Fireeye, Inc.

Dawn Song

Osman Abdoul Ismael

Ashar Aziz

Hui Xue

Noah M Johnson

Phung-Te Ha

Adrian Matthew Mettler

Peter J Gilbert

Prashanth Mohan

Prshanth Mohan

A method is described that includes receiving an application and generating a representation of the application that describes specific states of the application and specific state transitions of the application. The method further includes identifying a region of interest of the application based on rules and observations of the application's execution. The method further includes determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest. The method further includes enabling one or more monitors within the application's run time environment and applying the stimuli. The method further includes generating monitoring information from the one or more monitors. The method further includes applying rules to the monitoring information to determine a next set of stimuli to be applied to the application in pursuit of determining whether the region of interest corresponds to improperly behaving code.

Framework for efficient security coverage of mobile software applications

A method for hardening in the field code of mobile software applications is described that includes receiving, by a cloud service framework, an application via a user interface over a network. The method also includes generating, by the cloud service framework, a representation of the code of the application and determining, by the cloud service framework, changes to code of the application based at least in part on the representation, wherein the changes to the code preclude the application from performing one or more unwanted behaviors. The method also includes instrumenting, by a static instrumentation unit within the cloud service framework, the application with the changes to the code to create an instrumented application that does not perform the one or more unwanted behaviors.

Security cloud service framework for hardening in the field code of mobile software applications

A method is described that includes receiving an application and creating a representation of the application that describes states and state transitions of the application. The method further includes receiving a description of unwanted behaviors of the application. The method further includes using the description and the representation to determine actions to be added to the application and locations within the application where the actions are to be performed. The method also includes instrumenting the application with the actions in the locations to create an instrumented application that does not perform the unwanted behaviors.

Framework for efficient security coverage of mobile software applications that is usable to harden in the field code

For one embodiment, a method is described that involves the instrumenting of an application of a computing system with at least one monitoring function, where the monitoring function is capable of operating in a run-time environment during processing of the instrumented application. The movement of data associated with the application is tracked by one or more monitoring functions. This data is at least partially identified by a storage location. Thereafter, a determination is made whether movement of the data from a first storage location to a second storage location is suspicious, and if so, suspicious movement of the data is reported.

Framework for efficient security coverage of mobile software applications using machine learning

A method is described that involves receiving an application and generating a representation of the application that describes states of the application and transitions between the states. The method further includes referring to one or more rules and/or information from an inference engine that is observing the application's run time behavior to identify a region of interest within the application and reaching the region of interest by performing the following: identifying a path from the application's present state to the region of interest; representing states of the application along the path as logic expressions; solving the expressions to generate solutions to the expressions; causing stimuli to be provided to the application, where the stimuli correspond to the solutions.

Framework for efficient security coverage of mobile software applications using symbolic execution to reach regions of interest within an application

A method is described that includes operations for receiving an application, identifying a region of interest of the application based on rules or analysis of the application, and determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest. Thereafter, the stimuli is applied to the application. One or more behaviors of the application are monitored by a central intelligence engine during virtual execution of the application in response to the applied stimuli to determine whether the one or more behaviors identify that the region of interest corresponds to improperly behaving code.

Framework for iterative analysis of mobile software applications

A method is described that involves generating one or more machine learned rules with a machine learning system. The method also involves generating a representation of an application that describes various states and state transitions of the application. The method also involves referring to the one or more machine learned rules and the representation to identify a region of interest of the application. The method also involves configuring one or more monitors for the application to be enabled in a run time environment of the application. The method also involves setting conditions of the application within the run time environment to drive the application's execution to the region of interest. The method also involves observing behaviors of the application and determining whether the region of interest corresponds to improperly behaving code.

Framework for computer application analysis of sensitive information tracking

A method is described that includes generating a representation of an application that describes specific states of the application and specific state transitions of the application. The method also includes identifying a region of interest of the application based on rules and observations of the application's execution. The method also includes determining specific stimuli that will cause one or more state transitions within the application to reach said region of interest. The method also includes enabling one or more monitors within the application's run time environment and applying the stimuli within the application's run time environment, where, the application's run time environment is existing on a mobile device that the application is installed on. The method also includes generating monitoring information from said one or more monitors. The method also includes applying rules to the monitoring information to determine a next set of stimuli to be applied to the application in pursuit of determining whether the region of interest corresponds to improperly behaving code.

Growing community of inventors

San Francisco, CA, United States of America

Dawn Song