APPLICATION ANALYSIS SYSTEM FOR ELECTRONIC DEVICES

• US 20150332043A1
• Filed: 04/22/2015
• Published: 11/19/2015
• Est. Priority Date: 05/15/2014
• Status: Abandoned Application

• Current Assignee: Auckland UniServices Limited (Auckland University)
• Original Assignee: Auckland UniServices Limited (Auckland University)
• Inventors: Russello, Giovanni
• Application Number:
  US14/693,038
• Publication Number:
  US 20150332043A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 9/44 Arrangements for executing specific programs

Abstract

An analysis system for analysing applications executing on a target device. The system comprises an analysis agent operating on the target device that is configured to receive or retrieve information indicative of system call invocations initiated by applications during execution. The system also comprises an analysis device in data communication with the target device over a data communication link that is configured to receive the information from the analysis agent of the target device over the data communication link. The analysis device comprises an analysis graphical user interface (GUI) that is configured to display the received information for viewing and/or interaction by a user.

Claims

1. An analysis system for analysing applications executing on a target device, the system comprising:

an analysis agent operating on the target device that is configured to receive or retrieve information indicative of system call invocations initiated by applications during execution; and

an analysis device in data communication with the target device over a data communication link that is configured to receive the information from the analysis agent of the target device over the data communication link, and wherein the analysis device comprises an analysis graphical user interface (GUI) that is configured to display the received information for viewing and/or interaction by a user.

2. The analysis system according to claim 1 wherein the target device further comprises a monitoring entity associated with each executing application, wherein each monitoring entity is configured to detect, directly or indirectly, system call invocations made by the associated executing application.

3. The analysis system according to claim 2 wherein each monitoring entity is configured to detect system calls by intercepting the system calls to a kernel of an operating system of the target device.

4. The analysis system according to claim 2 wherein each monitoring entity is configured to detect system calls by intercepting shared or dynamic library symbol invocations that are intended to invoke one or more system calls to the kernel of an operating system of the target device.

5. The analysis system according to claim 2 wherein each monitoring entity forwards, directly or indirectly, system call invocations to the analysis agent of the target device.

6. The analysis system according to claim 5 wherein each monitoring entity comprises an associated profiler that is configured to retrieve or receive information indicative of the system call invocations detected by its associated monitoring entity and forwarding that information to the analysis agent.

7. The analysis system according to claim 6 wherein the profilers of the target device are configured to send or receive information to or from the analysis agent over an Inter Process Communication channel (IPC).

8. The analysis system according to claim 6 wherein each monitoring entity is configured to stall or pause execution of its associated application on detection of a system call invocation, and await a security decision for enforcement, the security decision being an instruction on how to handle the execution of the detected system call invocation.

9. The analysis system according to claim 8 wherein the security decision is any one of the following:

allow the system call to execute, deny the system call from executing, modifying the system call, or kill the application execution.

10. The analysis system according to claim 8 wherein the analysis agent of the target device is configured to forward the information indicative of the detected system call invocation(s) to the analysis device and a security decision is generated for the analysis agent based on user input into the GUI of the analysis device, the generated security decision being sent back to the analysis agent which is configured to forward the decision to the relevant monitoring entity, via its respective profiler, for enforcement.

11. The analysis system according to claim 10 wherein the security decisions made on the analysis device are stored in a security policy file.

12. The analysis system according to claim 6 wherein the monitoring entities are components of a security system in which the monitoring entities enforce security decisions in response to detected system call invocations based on a security policy or policies accessible by the security system.

13. The analysis system according to claim 12 wherein each monitoring entity is configured to retrieve and enforce the security decision for a detected system call invocation based on the security policy or policies of the security system, and then forward information indicative of the detected system call invocation and enforced security decisions to the analysis agent via its respective profiler, wherein the analysis agent is configured to forward the information to the analysis device for analysis by a user via the GUI of the analysis device.

14. The analysis system according to claim 6 wherein the analysis agent of the target device is configured to store information received from the profilers in a buffer prior to sending it to the analysis device.

15. The analysis system according to claim 14 wherein the analysis agent of the target device streams or sends the stored buffered information to the analysis device upon receiving a request instruction from the analysis device over the data communication link.

16. The analysis system according to claim 1 wherein the analysis agent of the target device is configured to commence receiving or retrieving information indicative of system call invocations made by applications executing on the target device in response to receiving a start instruction from the analysis device over the data communication link.

17. The analysis system according to claim 1 wherein the analysis agent of the target device is configured to cease receiving or retrieving information indicative of the system call invocations in response to receiving a stop instruction from the analysis device over the data communication link.

18. The analysis system according to claim 1 wherein the target device is a programmable device with an operating system capable of executing applications, and the analysis device is a programmable device with an associated display for the analysis GUI and user input device or devices.

19. The analysis system according to claim 1 wherein the target device comprises a Linux-based kernel and a system architecture defined by a Linux layer associated with the kernel and the higher application layer comprising applications.

20. The analysis system according to claim 1 wherein the target device comprises architecture comprising a kernel space and user space, wherein the kernel space comprises a Unix-like kernel and the user space comprises the applications.

21. A method of analysing applications executing on a target device via an analysis graphical user interface (GUI) displayed on an analysis device in data communication with the target device over a data communication link, comprising:

sending a request instruction over the data communication link to an analysis agent of the target device to request information indicative of the system call invocations initiated by the applications during execution;

receiving at the analysis device the requested information from the analysis agent over the data communication link; and

displaying the requested information to a user on the analysis GUI.

22. A method according to claim 21 wherein the method further comprises generating a start instruction for the analysis agent on the target device to initiate the analysis agent to receive or retrieve information indicative of detected system call invocations initiated by applications during execution.

23. A method according to claim 22 wherein the start instruction is a command generated and sent to the analysis agent over the data communication link.

24. A method according to claim 21 wherein the method further comprises generating a security decision for a detected system call invocation in response to user input, and sending the generated security decision to the analysis agent of the target device over data communication link for enforcing against the detected system call invocation.

25. A method according to claim 24 wherein the method further comprises storing each generated security decision in a security policy file or files to generate a customized security policy or policies for the target device.

26. A method according to claim 21 where in the method further comprises requesting information indicative of the security decisions enforced by a security system operating on the target device in response to detected system call invocations.

27. A method of analysing applications executing on a target device for an analysis graphical user interface (GUI) displayed on an analysis device in data communication with the target device over a data communication link, comprising:

receiving or retrieving at the target device, directly or indirectly, information indicative of detected system call invocations initiated by applications during execution from monitoring entities associated with each executing application;

receiving at the target device a request instruction over the data communication link from the analysis device for the information indicative of the system call invocations initiated by the applications during execution; and

sending the requested information to the analysis device over the data communication link.

28. A method according to claim 27 wherein the method further comprises receiving or retrieving information indicative of system call invocations initiated by applications during execution in response to receiving a start instruction.

29. A method according to claim 27 further comprising halting operation of an application on detection of a system call invocation and awaiting a security decision on how to handle the execution of the detected system call invocation.

30. A method according to claim 29 comprising receiving the security decision from the analysis device over the data communication link, and sending the received security decision to the monitoring entity associated with the halted application to which the security decision relates for enforcement.

31. A method according to claim 29 wherein the method comprises generating the security decision based on a security policy or policies linked to the application, and sending the generated security decision to the monitoring entity associated with the halted application to which the security decision relates for enforcement.

32. A method according to claim 31 wherein the method further comprises sending information indicative of the generated security decisions for detected system call invocations to the analysis device over the data communication link together with the information indicative of the detected system call invocations.