Mobile App Risk Quantification via Phased Static and Dynamic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number and variety of mobile apps pose challenges for enterprises to manage and monitor app usage, as they can access corporate resources, leading to security risks, malware, and privacy concerns, with traditional blacklisting approaches being insufficient to address evolving security challenges.
Innovation Solution
A platform that analyzes apps for mobile devices using a phased approach, including static and dynamic analysis, to generate a risk score and assess potential threats, such as unauthorized behavior, data usage, and permissions, providing a risk assessment report to ensure compliance with enterprise policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional blacklisting approaches are used to manage app security, then implementation is simple, but they are insufficient to address evolving security challenges
Solution Approach 1:
The security analysis is divided into multiple phases: static analysis phase and dynamic analysis phase. Each phase performs specific security checks and generates risk scores independently, allowing the system to comprehensively assess app security without requiring a monolithic complex system.
Solution Approach 2:
The system performs static analysis on app code before the app is executed on mobile devices. This preliminary security assessment identifies potential security issues in advance, preventing malicious apps from being installed or executed, thereby improving security reliability without requiring complex runtime intervention mechanisms.
2Measurement precision
If comprehensive static and dynamic analysis is performed on apps, then security risk assessment accuracy is improved, but analysis time and computational resources increase
Solution Approach 1:
The analysis process is segmented into static analysis and dynamic analysis phases. Static analysis examines app code without execution, providing quick initial security assessment. Dynamic analysis is performed selectively on apps that pass static analysis or require deeper verification, reducing total analysis time while maintaining accuracy.
Solution Approach 2:
The system performs comprehensive analysis only when necessary. For most apps, a streamlined static analysis is sufficient. Dynamic analysis with full instrumentation is applied selectively to apps with suspicious characteristics or higher risk profiles, optimizing the balance between accuracy and time consumption.
3Object-affected harmful factors
If risk scoring and app blocking mechanisms are implemented, then corporate data protection is improved, but app inventory management complexity increases
Solution Approach 1:
The system uses quantifiable risk scores generated from analysis results to automatically classify and manage apps. Apps are categorized based on risk thresholds (e.g., blocked, restricted, allowed), transforming complex security assessments into simple parameter-based management decisions that are easy to implement and enforce.
Solution Approach 2:
The risk assessment system provides continuous feedback to the app management process. Analysis results and risk scores are fed back into the decision-making process, automatically updating app status and management policies. This closed-loop approach simplifies management by using objective metrics rather than manual evaluation.
Data Source
AI summary
Quantifying the risks of applications (“apps”) for mobile devices is disclosed. In some embodiments, quantifying the risks of apps for mobile devices includes receiving an application for a mobile device; performing an automated analysis of the application based on a risk profile; and generating a risk score based on the automated analysis of the application based on the risk profile.