Object-Level Code Inspection for Mobile App Security Auditing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security auditing solutions for mobile applications are inadequate as they allow security breaches and data leakage before detection, particularly when malicious applications are installed on devices used to access corporate networks, posing risks to personal and financial data.
Innovation Solution
The system employs object-level code inspection and analysis to identify security risks by generating assembly code data from executing applications, analyzing object relationships, and applying filters and rules to detect potential threats, enabling real-time monitoring and reporting of security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security auditing solutions monitor application execution, then security monitoring is provided, but security breaches and data leakage occur before detection
Solution Approach 1:
The system performs static analysis of application code before execution to identify security risks in advance. By examining assembly code, object relationships, and data flow patterns prior to runtime, the system can detect malicious behavior patterns before they actually occur, preventing security breaches rather than merely detecting them after the fact.
Solution Approach 2:
The system introduces an intermediary analysis layer between application execution and security monitoring. Instead of directly monitoring execution traces, the system uses assembly code disassembly and object relationship mapping as intermediate representations to analyze security risks, enabling deeper inspection of code structure and data flow that traditional execution monitoring cannot achieve.
2Measurement precision
If object level code inspection is performed, then security risk identification accuracy is improved, but system complexity increases
Solution Approach 1:
The system segments the code inspection process into distinct analytical stages: assembly code generation, object relationship extraction, data flow analysis, and security rule matching. By dividing the complex inspection task into manageable segments that can be processed independently, the system achieves high detection accuracy while maintaining manageable system complexity through modular architecture.
Solution Approach 2:
The system transforms code inspection from binary level to object level by changing the analysis parameters. Instead of examining raw machine instructions, the system disassembles code into assembly level and further abstracts it into object relationships and data flow patterns. This parameter transformation enables more accurate security analysis while the abstraction layer simplifies the actual inspection process.
3Loss of time
If real-time monitoring is implemented, then security response time is reduced, but processing overhead increases
Solution Approach 1:
The system performs security analysis rules preparation and object relationship mapping in advance before actual security monitoring is needed. By pre-processing and indexing security rules and object graphs, the system can perform rapid matching during runtime without the overhead of complex real-time analysis, significantly reducing processing overhead while maintaining fast response time.
Solution Approach 2:
The system creates a simplified representation (copy) of the application's object relationships and data flow patterns during static analysis. This copied model serves as an efficient reference for runtime security monitoring, allowing the system to match current execution against pre-computed object graphs rather than performing complex analysis in real-time, thereby reducing processing overhead.
Data Source
AI summary
Security auditing of an application is performed based on object data associated with the application. An application is executed on a physical or emulated host device, and assembly code is generated for the executing application. The assembly code is analyzed to identify objects associated with the application, and to identify relationships between the objects. Data stored in member variables of the objects is retrieved by setting analysis points at which to extract member variable data during execution of the application. Based on the object data, relationship data, and retrieved member variable data, potential security risks are identified for the application. Security risks may include access of data on the host device and external communication of the accessed data. The application may be instrumented to include logging functionality, or to disable certain features of the application, and deployed to enable further monitoring for security risks.