Static and dynamic security analysis of apps for mobile devices

Patent metadata

Field	Value
Publication number	US-9811665-B1
Application number	US-201313954815-A
Country	US
Kind code	B1
Filing date	Jul 30, 2013
Priority date	Jul 30, 2013
Publication date	Nov 7, 2017
Grant date	Nov 7, 2017

Abstract

Techniques for performing static and dynamic analysis on a mobile device application are disclosed. Static analysis is performed on a mobile device application using a static analysis engine. A static analysis report is generated. Dynamic analysis of the application is performed using a dynamic analysis engine. The dynamic analysis performed is customized based on results of the static analysis. A determination of whether the application is malicious is made based at least on the dynamic analysis.

First claim

What is claimed is:

1. A system, comprising:
a processor configured to:
perform static analysis on a mobile device application using a static analysis engine to generate a static analysis report associated with the application;
perform dynamic analysis of the application using a dynamic analysis engine, wherein the dynamic analysis is customized based on results of the static analysis, wherein performing dynamic analysis includes emulating a mobile device, wherein performing dynamic analysis includes simulating an event external to the mobile device, and wherein performing dynamic analysis includes: (1) performing a first stage of dynamic analysis, (2) initiating a reboot event, and (3) performing a second stage of dynamic analysis after the reboot event occurs; and
determine whether the application is malicious based at least in part on the dynamic analysis; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 wherein the processor is further configured to refine a result of the static analysis based on the dynamic analysis.

3. The system of claim 1 wherein performing static analysis includes determining that a permission is not used by the application, and wherein customizing the dynamic analysis includes not performing dynamic analysis with respect to the permission.

4. The system of claim 1 wherein performing static analysis includes reversing the mobile device application into an intermediate source code form.

5. The system of claim 1 wherein performing static analysis includes determining the presence of a filetype mismatch.

6. The system of claim 1 wherein performing static analysis includes determining a minimum operating system version number associated with the application.

7. The system of claim 6 wherein performing dynamic analysis includes emulating a system running the minimum operating system version.

8. The system of claim 1 wherein performing static analysis includes performing an integrity check to determine whether the application will crash if executed during dynamic analysis.

9. The system of claim 1 wherein performing at least one of static and dynamic analysis includes determining that a deletion action is taken in response to receipt of message appearing to have been sent by a carrier.

10. The system of claim 1 wherein, in the event a feature is identified as suspicious during static analysis, the processor is configured to determine whether the feature is malicious during dynamic analysis.

11. The system of claim 1 wherein the processor is further configured to report the determination to a data security appliance.

12. The system of claim 1 wherein the simulated external event comprises a simulated location change.

13. The system of claim 1 wherein the simulated external event comprises a simulated transmission of a message to the mobile device from a simulated entity.

14. A method, comprising:
performing static analysis on a mobile device application using a static analysis engine to generate a static analysis report associated with the application;
performing dynamic analysis of the application using a dynamic analysis engine, wherein the dynamic analysis is customized based on results of the static analysis, wherein performing dynamic analysis includes emulating a mobile device, wherein performing dynamic analysis includes simulating an event external to the mobile device, and wherein performing dynamic analysis includes: (1) performing a first stage of dynamic analysis, (2) initiating a reboot event, and (3) performing a second stage of dynamic analysis after the reboot event occurs; and
determining whether the application is malicious based at least in part on the dynamic analysis.

15. The method of claim 14 further comprising refining a result of the static analysis based on the dynamic analysis.

16. The method of claim 14 wherein performing static analysis includes determining that a permission is not used by the application, and wherein customizing the dynamic analysis includes not performing dynamic analysis with respect to the permission.

17. The method of claim 14 wherein performing static analysis includes determining a minimum operating system version number associated with the application.

18. The method of claim 14 wherein performing at least one of static and dynamic analysis includes determining that a deletion action is taken in response to receipt of message appearing to have been sent by a carrier.

19. The method of claim 14 wherein, in the event a feature is identified as suspicious during static analysis, a determination of whether the feature is malicious is made during dynamic analysis.

20. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
performing static analysis on a mobile device application using a static analysis engine to generate a static analysis report associated with the application;
performing dynamic analysis of the application using a dynamic analysis engine, wherein the dynamic analysis is customized based on results of the static analysis, wherein performing dynamic analysis includes emulating a mobile device, wherein performing dynamic analysis includes simulating an event external to the mobile device, and wherein performing dynamic analysis includes: (1) performing a first stage of dynamic analysis, (2) initiating a reboot event, and (3) performing a second stage of dynamic analysis after the reboot event occurs; and
determining whether the application is malicious based at least in part on the dynamic analysis.

Assignees

• Palo Alto Networks Inc

Inventors

• Xu Zhi
• Wang Xinran
• Xie Huagang

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/562

  Static detection · CPC title