Remediating rogue applications

Patent metadata

Field	Value
Publication number	US-9680864-B2
Application number	US-201314238542-A
Country	US
Kind code	B2
Filing date	Jun 18, 2013
Priority date	Jun 18, 2013
Publication date	Jun 13, 2017
Grant date	Jun 13, 2017

Abstract

In one example embodiment, a remediating system may include a mobile communication device, to which an application is to be installed, and a remediator that may be configured to remediate the application and transmit the remediated version of the application to the mobile communication device for installation.

First claim

We claim:

1. A remediation system, comprising:
a mobile communication device to which an application is to be installed; and
a remediation server configured to:
receive profile information and security and policy settings of a user of the mobile communication device;
receive, from the user, a request to remediate the application based on the received profile information and the received security and policy settings of the user;
remediate the application by:
identification of malicious code section associated with the application based on the received profile information, the received security and policy settings of the user, and a comparison of the application to stored signatures or certificates of known malicious applications,
elimination of the identified malicious code section from the application,
rebuild of the application by insertion, in place of the eliminated malicious code section, code that complies with the received profile information and the received security and policy settings of the user of the mobile communication device, and
test of the rebuilt application in a virtual environment; and

transmit the rebuilt application to the mobile communication device for installation.

2. The remediation system of claim 1 ,
wherein the remediation server is configured to remediate the application by:
identification, based on a statistical analysis, of potential malicious method or system calls; and
replacement of the identified potential malicious method or system calls with one or more custom method or system calls.

3. The remediation system of claim 1 , wherein the remediation server is implemented as a service by a service provider.

4. The remediation system of claim 1 , wherein the remediation server is implemented as a tool on a workstation to which the mobile communication device is registered.

5. A non-transitory computer-readable medium that stores instructions thereon that, when executed, cause one or more processors to execute operations directed towards remediating rogue applications, the operations comprising:
receive an application;
receive profile information and security and policy settings of a user of a mobile communication device;
receive, from the user, a request to remediate the application based on the received profile information and the received security and policy settings of the user;
identify potentially malicious code section associated with the application based on the received profile information, the received security and policy settings of the user, and a comparison of the application to stored signatures or certificates of known malicious applications;
remove the identified potentially malicious code section from the application;
rebuild the application by insertion, in place of the removed potentially malicious code section, of replacement code that complies with the received profile information and the received security and policy settings of the user of the mobile communication device to remediate the application;
test the rebuilt application in a virtual environment; and
transmit the rebuilt application to the mobile communication device.

6. The non-transitory computer-readable medium of claim 5 , wherein the non-transitory computer-readable medium is included in a software framework of a remediating service.

7. The non-transitory computer-readable medium of claim 5 , wherein the non-transitory computer-readable medium is configured to be executed on a workstation to which the mobile communication device is communicatively coupled.

8. The non-transitory computer-readable medium of claim 5 , wherein the application is received after purchase or prior to installation thereof.

9. The non-transitory computer-readable medium of claim 5 , wherein the identification includes:
conversion of executable code to source code;
parse of source code or executable code; and
identification of method or system calls that may be potentially malicious.

10. The non-transitory computer-readable medium of claim 9 , wherein the identification of method or system calls that may be potentially malicious is executed based on a statistical analysis.

11. The non-transitory computer-readable medium of claim 10 , wherein the identification of method or system calls that may be potentially malicious includes a comparison of the source code or executable code against the stored signatures or certificates of known malicious applications.

12. The non-transitory computer-readable medium of claim 9 , wherein the identification of method or system calls that may be potentially malicious is executed based on pre-registered settings.

13. The non-transitory computer-readable medium of claim 5 , wherein the replacement code includes custom code.

14. The non-transitory computer-readable medium of claim 5 , wherein the test includes execution of the rebuilt application in the virtual environment which is an application runtime virtual modeling service.

15. The non-transitory computer-readable medium of claim 5 , wherein the operations are automated to be executed upon purchase of the application attributed to a registered user's account.

16. A method to remediate applications, the method comprising:
receiving, from a mobile communication device, an application suspected of having malicious code;
receiving profile information and security and policy settings of a user of the mobile communication device;
receiving, from the user, a request to remediate the application based on the received profile information and the received security and policy settings of the user;
remediating the application by:
identifying malicious code section associated with the application based on the received profile information and the received security and policy settings of the user, and by executing the application for dynamic analysis,
eliminating the identified malicious code section from the application,
rebuilding the application by incorporating, in place of the eliminated malicious code section, code that complies with the received profile information and the received security and policy settings of the user of the mobile communication device, and
testing the rebuilt application in a virtual environment; and

transmitting the rebuilt application to the mobile communication device.

17. The method of claim 16 , wherein the code that complies with the received profile information and the received security and policy settings includes stored custom code.

18. The method of claim 16 , wherein the identifying includes:
identifying one or more irregularities or potentially malicious behavior, wherein the one or more irregularities or potentially malicious behavior includes one or more of configuration changes, registry tampering, network redirections, installation of rogue executables, buffer overflows, or memory corruption.

19. The method of claim 16 , wherein the identifying is executed based on analyzing runtime behavior.

20. The method of claim 16 , wherein the received profile information and the received security and policy settings of the user of the mobile communication device relate to: private information that is authorized for release, types of application functionality for which the private information is authorized for release, or context for the authorized release of the private information.

Assignees

• Empire Technology Dev Llc

Inventors

• Khesin Oscar

Classifications

• G06F2221/033

  Test or assess software · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title