Fast and accurate identification of message-based API calls in application binaries

Patent metadata

Field	Value
Publication number	US-9910724-B2
Application number	US-201615013231-A
Country	US
Kind code	B2
Filing date	Feb 2, 2016
Priority date	Sep 13, 2013
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

Disclosed are various embodiments for fast and accurate identification of message-based application programming interface (API) calls in applications. A set of compliance rules is obtained from a compliance rule store. A request to analyze an application is received. An application analysis is performed by scanning the application to identify one or more public APIs invoked by the application. The set of compliance rules are enforced on the application based at least in part on the application analysis.

First claim

Therefore, the following is claimed:

1. A system, comprising:
at least one computing device; and
at least one service executable in the at least one computing device, the at least one service, when executed, causing the at least one computing device to at least:
obtain a set of compliance rules from a compliance rule store;
receive a request to analyze an application;
perform an application analysis by:
obtaining data identifying a plurality of public application programming interface (API) definitions,
analyzing binary code of the application and metadata of the application to determine a list of external classes and local classes used by the application and a list of external methods and local methods called by the application, and
scanning the application to identify at least one public API invoked by the application, wherein the at least one public API invoked by the application is identified by comparing the list of external classes and local classes used by the application and the listing of external methods called by the application with the data identifying the plurality of public API definitions;

wrap the application based at least in part on the application analysis; and
enforce the set of compliance rules on the application based at least in part on the application analysis.

2. The system of claim 1 , wherein the at least one service, when executed, further causes the at least one computing device to at least:
generate a developer reputation record based at least in part on the application analysis; and
enforce the set of compliance rules on the application further based at least in part on the developer reputation record.

3. The system of claim 1 , wherein the at least one service, when executed, further causes the at least one computing device to at least embed a software development kit (SDK) in the application based at least in part on the application analysis.

4. The system of claim 1 , wherein the at least one service, when executed, further causes the at least one computing device to at least perform forward constant propagation to determine a plurality of instructions of the application that invoke the at least one public API.

5. The system of claim 1 , wherein the at least one service, when executed, further causes the at least one computing device to at least perform backward slicing to check an argument of the at least one public API.

6. The system of claim 1 , wherein the at least one computing device comprises a first computing device and the set of compliance rules comprise a compliance rule restricting access to the wrapped application based at least in part on a current time or a location of a second computing device executing the wrapped application.

7. A method, comprising:
obtaining a set of compliance rules from a compliance rule store;
receiving a request to analyze an application;
performing an application analysis by:
obtaining data identifying a plurality of public application programming interface (API) definition,
analyzing binary code of the application and metadata of the application to determine a list of external classes and local classes used by the application and a list of external methods and local methods called by the application, and
scanning the application to identify at least one public API invoked by the application, wherein the at least one public API invoked by the application is identified by comparing the list of external classes and local classes used by the application and the listing of external methods called by the application with the data identifying the plurality of public API definitions;

wrapping the application based at least in part on the application analysis; and
enforcing the set of compliance rules on the application based at least in part on the application analysis.

8. The method of claim 7 , further comprising:
generating a developer reputation record based at least in part on the application analysis; and
enforcing the set of compliance rules on the application further based at least in part on the developer reputation record.

9. The method of claim 7 , further comprising embedding a software development kit (SDK) in the application based at least in part on the application analysis.

10. The method of claim 7 , further comprising performing forward constant propagation to determine a plurality of instructions of the application that invoke the at least one public API.

11. The method of claim 7 , further comprising performing backward slicing to check an argument of the at least one public API.

12. The method of claim 7 , wherein the set of compliance rules comprises a compliance rule restricting access to the wrapped application based at least in part on a current time.

13. The method of claim 7 , wherein the set of compliance rules comprises a compliance rule restricting access to the wrapped application based at least in part on a location of a computing device executing the wrapped application.

14. A non-transitory computer-readable medium embodying a program executable in at least one computing device, wherein when executed the program causes the at least one computing device to at least:
obtain a set of compliance rules from a compliance rule store;
receive a request to analyze an application;
perform an application analysis by:
obtaining data identifying a plurality of public application programming interface (API) definitions,
analyzing binary code of the application and metadata of the application to determine a list of external classes and local classes used by the application and a list of external methods and local methods called by the application, and
scanning the application to identify at least one API invoked by the application, wherein the at least one public API invoked by the application is identified by comparing the list of external classes and local classes used by the application and the listing of external methods called by the application with the data identifying the plurality of public API definitions;

wrap the application based at least in part on the application analysis; and
enforce the set of compliance rules on the application based at least in part on the application analysis.

15. The non-transitory computer-readable medium of claim 14 , wherein when executed the program causes the at least one computing device to at least embed a software development kit (SDK) in the application based at least in part on the application analysis.

16. The non-transitory computer-readable medium of claim 14 , wherein when executed the program causes the at least one computing device to at least generate a developer reputation record based at least in part on the application analysis.

17. The non-transitory computer-readable medium of claim 16 , wherein when executed the program causes the at least one computing device to at least enforce the set of compliance rules on the application further based at least in part on the developer reputation record.

18. The non-transitory computer-readable medium of claim 14 , wherein when executed the program causes the at least one computing device to at least perform forward constant propagation to determine a plurality of instructions of the application that invoke the at least one public API.

19. The non-transitory computer-readable medium of claim 14 , wherein when executed the program causes the at least one computing device to at least perform backward slicing to check an argument of the at least one public API.

20. The non-transitory computer-read

Assignees

• Xuan Chaoting
• Airwatch Llc

Inventors

• Xuan Chaoting

Classifications

• G06F21/629

  to features or functions of an application · CPC title

• G06F9/546 Primary

  Message passing systems or structures, e.g. queues · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F9/54

  Interprogram communication · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title