Managed Device Risk Assessment via Application Decompilation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack effective methods to assess and manage the risks associated with applications installed on client devices, particularly in ensuring compliance with predefined security policies and preventing potential security breaches by monitoring access to sensitive device resources.
Innovation Solution
A device management system that decompiles applications, analyzes their operations, and compares them against predefined profiles to identify violations, initiating remedial actions such as uninstallation or alerting administrators when access thresholds are exceeded, and encoding reports for decision-making.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If applications are monitored and analyzed for security compliance, then security reliability is improved, but system complexity increases due to decompilation and analysis operations
Solution Approach 1:
The system performs decompilation and security analysis of applications before they are allowed to execute on the client device. By conducting security assessments in advance, the system identifies potential threats and compliance violations before they can affect device security, thus improving reliability while managing complexity through proactive rather than reactive measures.
Solution Approach 2:
The device management system acts as an intermediary between the application repository and the client device. It intercepts applications during installation, performs decompilation and analysis through intermediate processing steps, and enforces security policies before allowing application execution. This intermediary role centralizes security functions and manages the complexity of security enforcement.
2Difficulty of detecting and measuring
If application operations are decompiled and analyzed to identify violations, then security detection capability is improved, but processing time increases
Solution Approach 1:
The system performs decompilation and security analysis during the application installation phase rather than during execution. This preliminary action allows thorough analysis without impacting user experience during application usage, as the security assessment is completed beforehand and results are cached for quick enforcement decisions.
Solution Approach 2:
The system applies selective analysis based on risk levels and application characteristics. Not all applications undergo the same level of detailed decompilation and analysis - the system adjusts the depth of analysis based on factors such as application source, user profile, and detected risk indicators, thus reducing unnecessary processing time while maintaining detection capability for high-risk applications.
3Reliability
If strict security policies are enforced through automated remedial actions, then security reliability is improved, but ease of operation decreases due to automated uninstallation and administrator alerts
Solution Approach 1:
The system implements dynamic security enforcement that adapts remedial actions based on violation severity, user roles, and organizational policies. Rather than applying fixed rigid rules, the system adjusts the stringency of enforcement - ranging from automated blocking for critical violations to alerting administrators for minor issues - thus maintaining security reliability while preserving operational flexibility and ease of use.
Solution Approach 2:
The system provides feedback mechanisms that notify administrators and users about security violations and enforcement actions. This feedback loop allows for human review and adjustment of automated decisions, enabling organizations to fine-tune security policies based on actual usage patterns and false positive rates, thereby maintaining both security enforcement and operational ease.
Data Source
AI summary
Examples of managed device risk assessment are described. In one example, a copy of an application installed on a client device is decompiled, to identify operations performed during execution of the application. A profile including one or more rules that specify whether the operations are assigned higher or lower levels of risk is obtained. A first number of times that the first rule is violated by the operations is determined, and a second number of times that the second rule is violated by the operations is determined. A total of the violations is compared against a threshold, and a remedial action is initiated in response to determining that the total exceeds the threshold.