Runtime Function Call Interception for Application Vulnerability Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The rapid development and frequent updates of applications on computers and mobile devices lead to vulnerabilities, such as buffer overflows and incorrect API usage, making it difficult to identify and secure applications without access to source code, and existing solutions rely on recommendations rather than mandatory security measures.

Innovation Solution

A system and method that intercepts function calls to identify vulnerabilities by modifying executable code to include interception code, analyzing data against criteria for safe execution, and identifying inconsistencies to detect vulnerabilities, which can include incorrect API usage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If application development is accelerated to stay competitive, then productivity increases, but vulnerabilities in the code increase

Engineering Contradiction:

Improveapplication development speedVSAvoidcode security

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system performs preliminary security analysis by intercepting function calls during application execution. Hooks are installed in advance to monitor and analyze API calls, buffer operations, and file I/O operations, enabling vulnerability detection before the application is deployed or updated.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements continuous feedback by monitoring application execution in real-time, analyzing intercepted function calls against security criteria, and identifying vulnerabilities as they occur during runtime, allowing for dynamic security assessment.

Inventive Principle:

Principle #23Feedback

2Reliability

If security checks are made mandatory through interception and analysis, then vulnerability detection improves, but device complexity increases

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidsystem structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system introduces an intermediary security analysis layer that sits between the application and the operating system. This intermediary intercepts function calls using hooks and analyzes them against security criteria without requiring modifications to the application source code or the core operating system.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system enables applications to self-analyze for vulnerabilities by instrumenting their own executable code with interception hooks. The application's own execution environment is used to perform the security analysis, reducing the need for external complex analysis infrastructure.

Inventive Principle:

Principle #25Self-service

3Ease of operation

If security analysis is performed without source code access, then ease of operation improves, but measurement precision decreases

Engineering Contradiction:

Improvesecurity analysis accessibilityVSAvoidvulnerability detection accuracy

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The system replaces static source code analysis with dynamic runtime analysis. Instead of mechanically examining source code before deployment, the system instruments the compiled executable and observes actual runtime behavior, including function call patterns, argument values, and execution flow, providing precision insights into actual vulnerabilities.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system changes the analysis parameters from static source code properties to dynamic runtime execution parameters. By monitoring actual function call arguments, return values, and execution context during runtime, the system gains precise information about how the application actually operates versus how it was intended to operate.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentEP3557464B1System and method for identifying vulnerabilities of applications by intercepting function calls

Publication Date: 2021.12.01 AO KASPERSKY LAB

Figure 1
Figure 2
Figure 3

AI summary

Disclosed herein are methods and systems of identifying vulnerabilities of an application. An exemplary method comprises identifying at least one function in executable code of the application according to at least one rule for modification of functions, adding an interception code to the executable code of the application upon launching of the application, executing the application with the added interception code, collecting, by the interception code, data relating to function calls performed by the application during execution, analyzing the collected data based on criteria for safe execution of applications, wherein the criteria comprises a range of permissible values of arguments of intercepted function calls and identifying inconsistencies between the analyzed data and the criteria for safe execution of applications, wherein the inconsistencies indicate vulnerabilities in the application.