Software Exploit Detection via Vulnerability Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods face difficulties in detecting device applications that exploit vulnerabilities, especially with dynamic code and inputs, as static analysis and dynamic review in emulators are ineffective.
Innovation Solution
A system and method for software exploit detection involve logging attempted exploitations of known vulnerabilities on computing devices, which generate log entries that are collected and analyzed by an analysis server to trigger remedial actions such as suspending applications or changing device configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If static analysis or dynamic review in emulators is used to detect vulnerabilities, then detection capability is improved, but effectiveness deteriorates due to dynamic code and inputs
Solution Approach 1:
The system performs preliminary actions by proactively pushing vulnerability information to computing devices before exploits occur. Vulnerability data including vulnerability identifiers, affected components, and detection patterns are pre-configured and distributed to devices, enabling them to detect and log exploit attempts in real-time without requiring complex static analysis or emulator-based dynamic review
Solution Approach 2:
A server acts as an intermediary between vulnerability databases and computing devices. The server receives vulnerability information, processes it into detectable patterns, and pushes it to multiple devices. This intermediary approach simplifies the detection mechanism on individual devices while maintaining high detection effectiveness across the ecosystem
2Reliability
If logging and analysis of attempted exploits is implemented, then ecosystem protection is improved, but system complexity increases
Solution Approach 1:
The complex analysis functionality is extracted from individual computing devices and centralized on a dedicated server. Devices only perform simple logging of exploit attempts using pre-configured patterns, while the server handles the computationally intensive tasks of analyzing logs, identifying new exploits, and generating vulnerability information for distribution back to the ecosystem
Solution Approach 2:
The system implements a feedback loop where the server analyzes logged exploit attempts, identifies new vulnerability patterns, and pushes updated vulnerability information back to computing devices. This continuous feedback mechanism improves ecosystem protection over time without requiring increasing complexity on individual devices, as each device benefits from collective learning
Data Source
AI summary
A method may include, in a computing device including a processor, memory, an operating system, and at least one installed application, detecting an attempted exploitation of at least one known vulnerability associated with the device. The attempted exploitation may be logged. At least one remedial action may be performed on the device based on the logged attempted exploitation. The known vulnerability may be associated with the operating system and/or the at least one installed application. The at least one known vulnerability may include one or more of at least one known coding flaw in the operating system or in the at least one installed application, at least one known weakness in a protocol running on the computing device, a known family of coding flaws in the operating system or in the at least one installed application, an unauthorized triggering of premium SMS services, and/or triggering of a hostile misconfiguration.