Hybrid Static Dynamic Analysis for Minimal Permission Profiles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for determining minimal permission sets for computer executable functions are either inaccurate due to static analysis or incomplete due to dynamic analysis limitations, as they fail to account for all possible behaviors and execution paths.
Innovation Solution
A system and method that combines static and dynamic analysis to identify the minimal set of permissions required for computer executable functions by executing the function multiple times with distinct parameter combinations, associating detected behaviors with risk scores, and determining a permission profile that includes only the necessary permissions, excluding those with high risk scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If static analysis is used to determine permissions, then the analysis can be performed without executing the code, but the accuracy is insufficient because actual behaviors depend on runtime parameters
Solution Approach 1:
The patent combines static analysis and dynamic analysis into a hybrid approach. Static analysis is performed first to identify potential permission requirements from code structure, then dynamic analysis with fuzzing executes the code with various parameter combinations to discover actual runtime behaviors. The results of both analyses are merged to determine the final minimal permission set, thereby achieving both ease of analysis and high accuracy.
2Measurement precision
If dynamic analysis is used to determine permissions, then the actual runtime behaviors can be observed, but the completeness is insufficient because some behaviors occur seldomly
Solution Approach 1:
The patent employs fuzzing technology to periodically and repeatedly execute the code with randomly generated parameter combinations. This periodic execution with varied inputs increases the probability of triggering rare or seldomly executed code paths, thereby improving the completeness of permission determination while maintaining the accuracy benefits of dynamic analysis.
3Reliability
If the code is executed multiple times with distinct parameter combinations, then complete permission coverage is achieved, but the analysis time and computational resources increase
Solution Approach 1:
The patent performs static analysis as a preliminary step before dynamic analysis. This preliminary action identifies potential permission requirements from the code structure without execution, filtering out many obvious permission needs. Subsequently, dynamic analysis with fuzzing focuses only on discovering additional permissions that static analysis missed, thereby reducing the total analysis time while maintaining completeness.
4Object-affected harmful factors
If a minimal set of permissions is assigned to the function, then security is improved by limiting damage potential, but the risk of insufficient permissions affecting function operation increases
Solution Approach 1:
The patent uses feedback from both static analysis (code structure insights) and dynamic analysis with fuzzing (actual runtime behaviors) to accurately identify the minimal permission set required for correct function operation. This feedback loop ensures that permissions are not overly restrictive (which would harm reliability) nor excessively permissive (which would increase security risk), achieving an optimal balance between security and operational reliability.
Data Source
AI summary
Systems, methods, and software products, determine permission profiles for computer executable functions (functions). The systems, methods and software products, utilize both static analysis and dynamic analysis, in order to determine the minimal set of permissions based on the inter-relations between these two analysis methods, i.e., static analysis, and dynamic analysis, to determine the permission profiles for computer executable functions (functions).