Symbolic Execution Framework for Mobile App Security Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile computing platforms face challenges in efficiently determining the safety of application software due to the complexity of identifying 'regions of interest' within applications, which are crucial for security assessments, as existing methods lack precision and efficiency in analyzing and characterizing application behavior.
Innovation Solution
A framework that employs symbolic execution and a central intelligence engine with a behavior and logic engine, explorer engine, and machine learning to identify and analyze 'regions of interest' within mobile applications, using static and dynamic instrumentation to apply stimuli and monitor behavior, thereby streamlining the testing process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing security assessment methods are used to analyze application behavior, then security coverage is achieved, but the analysis lacks precision and efficiency in identifying regions of interest
Solution Approach 1:
The patent segments the application code into distinct regions of interest using symbolic execution. The explorer engine divides the code base into executable statements and identifies specific regions that require security analysis, separating critical code paths from benign code. This segmentation enables precise targeting of security assessments without analyzing entire applications, thereby improving both precision and efficiency.
Solution Approach 2:
The patent applies local quality by focusing security analysis resources on specific regions of interest rather than uniformly analyzing all code. The behavior engine and explorer engine identify and concentrate analysis on critical code regions where security issues are most likely to occur, allocating computational resources locally to high-risk areas while skipping benign code sections.
2Reliability
If comprehensive code analysis is performed to ensure security coverage, then security assessment thoroughness is improved, but execution time and computational resources increase
Solution Approach 1:
The patent performs preliminary action by using symbolic execution to pre-identify regions of interest before conducting detailed security analysis. The explorer engine executes symbolic code to determine which regions require security assessment, preparing a targeted list of critical areas in advance. This preliminary identification eliminates the need for exhaustive analysis of all code, reducing execution time while maintaining thoroughness in critical areas.
Solution Approach 2:
The patent applies partial action by performing security analysis only on identified regions of interest rather than executing excessive analysis on all code. The system determines the minimum necessary analysis scope by focusing on critical paths, conditional branches, and error-prone regions, achieving adequate security coverage without the time cost of comprehensive analysis.
3Measurement precision
If symbolic execution is used to identify regions of interest, then analysis precision is improved, but device resource consumption increases
Solution Approach 1:
The patent extracts and removes benign code sections from the analysis scope after identifying regions of interest through symbolic execution. The explorer engine determines which code regions can be safely excluded from detailed security analysis, taking out unnecessary computational work. This extraction reduces resource consumption by focusing symbolic execution only on critical paths while eliminating waste on benign code.
Data Source
AI summary
A method is described that involves receiving an application and generating a representation of the application that describes states of the application and transitions between the states. The method further includes referring to one or more rules and/or information from an inference engine that is observing the application's run time behavior to identify a region of interest within the application and reaching the region of interest by performing the following: identifying a path from the application's present state to the region of interest; representing states of the application along the path as logic expressions; solving the expressions to generate solutions to the expressions; causing stimuli to be provided to the application, where the stimuli correspond to the solutions.