Framework for efficient security coverage of mobile software applications that is usable to harden in the field code

A method for hardening an application operating within a mobile device comprising:

• receiving the application in a first level of code, wherein said first level of code is executable code;
• translating the application to a second level of code different than the first level of code;
• creating a representation of an application that describes states and state transitions of said application;
• identifying one or more unwanted behaviors to be conducted by the mobile device based on an analysis of code of said application and the representation of said application;
• determining changes to said code of the application, wherein said changes to said code preclude the application from performing the one or more unwanted behaviors;
• and
• instrumenting the application with said changes to said code to preclude the application from performing the one or more unwanted behaviors, wherein the instrumenting is performed on the second level object code.

A system comprising:

• one or more hardware processors;
• and
• a storage medium communicatively coupled to the one or more hardware processors, and having stored thereon:
• a central intelligence unit configured to (i) identify one or more unwanted behaviors to be conducted by a device based on an analysis of code of an application and a representation of said application that describes states and state transitions of said application, and (ii) determine changes to code of said application, wherein said changes to code preclude the application from performing the one or more unwanted behaviors, wherein prior to identifying the one or more unwanted behaviors, the central intelligence unit translates the application from a first level of code being executable code to a second level of code different than the first level of code;
• and
• a static instrumentation engine in communication with the central intelligence unit, the static instrumentation engine being configured to (i) create said representation of said application, (ii) instrument the application with the changes to the code so that the application is precluded from performing the one or more unwanted behaviors, and (iii) install the instrumented application into data storage of the device, wherein the instrumenting is performed on the second level object code.

A system for hardening an application, the system comprising:

• one or more hardware processors;
• and
• a storage medium communicatively coupled to the one or more hardware processors, and having stored thereon:
• a central intelligence unit including:
• an explorer engine configured to receive a description of unwanted behaviors of said application, and
• a static instrumentation unit including:
• a translation unit configured to receive said application in a first level of code and translate the application to a higher level of code different than the first level of code, wherein said first level of code is executable code,
• an application representation generation unit configured to create a representation of an application that describes states and state transitions of said application, wherein said explorer engine uses said description and said representation to determine changes to code of said application to preclude said application from performing at least one of said unwanted behaviors,
• an instrumentation unit configured to instrument said application with said changes to said code to create an instrumented application that does not perform said at least one of said unwanted behaviors, wherein instrumenting of said application is performed at said higher level of code.

A non-transitory computer-readable medium having stored thereon logic, the logic being executable by one or more processors to perform operations including:

• receiving, by a translation unit, an application in a first level of code, wherein said first level of code is executable code;
• translating, by the translation unit, the application to a second level of code different than the first level of code;
• creating, by an application representation generation unit, a representation of an application that describes states and state transitions of said application;
• receiving, by an explorer engine, a description of unwanted behaviors of said application;
• using, by the explorer engine, said description and said representation to determine changes to code of said application, wherein said changes to said code preclude said application from performing at least one of said unwanted behaviors;
• and
• instrumenting, by a static instrumentation unit, said application with said code adapted to the changes to said code to create an instrumented application that does not perform said at least one of said unwanted behaviors, wherein said instrumenting of said application is performed at said second level of code.