Static Analysis Apparatus for Detecting Information Resource Leaks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting information resource leaks from smart devices through application analysis are inefficient, as they require dynamic analysis, which degrades device performance, is difficult to apply universally, and lacks reliability due to varying test scenarios and resource usage.
Innovation Solution
A static analysis method that obtains and analyzes the application's source code to determine if sensitive information resources are transmissible outside the device, using an apparatus with a source code obtainer, analyzer, and leak determiner, and optionally converting code to intermediate language for faster analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis is used to detect information resource leaks, then detection capability is provided, but device performance deteriorates
Solution Approach 1:
The patent applies preliminary action by performing static analysis on the application source code before execution to identify potential information resource leaks. The system analyzes the source code to determine if the application attempts to transmit sensitive information resources outside the device, thereby detecting security issues without needing to execute the application, which avoids performance degradation.
2Reliability
If dynamic analysis with software trackers is implemented, then leak detection is achieved, but analysis scope is limited and reliability varies
Solution Approach 1:
The patent implements universality by creating a static analysis method that can detect information resource leaks across various application types and scenarios without requiring scenario-specific test cases. The system universally analyzes source code to identify any attempt to transmit sensitive information resources, making the detection capability applicable to all applications regardless of their specific functionality or usage scenarios.
3Productivity
If static analysis is used to detect leaks, then analysis speed improves and reliability increases, but detection precision may be reduced without execution context
Solution Approach 1:
The patent uses an intermediary approach by introducing an intermediate representation layer between the source code and the analysis process. The system converts source code into an intermediate format that preserves semantic information about information resource access and transmission operations, enabling accurate static analysis without requiring actual execution context. This intermediary representation maintains the precision needed for reliable leak detection while achieving fast analysis speeds.
Data Source
AI summary
A method and apparatus for detecting a leak of an information resource of a device. Source code is obtained from an application and is analyzed to determine whether at least one information resource from among information resources of a device is transmittable to outside the device by tracking a task performed on the at least one information resource, thereby detecting whether the application is externally leaking an information resource from the device.