Mobile App Security Analysis Using Static and Non-Emulated Dynamic Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing mobile app security on emulators are inadequate due to idiosyncrasies that cause apps to run improperly, leading to incomplete security assessments and missed malicious behavior, as they fail to emulate actual user operations and rely on static binary signature identification, which is inefficient and prone to false positives.
Innovation Solution
Implementing a combination of static and non-emulated dynamic analysis on actual mobile devices using a specially instrumented operating system and unique analysis software to capture app interactions and network traffic, providing a comprehensive and accurate picture of app behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static binary signature identification is used for app security analysis, then the analysis process is simple and fast, but the detection accuracy is low and prone to false positives
Solution Approach 1:
The patent combines static analysis and dynamic analysis into a unified security testing system. Static analysis examines app binaries without execution to identify potential vulnerabilities, while dynamic analysis monitors actual app behavior during runtime. By merging these two approaches, the system achieves both efficiency (from static analysis) and accuracy (from dynamic analysis), resolving the contradiction between analysis speed and detection accuracy.
2Stability of the object's composition
If emulated dynamic analysis is used to test apps, then the testing environment is controlled and reproducible, but the app behavior does not reflect actual user operations and malicious behavior is missed
Solution Approach 1:
The patent uses real mobile devices as copies of the target environment rather than emulators. Instead of creating a virtual representation that approximates device behavior, the system directly analyzes apps on actual devices, capturing authentic user interactions and app behavior. This eliminates the fundamental limitation of emulators while maintaining environmental control through standardized test procedures.
3Measurement precision
If non-emulated dynamic analysis on actual mobile devices is performed, then the app behavior is authentic and comprehensive, but the analysis complexity and resource requirements increase
Solution Approach 1:
The patent segments the security analysis process into distinct phases: static analysis phase (examining app binaries before execution), dynamic analysis phase (monitoring runtime behavior), and reporting phase (consolidating findings). Each phase uses specialized tools and methods optimized for its specific task. This segmentation reduces overall system complexity by breaking down the complex analysis process into manageable, independent modules that can be executed sequentially.
4Reliability
If comprehensive security analysis is performed on multiple apps, then the security assessment is thorough, but the time and computational resources required increase significantly
Solution Approach 1:
The patent performs preliminary static analysis on app binaries before executing time-consuming dynamic analysis. During static analysis, the system identifies obvious vulnerabilities, permissions, and structural characteristics that can be assessed without runtime execution. This preliminary assessment filters out apps with minor issues and prioritizes those requiring intensive dynamic analysis, significantly reducing total analysis time while maintaining comprehensive security coverage.
Data Source
AI summary
Embodiments are disclosed for performing static and/or non-emulated dynamic analysis of mobile computing device software to improve app security testing. In the context of a method, an example embodiment includes processing, by a security analysis system, an app for analysis. This example embodiment of the method further includes analyzing the app by diagnostic circuitry of the security analysis system. In this regard, analyzing the app includes at least one of performing static analysis on the app or causing performance, by a lab rig, of non-emulated dynamic analysis on the app. In turn, this example embodiment further includes generating, by the security analysis system and based on analyzing the app, a set of risk issues presented by the app, and outputting, by the security analysis system, the set of risk issues. Corresponding apparatuses and computer program products are also provided.