System and method for program security protection

Patent metadata

Field	Value
Publication number	US-10089448-B1
Application number	US-201815923240-A
Country	US
Kind code	B1
Filing date	Mar 16, 2018
Priority date	Feb 6, 2018
Publication date	Oct 2, 2018
Grant date	Oct 2, 2018

Abstract

Systems and methods are provided for program security protection. An exemplary method for program security protection may comprise obtaining data packets transceived by a first program, analyzing similarities among the obtained data packets for a plurality of transmissions, and determining a security threat to the first program based on the analyzed similarities.

First claim

The invention claimed is:

1. A method for program security protection, comprising:
obtaining, by a second program in a computing device, data packets from transmissions between a first program in the computing device and a server through a network, wherein the second program is configured to relay the transmissions between the first program and the server;
analyzing, by the second program, similarities among the obtained data packets; and
determining, by the second program, a security threat to the first program based on the analyzed similarities, wherein:
the obtained data packets comprise a first data packet and a second data packet;
analyzing the similarities among the obtained data packets comprises determining a number of atomic operations required to change a first string X of the first data packet to a second string Y of the second data packet;
the first string X has a length i;
the second string Y has a length j;
the number of atomic operations required to change the first string X to the second string Y is D(X i , Y j );
determining the number of atomic operations required to change the first string X of the first data packet to the second string Y of the second data packet comprises:
(1) in response to determining the ith string character of the first string is the same as the jth string character of the second string, obtaining D(X i-1 , Y j-1 ) as equal to D(X i , Y j );
(2) in response to determining the ith string character of the first string is different from the jth string character of the second string, obtaining the minimum value of [D(X i-1 , Y j-1 )+1], [D(X i , Y j-1 )+1], and [D(X i-1 , Y j )+1] as equal to D(X i , Y j ); and
(3) recursively applying steps (1) and (2) to the first and second strings from their last string characters to obtain D(X i , Y j );

the first data packet belongs to a first transmission between the first program and the server, and the second data packet belongs to a second transmission between the first program and the server;
the first data packet comprises a first transmission timestamp and at least one of a first token or a first fingerprint;
the second data packet comprises a second transmission timestamp and at least one of a second token or a second fingerprint;
analyzing the similarities among the obtained data packets further comprises: obtaining (1) similarities between the first transmission timestamp and the second transmission timestamp and (2) at least one of: similarities between the first token and the second token or similarities between the first fingerprint and the second fingerprint; and
determining, by the second program, the security threat to the first program based on the analyzed similarities comprises: determining the second transmission as associated with the security threat, in response to determining that (1) the first transmission timestamp is earlier than the second transmission timestamp, and (2) at least one of: the first token and the second token are the same or the first fingerprint and the second fingerprint are the same.

2. The method of claim 1 , wherein:
the first program comprises a software application installed on the computing device; and
the second program comprises a man-in-the-middle proxy installed on the computing device.

3. The method of claim 1 , wherein:
the obtained packets comprise at least one of a header, a payload, or a trailer;
the header comprises at least one of: a Uniform Resource Locator (URL), a token, a fingerprint, a time, a key, or a username.

4. The method of claim 1 , wherein:
the atomic operation is selected from: inserting, deleting, or exchanging a string character.

5. A method for program security protection, comprising:
from transmissions between a first program in a computing device and a server through a network, obtaining, by a second program in the computing device, information of Application Programming Interface (API) calls executed by the first program, wherein the second program is configured to relay the transmissions between the first program and the server;
analyzing, by the second program, similarities among the obtained API call information; and
determining, by the second program, a security threat to the first program based on the analyzed similarities, wherein:
the obtained API call information comprises a plurality of API call information strings;
analyzing the similarities among the obtained API call information comprises determining a number of atomic operations required to change the plurality of API call information strings to a same string, the atomic operation being selected from: inserting, deleting, or exchanging a string character;
a first API call information string S has a length i;
a second API call information string T has a length j;
the number of atomic operations required to change the first API call information string S to the second API call information string T is D(S i , T j ); and
determining the number of atomic operations required to change the plurality of API call information strings to the same string comprises:
(1) in response to determining the ith string character of the first string is the same as the jth string character of the second string, obtaining D(S i-1 , T j-1 ) as equal to D(S i , T j );
(2) in response to determining the ith string character of the first string is different from the jth string character of the second string, obtaining the minimum value of [D(S i-1 , T j-1 )+1], [D(S i , T j-1 )+1], and [D(S i-1 , T j )+1] as equal to D(S i , T j );
(3) recursively applying steps (1) and (2) to the first and second strings from their last string characters to obtain D(S i , T j ); and
(4) recursively applying steps (1) to (3) to all pairs of API call information strings in the plurality of API call information strings;

obtaining information of the API calls executed by the first program comprises: obtaining the API call information for the API calls via a prelog algorithm, the prelog algorithm configured to obtain the API call information, the prelog algorithm being executed before the API call is executed;
the API calls comprise a plurality of API calls each comprising a key;
analyzing the similarities among the obtained API call information comprises obtaining a similarity among the keys; and
determining the security threat to the first program based on the analyzed similarities comprises determining the plurality of API calls as associated with the security threat, in response to an obtained similarity exceeding a threshold.

6. The method of claim 5 , wherein:
obtaining information of the API calls executed by the first program comprises obtaining the API call information for the API calls via the prelog algorithm and an epilog algorithm; and
the prelog and the epilog algorithms are configured to obtain the API call information.

7. The method of claim 6 , wherein:
the epilog algorithm is executed after the API call is executed.

8. The method of claim 6 , wherein:
the first program comprises a software application installed on a computing device; and
the prelog algorithm and the epilog algorithm are incorporated into an operating system of the computing device.

9. The method of claim 5 , wherein:
the obtained API call information for each API call comprises at least one of an unencrypted file, a size of data, a start position, a key, or an encrypted file.

Assignees

• Didi Res America Llc

Inventors

• Zhou Wu

Classifications

• G06V10/75

  Organisation of the matching processes, e.g. simultaneous or sequential comparisons of image or video features; Coarse-fine approaches, e.g. multi-scale approaches; using context analysis; Selection of dictionaries · CPC title

• G06F18/22

  Matching criteria, e.g. proximity measures · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L63/126

  the source of the received data · CPC title