Implanted Code Detection in Minified Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting code implanted via supply chain attacks in published applications is challenging due to vulnerabilities in public repositories, especially when libraries are minified, making it difficult to detect implanted code.
Innovation Solution
A method and system for detecting implanted code in published applications by retrieving a source version and a published version, determining the transformation process, producing a build version, comparing it with the published version, and identifying implanted code through correspondence scoring, with possible security actions such as quarantining or notification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If developers minify libraries when publishing, then the library size is reduced and loading efficiency is improved, but implanted code becomes harder to detect
Solution Approach 1:
The system performs preliminary actions by retrieving the source version before publishing, determining the transformation process in advance, and generating a build version locally for comparison. This allows detection of implanted code before the minified published version is distributed, resolving the contradiction by enabling security verification despite minification.
Solution Approach 2:
The system creates a local copy (build version) of the published version by applying the transformation process to the source version. This copy is then compared with the actual published version to detect implanted code, allowing detection despite minification while maintaining loading efficiency benefits.
2Reliability
If developers protect their own libraries on private repositories, then security control is improved, but vulnerability to supply chain attacks increases due to multiple dependencies
Solution Approach 1:
The system establishes a feedback mechanism by comparing the locally generated build version with the published version, identifying discrepancies that indicate implanted code. This feedback loop enables continuous security verification of dependencies, addressing supply chain vulnerabilities while allowing use of public repositories.
Solution Approach 2:
The system applies preliminary anti-action by detecting and identifying implanted code in published versions before they are executed in the application. This preemptive detection prevents supply chain attacks from taking effect, resolving the contradiction between using public repositories and maintaining security.
3Measurement precision
If the transformation process is determined through analysis of source and published versions, then accuracy of detection is improved, but computational complexity increases
Solution Approach 1:
The system changes parameters by analyzing various aspects of the transformation process including file changes, identification tag changes, and commit tag changes. By examining multiple parameters of the transformation, the system achieves high detection accuracy while managing computational complexity through systematic analysis.
Data Source
AI summary
The disclosed computer-implemented method for detecting code implanted into a published application may include retrieving a published version of an application and a source version of the application, and determining, based on an analysis of the source version and the published version, a transformation process for transforming from the source version to the published version. The method may also include performing the transformation process on the source version to produce a build version, comparing the build version with the published version, and identifying, based on the comparison, implanted code in the published version. The method may further include performing, in response to identifying the implanted code, a security action. Various other methods, systems, and computer-readable media are also disclosed.