Framework for iterative analysis of mobile software applications
AssigneeFireEye, Inc.
InventorsOsman Abdoul Ismael, Dawn Song, Ashar Aziz
Life of this patent
Estimating the term…
Abstract
A method is described that includes operations for receiving an application, identifying a region of interest of the application based on rules or analysis of the application, and determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest. Thereafter, the stimuli is applied to the application. One or more behaviors of the application are monitored by a central intelligence engine during virtual execution of the application in response to the applied stimuli to determine whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code.
Claims30
A method for detecting a presence of malware within an application based on analysis by a central intelligence engine processed by a processor within a computing system, the method comprising:
- identifying a region of interest within an application that is running in a virtual machine, the region of interest corresponds to one or more portions of code of the application that are considered to potentially include improperly behaving code;
- determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest;
- applying the stimuli to the application;
- and
- monitoring one or more behaviors of the application during virtual execution of the application within the virtual machine in response to the applied stimuli to determine whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code that includes malicious code.
A method for detecting a presence of malware within an application based on analysis by a central intelligence engine processed by a processor within a computing system, the method comprising:
- identifying a region of interest of an application that is running in a virtual machine, the region of interest corresponds to one or more parts of the application that are considered to potentially include improperly behaving code;
- determining specific stimuli that will cause one or more state transitions to occur for the application so that the application commences processing of code associated with the region of interest;
- applying the stimuli to the application;
- monitoring one or more behaviors of the application during virtual execution of the code associated with the region of interest in response to the applied stimuli;
- and
- determining whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code that includes malicious code.
A computing system comprising:
- a hardware processor;
- a storage medium in communication with the hardware processor, the storage medium comprises
- a static instrumentation engine that, when executed by the hardware processor, is configured to (i) identify a region of interest for an application under test, (ii) determine specific stimuli that causes one or more state transitions within the application to reach the region of interest, and (iii) applying the stimuli to the application;
- a dynamic run time environment including a virtual machine that, when executed by the hardware processor, is configured to process the application, the dynamic run time environment is further configured to monitor one or more behaviors of the application during processing of the application in response to the applied stimuli;
- and
- a central intelligence engine that, when executed by the hardware processor, is configured to determine, in response to information associated with the one or more behaviors monitored during processing of the application within the virtual machine, whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code that includes malicious code.
A method for detecting a presence of malware within an application based on analysis by a central intelligence engine processed by a processor within a computing system, the method comprising:
- generating one or more machine learned rules;
- identify a region of interest of an application based on at least the one or more machine learned rules, the region of interest corresponds to one or more portions of code of the application that are considered to potentially include improperly behaving code;
- determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest;
- applying the stimuli to the application;
- observing behaviors of the application during execution of at least the portion of code of the application in a virtual machine;
- and
- determining whether the region of interest corresponds to improperly behaving code that includes malicious code based on the observed behaviors.
Dependencies are inferred from the claim text.