Mobile Device File Tree Analysis for Compromise Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems fail to quickly and accurately determine whether a computing device has been compromised, such as rooted or jailbroken, which allows unauthorized access to sensitive information.

Innovation Solution

A method and system that analyze the file tree structure of a computing device to identify anomalies indicative of compromise, using machine learning and heuristic logic to develop a device model or rule set, and take appropriate actions based on the analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional security checking methods are used, then device security is maintained, but the speed and accuracy of detecting compromised devices is insufficient

Engineering Contradiction:

Improvedetection accuracyVSAvoiddetection time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by proactively pushing test commands to devices and pre-establishing baseline file tree structures for comparison. This allows the system to detect compromises quickly by comparing current states against pre-defined security baselines, rather than reacting to incidents after they occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system creates copies of expected file tree structures and compares them against actual device states. By maintaining reference copies of legitimate file structures and using diff-based comparison, the system achieves rapid and accurate detection of unauthorized modifications without requiring complex analysis of each device state from scratch.

Inventive Principle:

Principle #26Copying

2Reliability

If comprehensive security analysis is performed on all devices, then detection accuracy improves, but system complexity and resource consumption increase

Engineering Contradiction:

Improvesecurity detection reliabilityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system extracts only the critical security-relevant features from device states, specifically focusing on file tree structures and their differences. By taking out and analyzing only the essential elements (file paths, permissions, and structural differences) rather than performing comprehensive analysis of all device attributes, the system maintains high detection reliability while reducing computational complexity.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The security analysis is segmented into discrete, manageable components: generating file tree structures, comparing them against baselines, identifying specific differences, and evaluating security risk. This segmentation allows the system to achieve comprehensive security analysis through a series of simple, efficient operations rather than a single complex analysis process.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12568093B2Methods and systems to identify a compromised device through active testing

Publication Date: 2026.03.03 BLACKBERRY LTD

AI summary

Methods and devices for determining whether a mobile device has been compromised. File tree structure information for the mobile device is obtained that details at least a portion of a tree-based structure of folders and files in a portion of memory. The file tree structure information is analyzed to determine that the mobile device has been compromised, has not been compromised, or might be compromised. Based on determining that the mobile device might be compromised, the mobile device is instructed to execute a restricted action. If the restricted action occurs on the mobile device then it is determined that the mobile device has been compromised. Based on that determination, an action is taken.