Framework for iterative analysis of mobile software applications
View Patent ↗A method is described that includes operations for receiving an application, identifying a region of interest of the application based on rules or analysis of the application, and determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest. Thereafter, the stimuli is applied to the application. One or more behaviors of the application are monitored by a central intelligence engine during virtual execution of the application in response to the applied stimuli to determine whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code.
1. A method for detecting a presence of malware within an application based on analysis by a central intelligence engine processed by a processor within a computing system, the method comprising:
identifying a region of interest within an application that is running in a virtual machine, the region of interest corresponds to one or more portions of code of the application that are considered to potentially include improperly behaving code;
determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest;
applying the stimuli to the application; and
monitoring one or more behaviors of the application during virtual execution of the application within the virtual machine in response to the applied stimuli to determine whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code that includes malicious code.
2. The method of claim 1 , wherein the identifying of the region of interest includes analysis of the portion of code of the application to determine if the portion of the code violates one or more rules.
3. The method of claim 1 , wherein the identifying of the region of interest includes analysis of the portion of code of the application to determine if the portion of the code will attempt to cause data to be read out of a storage location assigned for sensitive data.
4. The method of claim 1 , wherein the determining the specific stimuli comprises determining a data value that, when processed by the application, drives the virtual execution of the application to the region of interest.
5. The method of claim 1 , wherein the determining the specific stimuli comprises determining an event that causes an operating system used in the virtual execution of the application to report the event to the application or provide state information to hardware observable by the application.
6. The method of claim 1 , wherein prior to monitoring the one or more behaviors, the method further comprises
enabling one or more monitors within a run time environment associated with the application; and
generating monitoring information from the one or more monitors.
7. The method of claim 6 wherein the enabling of the one or more monitors includes enabling at least one monitor in any of:
a virtual machine located between the application and an operating system instance within the run time environment associated with the application;
the operating system instance.
8. The method of claim 7 , wherein the enabling of the one or more monitors includes enabling at least one monitor in both of the virtual machine and the operating system instance.
9. The method of claim 7 , wherein the enabling of the one or more monitors includes enabling one or more of (i) a system calls monitoring function or (ii) a device operation monitoring function.
10. The method of claim 9 , wherein the system calls monitoring function comprises at least a portion of the operating system instance.
11. The method of claim 1 , wherein the rules include one or more of (i) rules from a first database, (ii) rules from a machine learning platform, or (iii) user provided rules.
12. The method of claim 11 , wherein the region of interest is determined from one or more machine learned rules received from a machine learning system and the data provides details as to specific low level code structures of the improperly behaving code in order to identify the region of interest of the application.
13. The method of claim 11 , wherein a determination as to whether the one or more behaviors of one or more improperly behaving forms of code comprises providing details as to specific behaviors of one or more improperly behaving forms of code as observed by a machine learning system.
14. A method for detecting a presence of malware within an application based on analysis by a central intelligence engine processed by a processor within a computing system, the method comprising:
identifying a region of interest of an application that is running in a virtual machine, the region of interest corresponds to one or more parts of the application that are considered to potentially include improperly behaving code;
determining specific stimuli that will cause one or more state transitions to occur for the application so that the application commences processing of code associated with the region of interest;
applying the stimuli to the application;
monitoring one or more behaviors of the application during virtual execution of the code associated with the region of interest in response to the applied stimuli; and
determining whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code that includes malicious code.
15. A computing system comprising:
a hardware processor;
a storage medium in communication with the hardware processor, the storage medium comprises
a static instrumentation engine that, when executed by the hardware processor, is configured to (i) identify a region of interest for an application under test, (ii) determine specific stimuli that causes one or more state transitions within the application to reach the region of interest, and (iii) applying the stimuli to the application;
a dynamic run time environment including a virtual machine that, when executed by the hardware processor, is configured to process the application, the dynamic run time environment is further configured to monitor one or more behaviors of the application during processing of the application in response to the applied stimuli; and
a central intelligence engine that, when executed by the hardware processor, is configured to determine, in response to information associated with the one or more behaviors monitored during processing of the application within the virtual machine, whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code that includes malicious code.
16. A method for detecting a presence of malware within an application based on analysis by a central intelligence engine processed by a processor within a computing system, the method comprising:
generating one or more machine learned rules;
identify a region of interest of an application based on at least the one or more machine learned rules, the region of interest corresponds to one or more portions of code of the application that are considered to potentially include improperly behaving code;
determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest;
applying the stimuli to the application;
observing behaviors of the application during execution of at least the portion of code of the application in a virtual machine; and
determining whether the region of interest corresponds to improperly behaving code that includes malicious code based on the observed behaviors.
17. The method of claim 16 wherein the generating of the one or more machine learned rules is conducted by a cloud service.
18. The method of claim 14 , wherein the identifying of the region of interest includes analysis of code associated with the one or more parts of the application to determine if the code violates one or more rules.
19. The method of claim 14 , wherein the identifying of the region of interest includes analysis of the code associated with the one or more parts of the application to determine if the code will attempt to cause data to be read out of a storage location assigned for sensitive data.
20. The method of claim 14 , wherein the determining the specific stimuli comprises determining a data value that, when processed by the application, drives the virtual execution of the application to the region of interest.
21. The method of claim 14 , wherein the determining the specific stimuli comprises determining an event that causes an operating system used in the virtual execution of the application to report the event to the application or provide state information to hardware observable by the application.
22. The method of claim 14 , wherein prior to monitoring the one or more behaviors, the method further comprises
enabling one or more monitors within a run time environment associated with the application; and
generating monitoring information from the one or more monitors.
23. The method of claim 22 wherein the enabling of the one or more monitors includes enabling at least one monitor in any of:
a virtual machine in communication with the application and an operating system instance within the run time environment;
the operating system instance.
24. The method of claim 23 , wherein the enabling of the one or more monitors includes enabling at least one monitor in both of the virtual machine and the operating system instance.
25. The method of claim 23 , wherein the enabling of the one or more monitors includes enabling one or more of (i) a system calls monitoring function or (ii) a device operation monitoring function.
26. The method of claim 25 , wherein the system calls monitoring function comprises at least a portion of the operating system instance.
27. The computing system of claim 15 , wherein the static instrumentation engine identifies the region of interest by analyzing code associated with a portion of the application under test to determine if the code violates one or more rules.
28. The computing system of claim 15 , wherein the static instrumentation engine identifies the region of interest by analyzing code associated with a portion of the application under test to determine if the code will attempt to cause data to be read out of a storage location assigned for sensitive data.
29. The computing system of claim 15 , wherein the dynamic run time environment further comprises one or more monitors that are enabled to monitor for the one or more behaviors during processing of the application within the virtual machine.
30. The computing system of claim 29 , wherein the one or more monitors are situated in one of (i) the virtual machine located in communication with the application and an operating system instance within the run time environment associated with the application, or (ii) the operating system instance.