Memory Taint Tracking for Mobile Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for mobile device performance and power utilization degradation, such as anti-virus and firewall products, are inadequate in detecting complex factors and interactions that contribute to degradation over time, often relying on computationally-intensive scanning engines that consume resources and fail to identify non-benign behaviors like data leaks from sensitive sources.
Innovation Solution
A behavior-based security system using heuristics and machine learning techniques to monitor memory operations, identify tainted memory addresses, and apply taint propagation heuristics to efficiently track data flows without significant performance or power impact, allowing for real-time identification and correction of non-benign software applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If computationally-intensive scanning engines are used to detect security threats, then detection capability is improved, but device performance and power utilization deteriorate
Solution Approach 1:
The patent extracts only the essential monitoring functions from comprehensive security scanning, focusing specifically on memory operation monitoring and data flow tracking. This selective extraction allows the system to achieve effective security detection without the overhead of full-system scanning engines, thereby maintaining device performance while improving detection capability for critical threats.
Solution Approach 2:
The patent applies monitoring resources selectively to critical areas rather than uniformly across the entire system. By focusing monitoring efforts on memory operations, data flows, and inter-application communications, the system achieves high detection capability in these critical zones while consuming minimal overall resources, thus resolving the contradiction between comprehensive detection and performance maintenance.
2Measurement precision
If comprehensive data tagging and tracking is implemented to identify non-benign behaviors, then detection accuracy is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent segments the monitoring system into distinct functional modules: memory operation monitors, data flow trackers, taint propagation analyzers, and classifier models. Each module handles a specific aspect of security analysis independently, which maintains high detection accuracy through comprehensive monitoring while reducing overall system complexity through modular design and clear separation of concerns.
Solution Approach 2:
The patent implements partial monitoring by focusing on critical data flows and operations rather than tracking every system activity. The taint propagation mechanism selectively tracks only data that originates from sensitive sources and follows paths that could lead to security violations, achieving high detection accuracy without the excessive complexity of comprehensive system-wide tagging and tracking.
3Reliability
If real-time monitoring of memory operations is performed to detect non-benign behaviors, then security detection is improved, but power consumption increases
Solution Approach 1:
The patent implements periodic sampling and event-triggered monitoring rather than continuous real-time monitoring of all memory operations. The system monitors memory operations at strategically chosen points and triggers detailed analysis only when suspicious patterns are detected, maintaining effective security detection while significantly reducing power consumption compared to continuous monitoring approaches.
Solution Approach 2:
The monitoring system leverages existing system infrastructure and resources, such as the operating system's memory management structures and existing event logging mechanisms. By reusing these existing components rather than building dedicated monitoring hardware or continuously active software agents, the system achieves effective security detection with minimal additional power consumption.
Data Source
AI summary
Methods and devices for tracking data flows in a computing device include monitoring memory in a hardware component of the computing device to identify a read operation that reads information from a tainted memory address, using heuristics to identify a first, second, and third number of operations performed after the identified read operation, marking memory addresses of write operations performed after first number of operations and before the second number of operations as tainted, and marking memory addresses of write operations performed after the third number of operations and before the second number of operations as untainted.