Low-Level Sensor Request Hooking for Malicious App Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users are unaware of which applications are accessing sensors on their electronic devices, for how long, and for what purpose, leading to potential malicious data collection by nefarious applications, as existing systems lack comprehensive monitoring and reporting capabilities.
Innovation Solution
A communication system that hooks sensor requests at a low level, logs data, and aggregates information across devices to provide users with detailed insights into sensor usage, enabling detection of suspicious behavior and reputation scoring of applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive sensor monitoring is implemented, then user awareness and security are improved, but device complexity increases
Solution Approach 1:
The patent introduces a sensor usage module as an intermediary component that sits between the sensor hardware and applications. This module intercepts sensor requests, logs usage data, and provides monitoring capabilities without requiring complex integration throughout the entire system. The intermediary handles the complexity of monitoring internally while presenting a simplified interface to users and applications, thereby improving security without proportionally increasing overall device complexity.
Solution Approach 2:
The system implements feedback mechanisms where sensor usage information is continuously collected, analyzed, and presented to users through notifications and interfaces. This feedback loop enables users to understand and control sensor access, improving security awareness. The automated feedback system reduces the need for complex manual monitoring configurations, as the module self-manages data collection and presentation.
2Measurement precision
If detailed sensor usage logging is implemented, then detection precision is improved, but loss of time increases
Solution Approach 1:
The system performs preliminary actions by continuously logging sensor usage data in the background as events occur, rather than analyzing data in real-time when needed. Usage patterns are pre-recorded with timestamps, application identifiers, and sensor types. This preliminary data collection enables rapid detection and analysis when security events need to be investigated, as the data is already structured and ready for query, thus improving detection precision without significant time loss.
3Measurement precision
If low-level sensor request hooking is implemented, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The sensor usage module acts as a low-level intermediary that hooks into sensor request pathways without requiring modification of sensor hardware or application code. By positioning this monitoring layer in the data flow between sensors and applications, the system achieves precise measurement of all sensor access events. The intermediary handles the technical complexity of low-level hooking internally, presenting a simplified monitoring interface to users while maintaining high measurement precision.
Data Source
Figure 1
Figure 2~4
Figure 5~6
AI summary
Particular embodiments described herein provide for an electronic device that can receive a request from an application to access a sensor in a system, hook the request at a low level in the system, and log data related to the request. In an example, the request is hooked at a level below an operating system sensor application program interface in the system.