Visual Security Analysis Configuration for Mobile Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Configuring static security analysis for mobile applications is complex and prone to errors due to the manual identification of entry points, sources, sinks, and downgraders, often resulting in false positives and requiring specialized programming knowledge.
Innovation Solution
A method and system that allow non-programmers to visually configure security analysis by extracting and presenting UI views, enabling users to select and label components as entry points, sources, or sinks without knowledge of the application's source code, using a combination of static and dynamic analysis to eliminate false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual identification of entry points, sources, sinks, and downgraders is performed, then security analysis accuracy can be improved, but the complexity and time required for configuration increases significantly
Solution Approach 1:
The system performs automatic identification of entry points, sources, sinks, and downgraders through algorithmic analysis of the application code, eliminating the need for manual configuration by security analysts. The analyzer autonomously scans the codebase, identifies security-relevant components, and generates initial security models without human intervention.
Solution Approach 2:
The patent replaces the manual mechanical process of identifying security components with an automated computational system. The algorithmic analyzer uses static and dynamic analysis techniques to automatically detect entry points, sources, sinks, and downgraders, substituting human expertise with machine-based analysis.
2Productivity
If automatic algorithmic classification of all text input fields as sources and text display fields as sinks is performed, then configuration time is reduced, but the number of false positives increases
Solution Approach 1:
The system dynamically adjusts the classification of UI components based on their actual usage in the application code. Rather than static classification of all text fields, the analyzer traces data flows and dynamically determines which fields are actual sources or sinks based on their runtime behavior and security context.
Solution Approach 2:
The patent applies different classification rules to different UI components based on their specific characteristics and context. Each text field is analyzed individually to determine its actual security role, rather than applying a blanket classification rule to all fields of the same type.
3Measurement precision
If manual security configuration is performed by highly skilled personnel, then analysis accuracy is improved, but the ease of operation decreases and requires specialized knowledge
Solution Approach 1:
The system enables security analysts with limited programming expertise to perform accurate security analysis by providing automated assistance. The tool guides users through the configuration process, automatically identifies security components, and reduces the need for deep programming knowledge while maintaining analysis accuracy.
Solution Approach 2:
The patent introduces an intermediary automated analysis system that bridges the gap between security analysts and complex codebases. This intermediary tool handles the technical complexity of identifying security components, allowing users to focus on security policy decisions rather than technical implementation details.
Data Source
AI summary
A method extracts views from an application program, where at least some extracted views include at least one view component, and presenting the extracted views to a user. In response to the user selecting a view component in a presented extracted view, the method presents a form to the user having a plurality of vulnerability types indicated for the selected view component and, for each vulnerability type, provides an ability for the user to set an indicator in the form as to indicate whether the view component is at least one of a source or a sink. The method further includes saving the form containing the user's input in conjunction with a user-provided label for the selected view component and a unique identification of the selected view component, and deriving an analysis policy configuration from the saved form that is formatted for use by a program security analyzer.