Mobile App Security Framework via Static Instrumentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The security of mobile application software on devices is a growing concern due to the increasing capability and importance of applications handling sensitive information, with existing technologies failing to efficiently determine the safety of these applications.
Innovation Solution
A framework that includes a static instrumentation engine, dynamic runtime test environment, central intelligence engine, platform-specific knowledge base, machine learning platform, and user-provided rules to identify and analyze 'regions of interest' in application code, applying stimuli to determine if the application is safe or unsafe, while avoiding execution of benign code to streamline testing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security testing methods are used to analyze mobile applications, then comprehensive security coverage can be achieved, but the testing time and computational resources required increase significantly
Solution Approach 1:
The patent segments the mobile application code into distinct basic blocks and identifies specific 'regions of interest' that are most likely to contain security vulnerabilities. Instead of analyzing the entire application uniformly, the system divides the code base and focuses testing resources on critical segments such as data processing functions, network communication modules, and system interface interactions, thereby achieving comprehensive security coverage with reduced testing time.
Solution Approach 2:
The patent applies local quality by assigning different analysis depths and testing intensities to different regions of the application code. High-risk regions identified through static analysis receive more rigorous testing and multiple stimulus applications, while low-risk benign code regions receive minimal or no execution testing. This differentiated approach maintains security coverage while significantly reducing overall testing time and computational resources.
2Measurement precision
If comprehensive code analysis is performed on all application code, then security vulnerabilities can be detected, but the computational resources and processing time required increase
Solution Approach 1:
The patent performs preliminary static analysis of the application code before executing time-consuming dynamic tests. This preliminary action involves parsing the code structure, identifying basic blocks, analyzing data flow, and detecting potential security issues without actually executing the code. By performing this initial analysis, the system creates a map of the application structure and identifies regions of interest that require further testing, thereby improving vulnerability detection accuracy while maintaining high analysis efficiency through selective follow-up testing only on critical regions.
3Loss of energy
If multiple application instances are analyzed sequentially, then resource consumption is reduced, but the total analysis time increases
Solution Approach 1:
The patent implements concurrent analysis of multiple application instances by utilizing multi-threading and parallel processing capabilities. Multiple instances are analyzed simultaneously rather than sequentially, with each instance being tested with various stimuli in parallel. This continuous useful action maximizes resource utilization and significantly reduces total analysis time while maintaining efficient resource consumption through proper thread management and shared resource coordination.
Data Source
AI summary
A method for hardening in the field code of mobile software applications is described that includes receiving, by a cloud service framework, an application via a user interface over a network. The method also includes generating, by the cloud service framework, a representation of the code of the application and determining, by the cloud service framework, changes to code of the application based at least in part on the representation, wherein the changes to the code preclude the application from performing one or more unwanted behaviors. The method also includes instrumenting, by a static instrumentation unit within the cloud service framework, the application with the changes to the code to create an instrumented application that does not perform the one or more unwanted behaviors.