# US 8,474,046 B1 · Systems and methods for identifying the spreading of sensitive data by a suspicious application > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,046 B1 - Document ID: US8474046B1 - Status: Granted - Kind: B1 - Application number: 13/188,346 - Filed: 2011-07-21 - Granted: 2013-06-25 - Earliest claimed: 2011-07-21 - Assignees: Symantec Corporation - Applicants: Sheng Gong; Zhe Liu; Xue Feng Tian - Inventors: Sheng Gong; Zhe Liu; Xue Feng Tian - Web page: https://patentgrep.com/patent/US8474046B1 ## CPC - G06F 11/3093: {Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes} - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer-implemented method to identify the spreading of sensitive data from a suspicious application is described. At least one security attribute for an application programming interface (API) is defined. Sensitive data passed through the at least one security attribute to the suspicious application are marked. The marked sensitive data being passed through the at least one security attribute from the suspicious application are detected. A notification is generated regarding the spreading of the sensitive data by the suspicious application. ## Claims ### Claim 1 A computer-implemented method to identify spreading of sensitive data from a suspicious application, comprising: defining, by a processor, a first security attribute for a return value of a first application programming interface (API) and a second security attribute for a parameter of a second API, wherein the first API is different than the second API; marking, by the processor, data passed through the first security attribute to the suspicious application as sensitive data; detecting, by the processor, the marked sensitive data being passed through the second security attribute from the suspicious application; and generating, by the processor, a notification regarding spreading of the sensitive data by the suspicious application. ### Claim 2 (depends on 1) The method of claim 1, wherein the first security attribute comprises an incoming security attribute for incoming data passed through the first API to the suspicious application. ### Claim 3 (depends on 1) The method of claim 1, wherein the second security attribute comprises an outgoing security attribute for outgoing data passed from the suspicious application through the second API. ### Claim 4 (depends on 1) The method of claim 1, wherein the suspicious application executes on a smartphone device. ### Claim 5 (depends on 1) The method of claim 1, further comprising monitoring the sensitive data passed to and from the suspicious application through the first API and the second API in a simulated environment. ### Claim 6 (depends on 1) The method of claim 1, further comprising defining at least one additional security attribute for the second API. ### Claim 7 (depends on 6) The method of claim 6, wherein an argument passed on the at least one additional security attribute causes at least one data object to become sensitive data. ### Claim 8 (depends on 6) The method of claim 6, wherein an argument passed on the at least one additional security attribute causes at least one data object in a smartphone device to become exposed. ### Claim 9 (depends on 1) The method of claim 1, further comprising identifying the spreading of sensitive data from a suspicious application using static analysis. ### Claim 10 A smartphone device configured to identify spreading of sensitive data from a suspicious application, comprising: a processor; memory in electronic communication with the processor; and instructions stored in the memory, the instructions executable by the processor to define a first security attribute for a return value of a first application programming interface (API) and a second security attribute for a parameter of a second API, wherein the first API is different than the second API; mark data passed through the first security attribute to the suspicious application as sensitive data; detect the marked sensitive data being passed through the second security attribute from the suspicious application; and generate a notification regarding spreading of the sensitive data by the suspicious application. ### Claim 11 (depends on 10) The smartphone device of claim 10, wherein the first security attribute comprises an incoming security attribute for incoming data passed through the first API to the suspicious application. ### Claim 12 (depends on 10) The smartphone device of claim 10, wherein the second security attribute comprises an outgoing security attribute for outgoing data passed from the suspicious application through the second API. ### Claim 13 (depends on 10) The smartphone device of claim 10, wherein the suspicious application executes on the smartphone device. ### Claim 14 (depends on 10) The smartphone device of claim 10, wherein the instructions are further executable by the processor to monitor the sensitive data passed to and from the suspicious application through the first API and the second API in a simulated environment. ### Claim 15 (depends on 10) The smartphone device of claim 10, wherein the instructions are further executable by the processor to define at least one additional security attribute for the second API. ### Claim 16 (depends on 15) The smartphone device of claim 15, wherein an argument passed on the at least one additional security attribute causes at least one data object to become sensitive data. ### Claim 17 (depends on 15) The smartphone device of claim 15, wherein an argument passed on the at least one additional security attribute causes at least one data object in the smartphone device to become exposed. ### Claim 18 (depends on 10) The smartphone device of claim 10, wherein the monitoring module is further configured to identify the spreading of sensitive data from a suspicious application using static analysis. ### Claim 19 A computer-program product for identifying spreading of sensitive data from a suspicious application, the computer-program product comprising a non-transitory computer-readable medium having instructions thereon, the instructions being executable by a processor to: define a first security attribute for a return value of a first application programming interface (API) and a second security attribute for a parameter of a second API, wherein the first API is different than the second API; mark data passed through the first security attribute to the suspicious application as sensitive data; detect the marked sensitive data being passed through the second security attribute from the suspicious application; and generate a notification regarding spreading of the sensitive data by the suspicious application. ### Claim 20 (depends on 19) The computer-program product of claim 19, wherein the first security attribute comprises an incoming security attribute for incoming data passed through the first API to the suspicious application.