Malware detection system and method for mobile platforms

Abstract

In one example, a management server is configured to provide malware protection for one or more client mobile platforms in communication with the management server via a mobile network. In the example, the management server includes a processor configured to detect malware in the mobile network, select a client mobile platform having a malware scanning agent, and, manage the malware scanning agent of the client mobile platform using a device independent secure management protocol based at least in part on the malware detected in the mobile network.

Description

CROSS REFERENCE TO RELATED APPLICATIONS[0001]This application is a continuation of U.S. application Ser. No. 11 / 697,647, filed Apr. 6, 2007, which claims the benefit of U.S. application Ser. No. 60 / 789,766, filed Apr. 6, 2006; Ser. No. 60 / 789,748, filed Apr. 6, 2006; Ser. No. 60 / 789,749 filed Apr. 6, 2006; Ser. No. 60 / 789,746, filed Apr. 6, 2006; Ser. No. 60 / 789,744, filed Apr. 6, 2006; Ser. No. 60 / 789,745, filed Apr. 6, 2006; Ser. No. 60 / 789,743, filed Apr. 6, 2006; Ser. No. 60 / 789,958, filed Apr. 6, 2006; Ser. No. 60 / 824,649, filed Sep. 6, 2006; and Ser. No. 60 / 828,491, filed Oct. 6, 2006, the entire content of each of which is incorporated herein by reference.TECHNICAL FIELD[0002]The present invention relates generally to systems, devices, and methods for detecting malware in mobile networks and mobile devices.BACKGROUND OF THE INVENTION[0003]Traditional malware signature detection methods extract signatures from an invariant portion of the actual executable part of a target appl...

AI Technical Summary

Benefits of technology

The present invention is a system and method for detecting and reporting malware on mobile platforms. It uses various techniques such as malware signature detection, hash matching, and feature based analysis to identify malicious software. The system is efficient and adaptable to mobile platforms, as it requires minimal memory and computational resources. It also allows service providers to update malware protection on mobile platforms, ensuring timely and secure management of mobile networks. Overall, the invention provides a comprehensive solution for identifying and managing malware on mobile platforms.

Problems solved by technology

However, these detection methods present numerous problems when implemented in mobile networks and on mobile platforms.

Therefore, while scanning for malware, it is not possible to obtain the entire data corresponding to a malicious application because the malicious application may exist across multiple packages in a compressed format.

Also, it is cumbersome and time consuming to attempt to re-assemble and uncompress such data packets as they pass through the mobile network due to the latency these operations would introduce.

Also, comprehensive signature matching as a virus or malware detection method on memory-constrained devices, like mobile phones, is difficult to efficiently implement due to the need for a large database of identified malware signatures.

String matching is also processor intensive and results in a high computational tax on a mobile device wherein such mobile platforms have relatively low processing power such that large processing and memory requirements results in lowered performance and excessive battery drain.

Therefore, it is difficult to determine which file to scan for malware.

Malware checking using signatures is often processor and memory intensive.

Therefore, some of the best and most advanced programs for detecting malware are usually running at network operations centers and may not be available for running on mobile handsets.

Access to the binary code in other devices may also be limited due to constraints such as power, permissioning, or other limitations.

Therefore, one cannot always apply the traditional binary, signature-based methods of scanning binary code to detect malware in such devices.

Even though each new malware variant tends to perform the same or similar kind of malicious behavior, traditional signature detection can only detect a new malware variant by adding a new signature to its list and scanning for the new signature.

Mobile devices however are limited in both storage space and computational ability, thus making them difficult platforms for using existing methods of malware detection that were designed for more robust computing platforms such as desktop and laptop systems.

In the interim, however, their systems remain vulnerable to the new malware.

Images