifying inconsistencies to detect vulnerabilities, which can include actions like saving arguments, generating system events, or changing argument values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If application development is accelerated to maintain competitiveness, then productivity increases, but vulnerabilities in the code increase
Solution Approach 1:
The system performs preliminary analysis of function calls during application execution to identify potential vulnerabilities before they can be exploited. By intercepting and analyzing API calls in real-time, the system proactively detects security issues such as buffer overflows and incorrect API usage patterns, allowing vulnerabilities to be identified and addressed before they cause harm.
2Loss of information
If recommendations for safe API usage are provided, then security knowledge is improved, but compliance and actual security remain insufficient
Solution Approach 1:
The system implements continuous feedback by monitoring application execution and comparing actual API call patterns against known safe usage patterns. When inconsistencies or potentially vulnerable patterns are detected, the system generates alerts and feedback to developers, enabling them to correct security issues. This closed-loop approach transforms static recommendations into dynamic, actionable security guidance.
3Difficulty of detecting and measuring
If interception code is added to executable code, then vulnerability detection capability is improved, but device complexity increases
Solution Approach 1:
The system introduces interception code as an intermediary layer between the application and the operating system API calls. This mediator captures function call parameters and return values without fundamentally altering the application's core logic. The interception mechanism acts as a transparent observer that can analyze security patterns while allowing the original application functionality to proceed unchanged.
Data Source
AI summary
Disclosed herein are methods and systems of identifying vulnerabilities of an application. An exemplary method comprises identifying at least one function in executable code of the application according to at least one rule for modification of functions, adding an interception code to the executable code of the application upon launching of the application, executing the application with the added interception code, collecting, by the interception code, data relating to function calls performed by the application during execution, analyzing the collected data based on criteria for safe execution of applications, wherein the criteria comprises a range of permissible values of arguments of intercepted function calls and identifying inconsistencies between the analyzed data and the criteria for safe execution of applications, wherein the inconsistencies indicate vulnerabilities in the application.