Static Vulnerability Analysis in Application Packages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing computer programs for security vulnerabilities are inadequate, as they fail to effectively detect vulnerabilities in application packages without dynamic testing, which is resource-intensive and not feasible for large-scale scanning.
Innovation Solution
A method involving disassembling executable code within application packages to search for patterns associated with potentially vulnerable functions, determining the presence of secure implementation instructions, and identifying vulnerabilities by comparing against secure function definitions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic testing is used to detect vulnerabilities, then measurement precision is improved, but productivity deteriorates due to resource-intensive requirements
Solution Approach 1:
The patent applies preliminary action by performing static analysis on application packages before they are installed or executed. The system disassembles and analyzes the package structure, manifest files, and code in advance to identify vulnerabilities, eliminating the need for resource-intensive dynamic testing during actual use. This allows vulnerabilities to be detected ahead of time while maintaining high scanning efficiency across large numbers of applications.
2Productivity
If static analysis is performed on application packages, then productivity is improved through efficient large-scale scanning, but measurement precision deteriorates compared to dynamic testing
Solution Approach 1:
The patent applies segmentation by dividing the vulnerability analysis process into distinct phases: package structure analysis, manifest file parsing, code disassembly, and pattern matching. Each phase focuses on specific aspects of the application package, allowing the system to maintain high productivity through automated batch processing while achieving reliable detection accuracy through systematic examination of different code layers and security-relevant components.
Solution Approach 2:
The patent uses copying by creating and analyzing copies of the application package's code and metadata during static analysis. The system disassembles the package to generate intermediate representations and compares these copies against known vulnerability patterns and secure coding standards. This allows thorough examination without requiring the original application to be executed, maintaining both efficiency and detection capability.
3Measurement precision
If code disassembly and pattern searching is performed, then measurement precision is improved for detecting vulnerable functions, but device complexity increases
Solution Approach 1:
The patent applies parameter changes by transforming the application code from its original format through disassembly into intermediate representations that are more amenable to pattern matching. The system changes parameters such as code representation format, analysis depth, and pattern matching criteria to optimize both detection accuracy and processing efficiency. This allows precise vulnerability identification while managing system complexity through automated transformation processes.
Data Source
AI summary
Apparatus and methods are disclosed herein for analyzing computer programs for potential security vulnerabilities. In one computer-implemented embodiment of the disclosed technology, a method includes analyzing a package for an application (e.g., a mobile device application package) by disassembling at least a portion of executable code associated with the application, searching for a pattern associated with a potentially vulnerably function or method, and, if the function or method is defined, then analyzing disassembled code for the function to determine whether a vulnerability is present. In some examples, a number of packages are stored in an application store database and scanned periodically to statically analyze the package for vulnerabilities.