Runtime Security Analysis via Man-in-the-Middle Proxy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to effectively identify and address security vulnerabilities in mobile phone applications, particularly due to code hiding, dynamic loading, and obfuscation, and are rendered obsolete by code changes, relying heavily on human efforts for pattern recognition.
Innovation Solution
The method involves monitoring runtime behavior by analyzing similarities in data packets and API calls, using a man-in-the-middle proxy and prelog/epilog algorithms to detect potential security threats by comparing communications with known vulnerabilities, thereby automating the detection of vulnerabilities masked by advanced techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code hiding, dynamic loading, and obfuscation techniques are used to protect application security, then security protection capability is improved, but vulnerability detection capability deteriorates
Solution Approach 1:
The patent introduces a man-in-the-middle proxy as an intermediary component that sits between the application and the network. This proxy intercepts and analyzes data packets without requiring direct access to the application's internal code or logic, thereby detecting vulnerabilities while respecting the application's security protection mechanisms. The proxy acts as a mediator that can observe communication patterns without breaking the application's defensive layers.
Solution Approach 2:
The patent replaces traditional manual code analysis and pattern recognition methods with automated machine learning-based analysis. Instead of relying on human analysts to manually examine obfuscated code or recognize vulnerability patterns, the system uses ML models to automatically analyze data packet characteristics, identify anomalies, and detect security threats, thereby overcoming the limitations imposed by code obfuscation and dynamic loading.
2Measurement precision
If traditional pattern recognition methods are used for vulnerability detection, then detection accuracy is improved for known patterns, but adaptability to code changes deteriorates
Solution Approach 1:
The patent implements a dynamic vulnerability detection system that continuously adapts to code changes through machine learning. The system collects data packets from multiple transmissions, trains ML models on this data, and updates its detection capabilities accordingly. This dynamic approach allows the system to maintain high detection accuracy while adapting to new code versions and obfuscation techniques, unlike static pattern recognition methods.
Solution Approach 2:
The system performs self-improvement by automatically collecting data packets, training its own ML models, and updating its detection algorithms without requiring external intervention. The machine learning model learns from the data it collects and automatically adjusts its parameters and structures to improve detection accuracy, making the system self-adapting to code changes and new vulnerability patterns.
3Measurement precision
If manual pattern recognition is used for security analysis, then detection precision is improved, but automation level deteriorates
Solution Approach 1:
The system automatically collects data packets, preprocesses them, trains machine learning models, and performs vulnerability detection without human intervention. The entire security analysis process is automated, from data collection to model training to threat detection, while maintaining high precision through ML-based pattern recognition that surpasses manual analysis capabilities.
Solution Approach 2:
The patent replaces manual security analysis with automated machine learning-based analysis. The ML models automatically examine data packets, identify security threats, and generate reports, eliminating the need for human analysts to manually review code or communication patterns. This automation maintains high detection precision while dramatically increasing efficiency and scalability.
4Reliability
If comprehensive data packet analysis is performed to detect hidden vulnerabilities, then security detection capability is improved, but computational complexity deteriorates
Solution Approach 1:
The patent segments the vulnerability detection process into distinct stages: data packet collection, preprocessing, feature extraction, model training, and analysis. By dividing the comprehensive analysis into smaller, manageable segments, the system can process large volumes of data efficiently without overwhelming computational resources at any single stage, while still achieving high security detection capability.
Data Source
AI summary
Systems and methods are provided for program security protection. An exemplary method for program security protection may comprise obtaining data packets transceived by a first program, analyzing similarities among the obtained data packets for a plurality of transmissions, and determining a security threat to the first program based on the analyzed similarities.