System and method for Anti-virus scanning of objects on mobile device

Abstract

The invention discloses a system and a method for anti-virus scanning of an object on a mobile device. In one aspect, an exemplary method includes receiving, by a security module, a command from a protection module of a third-party application to perform an anti-virus scan; when the mobile security application program is installed or pre-installed, if the mobile security application program is not activated, activating the mobile security application program; when the mobile security application program is not installed or pre-installed on the mobile equipment, installing and activating the mobile security application program; sending an object to the mobile security application; performing an anti-virus scan on the object to determine whether the object is malicious; sending an anti-virus scanning result to a protection module of a third-party application program; selecting at least one response measure based on a result of the anti-virus scan; and applying the selected at least one response measure.

Description

Technical Field

[0001] The present invention relates to the field of information security, and more particularly, to a system and method for ensuring the security of an application on a mobile device by performing an anti-virus scan on an object on the mobile device. Background Art

[0002] Today, mobile computing devices (hereinafter referred to as mobile devices) have become an integral part of people's (users') lives. Typically, most mobile devices contain a variety of user data that people need for their daily lives. Such data can be personal data (such as last name, first name, patronymic, year of birth, phone number, photos, and videos), and / or confidential data (such as login name and password for personal accounts on banking websites, or credit card numbers).

[0003] One of the most popular mobile platforms used on mobile devices is the Google Android operating system (hereinafter referred to as Android OS). First of all, Android OS is popular because it is open source and free, which has led to its distribution on various hardware platforms and the creation of a large number of different applications for the operating system. So far, millions of applications have been created for Android OS, which have been installed on more than 2 billion mobile devices worldwide. At the same time, malware targeting mobile devices using Android has become increasingly active. Malware targeting mobile devices refers to any software (hereinafter referred to as "software") that contains malicious code and / or is designed to gain unauthorized access to the computing resources of a mobile device or information stored on the mobile device, with the purpose of using the resources without permission or causing harm to the mobile device owner by copying, distorting, deleting or replacing information. In particular, information refers to personal and confidential data of the mobile device owner. Examples of unauthorized use of mobile device resources include the intention to make unauthorized payments, send messages containing spam, and call premium numbers. Since applications installed on mobile devices may access sensitive user data in one way or another, it becomes very important to protect mobile devices and their applications from malware.

[0004] One of the solutions to ensure the security of mobile devices is to use dedicated applications, namely mobile security applications. A mobile security application is an application designed to detect malware and, depending on the implementation, has different methods for performing antivirus scans on objects on the mobile device. Mobile security applications tend to have a high load on the resources of the mobile device, affecting the mobile device in the process of achieving their purpose. In particular, a large amount of permanent memory is required to install the application itself and the local database, as well as to use RAM during operation. As a result, it becomes difficult to operate other applications on the mobile device as well as the mobile device itself as a whole.

[0005] Another disadvantage of mobile security applications is the limitations associated with the OS architecture of mobile devices (Android and iOS). In these operating systems, each application runs in an isolated environment and can only access its own virtual memory.

[0006] Through the analysis of the existing technologies, it can be concluded that the current use of technologies is not effective enough in ensuring the security of mobile applications, especially in achieving antivirus scanning of objects on mobile devices at an acceptable level of resource consumption of the mobile device.

[0007] Therefore, there is a need for a method and system that allows both ensuring the security of mobile applications and reducing the load on resources on the mobile device. Summary of the invention

[0008] Aspects of the present invention relate to systems and methods for implementing security for applications on mobile devices while reducing the load on the resources of the mobile device. Security for mobile device applications is implemented by performing anti-virus scanning on objects on the mobile device.

[0009] In one exemplary aspect, a method for performing an antivirus scan on an object on a mobile device is disclosed, the method comprising: receiving, by a security module, a command from a protection module of a third-party application to use the security module to perform an antivirus scan on the object; checking, by the security module, whether a mobile security application has been installed or pre-installed on the mobile device; determining, by the security module, whether the mobile security application has been activated when the mobile security application has been installed or pre-installed, and activating the mobile security application when the mobile security application has not been activated; installing and activating the mobile security application when the mobile security application has not been installed or pre-installed on the mobile device; sending, by the security module, the object to the mobile security application to perform an antivirus scan on the object; performing an antivirus scan on the object to determine whether the object is malicious; sending, by the security module, the result of the antivirus scan to the protection module of the third-party application; selecting, by the protection module, at least one response measure based on the result of the antivirus scan; and applying, by the security module, the selected at least one response measure.

[0010] In one aspect, the command to perform an antivirus scan on the object is obtained after detecting suspicious activity, and wherein the suspicious activity is associated with at least one object.

[0011] In one aspect, the suspicious activity is detected using a protection module that uses behavior blockers or dangerous application behavior patterns.

[0012] In one aspect, the command for performing an antivirus scan on the object includes at least the following information: a location of the object and a name of the object.

[0013] In one aspect, the objects for performing antivirus scanning include at least one of: files; links; message text; spam; and network packets.

[0014] In one aspect, activation and installation of the mobile security application is performed in one of the following ways: by providing a request to the user of the mobile device; according to a group policy of the mobile device; and in an automatic mode when installing the third-party application.

[0015] In one aspect, antivirus scanning of the object is performed using at least one of: interaction with a cloud security service; and a database located in the mobile security application.

[0016] In one aspect, the at least one response measure is intended to ensure the security of the third-party application on the mobile device and includes at least one of the following: removing the malicious object; changing access permissions to the malicious object; placing the malicious object in a spam category; alerting the user of the presence of the malicious object on the mobile device; quarantining the malicious object; blocking incoming traffic by IP address; disconnecting the mobile device from the Internet; providing information support to the user of the mobile device when the malicious object is detected; changing the settings of the mobile security application on the mobile device; preventing clicking on phishing links; updating the operating system or rolling back the operating system of the mobile device to factory settings; and updating the third-party application to the latest version.

[0017] According to one aspect of the present invention, a system for performing antivirus scanning on an object on a mobile device is provided, the system comprising at least one memory; and at least one hardware processor, the at least one hardware processor being connected to the at least one memory and being configured individually or in combination to: receive, by a security module, a command from a protection module of a third-party application to use the security module to perform antivirus scanning on an object; check, by the security module, whether a mobile security application has been installed or preinstalled on the mobile device; determine, by the security module, whether the mobile security application has been activated when the mobile security application has been installed or preinstalled, and activate the mobile security application when the mobile security application has not been activated; install and activate the mobile security application when the mobile security application has not been installed or preinstalled on the mobile device; send, by the security module, the object to the mobile security application to perform antivirus scanning on the object; perform antivirus scanning on the object to determine whether the object is malicious; send, by the security module, the result of the antivirus scanning to the protection module of the third-party application; select, by the protection module, at least one response measure based on the result of the antivirus scanning; and apply, by the security module, the selected at least one response measure.

[0018] In one exemplary aspect, a non-transitory computer-readable medium is provided on which a set of instructions for performing an antivirus scan on an object on a mobile device is stored, the set of instructions including instructions for the following operations: receiving, by a security module, a command from a protection module of a third-party application to use the security module to perform an antivirus scan on an object; checking, by the security module, whether a mobile security application has been installed or pre-installed on the mobile device; determining, when the mobile security application has been installed or pre-installed, whether the mobile security application has been activated, and activating the mobile security application when the mobile security application has not been activated; installing and activating the mobile security application when the mobile security application has not been installed or pre-installed on the mobile device; sending, by the security module, the object to the mobile security application to perform an antivirus scan on the object; performing an antivirus scan on the object to determine whether the object is malicious; sending, by the security module, the result of the antivirus scan to the protection module of the third-party application; selecting, by the protection module, at least one response measure based on the result of the antivirus scan; and applying, by the security module, at least one selected response measure.

[0019] The technical result of the method is to improve the security of information from third-party applications on the mobile device. The technical result is achieved by the system of the present invention, which is designed to ensure the security of applications on the mobile device. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate one or more example aspects of the invention and, together with the detailed description, serve to explain the principles and implementations of these example aspects.

[0021] Figure 1 A block diagram of an exemplary application security system for antivirus scanning of objects on a mobile device according to aspects of the present invention is shown.

[0022] Figure 2 An example of a method for anti-virus scanning an object on a mobile device according to aspects of the present invention is shown.

[0023] Figure 3 An example implementation of a method for performing antivirus scanning on an object on a mobile device according to aspects of the present invention is shown.

[0024] Figure 4 An example is presented of a general purpose computer system on which aspects of the present invention for antivirus scanning of objects on a mobile device may be implemented. DETAILED DESCRIPTION

[0025] Various exemplary aspects are described herein in the context of systems, methods, and computer programs for performing antivirus scanning on objects on a mobile device according to various aspects of the present invention. One of ordinary skill in the art will recognize that the following description is merely illustrative and is not intended to be limiting in any way. Other aspects can be readily imagined by those skilled in the art, with the benefit of the disclosure of the present invention. Reference will now be made in detail to the implementation of the example aspects shown in the accompanying drawings. Throughout the drawings and the following description, the same reference numerals will refer to the same or similar items as much as possible.

[0026] In some aspects of the invention, some or all of the system for classifying objects to prevent the spread of malicious activity may be implemented on a general purpose computer (e.g., Figure 4 The system is implemented on a processor of a general-purpose computer (shown in FIG. 1 ). In this case, the components of the system may be implemented in a single computing device, or may be distributed among multiple interconnected computing devices. The present invention describes a technical solution for performing antivirus scanning on an object on a mobile device.

[0027] The method of the present invention provides a technical solution for ensuring the overall security of mobile applications and mobile devices by using a security module in a third-party application. At the same time, the method of the present invention allows reducing the load on mobile device resources while achieving the security of the mobile device.

[0028] Figure 1 A block diagram of an exemplary application security system for antivirus scanning of objects on a mobile device according to aspects of the present invention is shown.

[0029] In a preferred aspect, the application security system 105 is implemented on the mobile device 102 and includes at least one third-party application 110 and a mobile security application 140 including a database 145. The third-party application 110 further includes a protection module 115 and a security module 120, wherein the security module 120 is composed of a scanner 125, an analysis module 130, an execution module 135, and a database 150. It is worth noting that the security module 120 is an embedded component within the third-party application 110 and is designed to provide protection against malicious activities by the third-party application 110. Depending on the implementation, the security module 120 can be an integral part of the third-party application 110 or an independent module embedded in the third-party application 110.

[0030] Mobile device 102 includes at least a computing device, such as a smartphone, a tablet computer, a smart watch, a handheld game console, a personal navigation device, and a data receiving terminal. Another example of a computing device is Figure 4 The computer system shown.

[0031] Third-party applications 110 include third-party software designed to work on smartphones, tablets, and other mobile devices that are developed for specific platforms (Android, Windows Phone, iOS, etc.) but are not used for antivirus scanning of objects.

[0032] The protection module 115 located in the third-party application 110 is designed to monitor the activities of the third-party application 110 in order to detect suspicious activities and objects related to the detected suspicious activities.

[0033] The objects include in particular objects such as:

[0034] -document;

[0035] -reference;

[0036] -Message text;

[0037] - spam; or

[0038] -Network packets.

[0039] Examples of activities are activities such as: downloading a file, opening a file, or clicking a link.

[0040] In one aspect, the protection module 115 monitors the activity of the third-party application 110 using a behavior blocker or dangerous application behavior patterns. For example, if the activity of the third-party application 110 matches one of the dangerous behavior patterns, or if suspicious activity is detected, the protection module 115 detects such activity as suspicious, detects at least one object associated with the specified activity, and prohibits further action on the detected object by applying a block. It is worth noting that when implementing the third-party application 110, the protection module 115 can use other methods known in the art to control the activity of the third-party application 110. Next, the protection module 115 sends a command to the security module 120 to perform an antivirus scan on the detected object associated with the suspicious activity. The command for performing an object scan includes at least the following information: the location of the object (e.g., the path of a file) and the name of the object.

[0041] The following are examples of protection modules 115 implemented in various third-party applications 110 .

[0042] In one aspect, in a third-party application 110, for example, in a banking application provided by a financial institution for remote interaction, the protection module 115 is responsible for monitoring transactions by identifying the program that initiates the transaction execution, the URL that the transaction accepts, and applying filters (e.g., authenticator filters, stop list filters, authorization restriction filters) to prevent unauthorized access to customer data (e.g., credit card data on the mobile device 102). For example, Trojan-Banker.AndroidOS.Faketoken may cause unauthorized access to credit card data. The Trojan displays a fake form for collecting credit card data on the banking (third-party) application 110, thereby stealing credit card data (i.e., card number, PIN, CVV). Among other things, Trojan-Banker.AndroidOS.Faketoken also intercepts all incoming SMS passwords on the mobile device 102 and sends them to the attacker's server. If the Trojan horse program is suspected of intercepting data, the protection module 115 on the mobile device 102 intercepts the suspicious activity and sends at least one command to the security module 120 to perform an antivirus scan on the object of the application file whose window is currently active and is determined to be associated with the suspicious activity. The security module 120 requests permission from the third-party application 110 to perform its functions in the third-party application 110.

[0043] On the other hand, in the third-party application 110, such as in an instant messaging software, the protection module 115 is responsible for monitoring spam and attached links for phishing in incoming messages, and analyzing downloaded files to determine maliciousness. In the case of detecting spam, phishing, or malicious objects (files), the protection module 115 intercepts suspicious activities and sends at least one command to the security module 120 to perform antivirus scanning of spam, phishing links, or file objects associated with the suspicious activities. The security module 120 requests permission from the third-party application 110 to perform its functions in the third-party application 110. Before the security module 120 performs an antivirus scan on the object, the protection module 115 can remove all personal data from the message, such as mentioned names, email addresses, and other personal data.

[0044] The security module 120, as a component of the third-party application 110, is designed to perform antivirus scanning on objects corresponding to commands received from the protection module 115 to identify malicious objects. Compared with the mobile security application 140, the security module 120 has limited functions and capabilities for antivirus scanning of objects. For example, the security module 120 may have only one of the following types of scans, and each type of scan may have limited implementation: a scan without the ability to simulate a file or run in a restricted environment (sandbox); a scan with a limited size of a database for checking hashes and or digital signatures of files; and the functionality of the security module 120 is limited to scans using executable files assembled without using a program (e.g., an executable packager). An executable packager refers to a program for reducing the size of an executable file. When a packager is used, a compressed copy of the original file and a program for decompression are written to the packaged file. Due to limited functions and capabilities, the security module 120 requires less CPU and RAM resources than the mobile security application 140. In yet another aspect, the security module 120 only has the ability to search for and / or install on the mobile device 102 an application (eg, the mobile security application 140 ) that is designed to perform anti-virus security scans.

[0045] Upon receiving an object associated with suspicious activity, in order to perform an antivirus scan, the security module 120 uses the scanner 125 to scan for the presence of the mobile security application 140. The scanner 125 verifies that the mobile security application 140 is installed or pre-installed on the mobile device 102 by calling an application programming interface (API) function set and by:

[0046] When the mobile security application 140 is installed or pre-installed on the mobile device 102, checking whether the mobile security application 140 is activated, and activating the installed or pre-installed mobile security application 140 when the installed or pre-installed application is not activated; and

[0047] When the mobile security application 140 is not installed or pre-installed from the mobile device 102, installing and activating the mobile security application 140.

[0048] The scanner 125, when detecting a mobile security application 140 that has been installed or pre-installed but not activated, notifies the security module 120 that the detected mobile security application 140 should be activated. The security module 120 activates the mobile security application 140 by interacting with the user of the mobile device 102, or if the security module 120 has appropriate permissions on the mobile device 102, the security module 120 automatically activates the mobile security application 140. For example, the security module 120 may send a request to the user, wherein the request contains information about the existence of the mobile security application 140 installed on the mobile device 102 and whether it needs to be activated and waits for an activation response. The request is sent to the user using a data input / output interface. Once the mobile security application 140 is activated, the security module 120 communicates with the activated mobile security application 140. On the other hand, the security module 120 starts the activation process of the security application 140 by making the window of the security application 140 active, so that the user can perform all necessary actions for activation (e.g., input an activation code, read a license agreement, etc.).

[0049] In the absence of the mobile security application 140, the scanner 125 notifies the security module 120 to install and activate the mobile security application 140. In one aspect of the present invention, the installation of the mobile security application 140 is completed by prompting the user of the mobile device 102. The scanner 125 detects the available application store 155 through the network 103 and sends a request to the user of the mobile device 102 to install the mobile security application 140. The specific application store 155 depends on the OS type of the mobile device 102, which is Google Play, RuStore, Samsung Galaxy store, Xiaomi Mi GetApps, etc. for Android, and App Store, etc. for iOS. In one aspect, the request to install the mobile security application 140 can be implemented using a mailbox and SMS message on the mobile device 102. For example, the security module 120 can send an email or SMS message containing a link to the application storefront of the mobile security application 140, or the mobile security application 140 can be sent as an attachment. In the event that the secure mobile application 140 does not exist in the application store 155, or no application store 155 is available for the mobile device 102, the request may contain permission to install the mobile security application 140 from the Internet (e.g., for Android, this would be a link to the APK file). Once the mobile security application 140 is installed, activation is performed in one of the previously listed ways.

[0050] In one aspect, the installation and activation of the mobile security application 140 is performed according to the group policy of the mobile device 102. The mobile device group policy should be understood as a set of settings for managing mobile devices that are part of a management group and the mobile applications installed on the devices. For example, in a corporate or local network, a series of mobile applications are installed and activated on the mobile device 102 according to the group policy. This installation and activation occurs after the mobile device is turned on, restarted, or updated.

[0051] On the other hand, the installation and activation of the mobile security application 140 can be performed automatically. For example, when the third-party application 110 is installed, the mobile security application 140 is additionally installed on the mobile device 102 by default.

[0052] In the event that the mobile security application 140 is not installed on the mobile device 102 or is installed but not activated and there is no option to activate, the security module 120 uses the analysis module 130 to perform an inspection on the object itself.

[0053] In this way, to perform the check, the security module 120 sends the object to:

[0054] - Mobile security application 140, when the mobile security application 140 is installed and activated on the mobile device 102; and

[0055] - Analysis module 130 , in case the mobile security application 140 is not installed or is installed but not activated and there is no activation option on the mobile device 102 .

[0056] In a preferred aspect, the security module 120 passes the scan object to the mobile security application 140. The mobile security application 140 performs an antivirus scan of the object to determine whether it corresponds to a malicious object. Malicious objects include objects created with the help of malicious code that is designed to gain unauthorized access to information or resources of the user's device, particularly the mobile device 102. An example of a mobile security application 140 is Kaspersky Lab's Kaspersky Total Security product, particularly for mobile devices.

[0057] Compared to the security module 120, the mobile security application 140 is not limited in its ability to perform antivirus scanning on objects, and also has access to the cloud security service 160. Depending on the implementation options, the inspection of the object is performed by the mobile security application 140 itself or by the cloud security service 160, and may include signature-based scanning or heuristic scanning of information about object code fragments, the use of behavioral analyzers, and the use of online services and sandboxes for analyzing suspicious files. In a preferred aspect, the mobile security application 140 performs antivirus scanning on objects using the cloud security service 160 (e.g., Kaspersky Security Network) through the network 103.

[0058] In another aspect, the mobile security application 140 uses the database 145 to perform checks on the object. In one aspect, the database 145 stores at least signatures, heuristics, and file hashes. The mobile security application 140 uses the database 145 to check the object including the signature and heuristic scanning (analysis) of the code of the object, the use of a behavioral analyzer. The scan results of the object are sent by the mobile security application 140 to the protection module 115 using the security module 120.

[0059] As previously described, in the case where the mobile security application 140 is not installed or is installed but not activated on the mobile device 102, the security module 120 performs a check on the object using the analysis module 130 and the database 150. The analysis module 130 performs a check on the object using the signature from the database 150. The result of the object check is sent by the analysis module 130 to the protection module 115.

[0060] In one particular aspect of the present invention, the security module 120 further checks the permissions in the third-party application 110 to perform a self-check of the object. For example, the security module 120 may be embedded in a third-party "mobile game" application 110 and may not have sufficient permissions. For example, the security module 120 may not have permissions to access components such as speakers, contacts, calendars, device locations, messages on the device, Wi-Fi connection data, etc. Therefore, the inspection of the objects of the third-party application 110 by the analysis module 130 in the security module 120 may be incomplete or impossible due to insufficient permissions. In another example, the security module 120 may be located in a third-party application 110 with system-level preferences. Therefore, on the mobile device 102, the security module 120 may have a sufficient number of permissions because the system application has the right to access the entire mobile device without restriction. The analysis module 130 independently checks the objects of the third-party application 110. The results of the object inspection are sent by the analysis module 130 to the protection module 115.

[0061] Based on the test results obtained from the security module 120, the protection module 115 selects a response measure, if necessary. A series of exemplary measures are given below.

[0062] The response measures selected by the protection module 115 to protect the third-party application 110 of the mobile device 102 include at least one of the following:

[0063] -Remove malicious objects;

[0064] -Change access permissions to malicious objects;

[0065] - Place malicious objects in the spam category;

[0066] - warn the user of the presence of a malicious object on the mobile device 102;

[0067] -Isolate malicious objects;

[0068] -Block incoming traffic by IP address;

[0069] - disconnecting the mobile device 102 from the Internet;

[0070] - providing information support to the user of the mobile device 102 when a malicious object is detected;

[0071] - changing the settings of the mobile security application on the mobile device 102;

[0072] - Block clicks on phishing links;

[0073] - Updating the operating system or rolling back the mobile device 102 to factory settings; and

[0074] -Update third-party applications 110 to the latest version.

[0075] The protection module 115 sends a command to the security module 120 to execute one or more selected response measures. The security module 120 uses the execution module 135 to execute the response measures selected by the protection module 115. For example, the scanning results may reveal a malicious object - a phishing link in an SMS message; then, the protection module 115 may select the following responses: alert the user of the mobile device 102 that the phishing link exists, and prevent the phishing link from being clicked.

[0076] In one aspect, based on the inspection of the results of the analysis module 130 , the execution module 135 can immediately apply a response measure.

[0077] Table 1 provides an example of response measures stored in database 150 for use when an antivirus scan identifies a relevant malicious object.

[0078] Table 1

[0079]

[0080] Figure 2 An example of a method 200 for performing antivirus scanning on an object on a mobile device according to aspects of the present invention is shown. In one aspect, the method 200 is performed using a combination of Figure 1 A description is provided of an application implemented by the security system 105.

[0081] In step 205, method 200 monitors the activity of third party application 110 by protection module 115 to detect suspicious activity and one or more objects associated with the detected suspicious activity. Examples of suspicious activity are downloading files from unknown IP addresses, receiving messages from unknown senders, and the like.

[0082] In step 210, the method 200 sends a command to the security module 120 via the protection module 115 to perform an antivirus scan on the object detected to be associated with suspicious activity. In one aspect, the command for performing an antivirus scan on the object includes at least the following information: the location of the object (e.g., the path of the file) and the name of the object.

[0083] In step 220, after the security module 120 is instructed by the scanner 125 to perform an antivirus scan on the identified object associated with suspicious activity, the method 200 performs a scan on the object to determine the presence of the mobile security application 140. The scanner 125 verifies that the mobile security application 140 is installed or pre-installed on the mobile device by calling the necessary API functions. If the scanner 125 detects that the mobile security application 140 is installed or pre-installed, the method 200 proceeds to step 230. In the event that the mobile security application 140 does not exist on the mobile device 102, the method 200 proceeds to step 240.

[0084] In step 230, the scanner 125 verifies whether the installed or pre-installed mobile security application 140 is activated. If the mobile security application 140 is not activated, the method 200 proceeds to step 250. In the event that the mobile security application 140 is activated, the method 200 proceeds to step 260.

[0085] In step 240, the scanner 125 notifies the security module 120 to install the mobile security application 140. In one aspect, the installation of the mobile security application 140 is accomplished by providing a request to the user of the mobile device 102. The method 200 uses the scanner 125 to locate an available application store 155 via the network 103 and sends a request to the user of the mobile device 102 to install the mobile security application 140. The request to install the mobile security application 140 is sent using a mailbox and an SMS message on the mobile device 102. With the help of the security module 120, the method 200 sends a letter or SMS message to the mailbox, which contains a link to a showcase of the mobile security application 140 or an attachment of the mobile security application 140. In the case where the mobile security application 140 does not exist in the application store 155, or in the case where the application store 155 does not exist on the mobile device 102, the request includes a request to authorize the installation of the mobile security application 140 from the Internet (for example, for Android, this would be a link to an APK file).

[0086] In step 250, the method 200 activates the mobile security application 140 by the security module 120 through user interaction with the mobile device 102, or automatically if the security module 120 has appropriate permissions on the mobile device 102. For example, the security module 120 can be used to send a request to the user, where the request contains information about the existence of the mobile security application 140 installed on the mobile device 102 and whether it needs to be activated and waits for an activation response. On the other hand, the security module 120 starts the activation process of the security application 140 by making the window of the security application 140 active, so that the user can perform all necessary actions for activation.

[0087] In one aspect, the installation and activation of the mobile security application 140 is performed according to a group policy of the mobile device 102. For example, in a company or local area network, a series of mobile applications are installed and activated on the mobile device 102 according to a group policy.

[0088] In another aspect, the installation and activation of the mobile security application 140 is performed automatically. For example, when the third-party application 110 is installed, the mobile security application 140 is additionally installed on the default mobile device 102.

[0089] In step 260, the method 200 sends the object to the mobile security application 140 through the security module 120 to perform an antivirus scan. The method 200 uses the mobile security application 140 to perform an antivirus scan on the object to determine whether it meets the requirements of a malicious object. A malicious object should be understood as an object created with the help of malicious code that is intended to gain unauthorized access to information or resources of a user's device, particularly the mobile device 102.

[0090] In step 270, an antivirus scan of the object is performed using the mobile security application 140. In a preferred aspect, the scan is performed by interacting with a cloud security service 160 (e.g., Kaspersky Security Network) via the network 103. In one aspect, the scan of the object using the cloud security service 160 includes signature-based scanning or heuristic scanning of information about the object code fragment, use of a behavioral analyzer, and use of an online service and sandbox to analyze suspicious files.

[0091] In another aspect, the mobile security application 140 performs object inspection using the database 145. The verification of the object by the mobile security application 140 using the database 145 includes, among other things, signature and heuristic scanning of information about the object code fragment, and the use of a behavioral analyzer.

[0092] In step 280, method 200 sends the test results to protection module 115 via security module 120 through mobile security application 140. With the help of protection module 115, a response measure is selected based on the results of the antivirus scan from security module 120, if necessary.

[0093] In step 290, method 200 sends a command to security module 120 via protection module 115 to execute the selected response measure. Security module 120 uses execution module 135 to execute the response measure selected by protection module 115. In a particular case of implementing method 200, the response measure is applied immediately based on the results of the scan.

[0094] Figure 3 An example implementation of a method 300 for antivirus scanning of an object on a mobile device according to aspects of the present invention is shown.

[0095] In one aspect, method 300 is performed using Figure 1 The security features of the application security system 105 shown are implemented, and the method 300 supplements the combination of Figure 2 The description presents method 200. Therefore, Figure 3 Steps 205, 210, 220, 230, 240, 250, 260 and 290 shown in Figure 2 The steps are the same as shown in .

[0096] In step 310, the method 300 verifies through the scanner 125 whether the mobile security application is installed in step 240. If the mobile security application 140 is installed, the method 300 proceeds to step 320. In the event that the mobile security application 140 is not installed on the mobile device 102, the method 300 proceeds to step 330.

[0097] In step 320, the method 300 verifies through the scanner 125 whether the mobile security application 140 is activated in step 250. In the case that the mobile security application 140 is not activated, the method 300 proceeds to step 330. In the case that the mobile security application 140 is activated, the method 300 proceeds to step 260.

[0098] In step 330, if the mobile security application 140 is not installed or is installed but not activated, and there is no option to activate the method 300, the analysis module 130 performs an antivirus scan on the mobile device 102 using the signatures from the database 150. In the event that the mobile security application 140 is successfully activated, see Figure 2 Description of step 270 in FIG.

[0099] In step 340, the method 300 sends the scan results to the protection module 115 via the security module 120, by the component that performed the antivirus scan in step 330 (i.e., the mobile security application 140 or the analysis module 130). With the help of the protection module 115, a response measure is selected based on the results of the antivirus scan from the security module 120, if necessary.

[0100] Figure 4 is a block diagram illustrating a computer system 20 on which aspects of the system and method for performing antivirus scanning of objects on a mobile device may be implemented. The computer system 20 may be in the form of multiple computing devices, or may be in the form of a single computing device, such as a desktop computer, a laptop computer, a handheld computer, a mobile computing device, a smartphone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

[0101] As shown, computer system 20 includes a central processing unit (CPU) 21, a system memory 22, and a system bus 23 connecting various system components, including a memory associated with the central processing unit 21. The system bus 23 may include a bus memory or a bus memory controller, a peripheral bus, and a local bus capable of interacting with any other bus architecture. Examples of buses may include PCI, ISA, PCI-Express, HyperTransport, and the like. TM (HyperTransport TM ), unlimited bandwidth TM (InfiniBand TM ), Serial ATA, I 2 C, and other suitable interconnections. The central processing unit 21 (also referred to as a processor) may include a single or multiple groups of processors having a single core or multiple cores. The processor 21 may execute one or more computer executable codes that implement the technology of the present invention. The system memory 22 may be any memory for storing data used herein and / or computer programs executable by the processor 21. The system memory 22 may include volatile memory (such as random access memory (Random Access Memory, RAM) 25) and non-volatile memory (such as read-only memory (Read-Only Memory, ROM) 24, flash memory, etc.) or any combination thereof. The basic input / output system (Basic Input / Output System, BIOS) 26 may store basic programs for transmitting information between elements of the computer system 20, such as those basic programs when the operating system is loaded using ROM 24.

[0102] The computer system 20 may include one or more storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or a combination thereof. The one or more removable storage devices 27 and the one or more non-removable storage devices 28 are connected to the system bus 23 via a memory interface 32. In one aspect, the storage devices and corresponding computer-readable storage media are power-independent modules for storing computer instructions, data structures, program modules, and other data of the computer system 20. The system memory 22, the removable storage devices 27, and the non-removable storage devices 28 may use a variety of computer-readable storage media. Examples of computer-readable storage media include: machine memory, such as cache, SRAM, DRAM, zero-capacitor RAM, two-transistor RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other storage technology, such as in a Solid State Drive (SSD) or a flash drive; magnetic cassettes, tapes, and disk storage, such as in a hard drive or floppy disk; optical storage, such as in a compact disk (CD-ROM) or a digital versatile disk (DVD); and any other medium that can be used to store the desired data and can be accessed by the computer system 20.

[0103] The system memory 22, removable storage device 27 and non-removable storage device 28 of computer system 20 can be used to store operating system 35, additional application programs 37, other program modules 38 and program data 39. Computer system 20 may include a peripheral interface 46 for transmitting data from input device 40, such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices, such as a printer or scanner via one or more I / O ports, such as a serial port, parallel port, Universal Serial Bus (USB), or other peripheral interfaces. Display device 47 (such as one or more monitors, projectors or integrated displays) can also be connected to system bus 23 via output interface 48 (such as a video adapter). In addition to display device 47, computer system 20 may also be equipped with other peripheral output devices (not shown), such as speakers and other audio-visual devices.

[0104] The computer system 20 can work in a network environment using a network connection with one or more remote computers 49. The one or more remote computers 49 can be local computer workstations or servers, which include most or all of the elements described above in describing the properties of the computer system 20. Other devices can also be present in the computer network, such as but not limited to routers, network sites, peer devices or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with the remote computer 49 through one or more networks, such as a computer local area network (LAN) 50, a computer wide area network (WAN), an intranet, and the Internet. Examples of the network interface 51 may include an Ethernet interface, a frame relay interface, a SONET (synchronous optical network) interface, and a wireless interface.

[0105] Various aspects of the present invention may be systems, methods and / or computer program products. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions for causing a processor to perform various aspects of the present invention.

[0106] Computer readable storage medium can be a tangible device, and this tangible device can keep and store the program code of the form of instruction or data structure, and this program code can be accessed by the processor of computing device (such as computer system 20).Computer readable storage medium can be electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or its any suitable combination.As an example, this type of computer readable storage medium can include random access memory RAM, read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), portable optical disc read-only memory (CD-ROM), digital versatile disc (DVD), flash memory, hard disk, portable computer disk, memory stick, floppy disk or even mechanical coding device, such as punch card or convex structure in the groove of recording instruction thereon.As used in this article, computer readable storage medium should not be regarded as temporary signal itself, temporary signal such as radio wave or other free propagation electromagnetic wave, electromagnetic wave propagated by waveguide or transmission medium or electric signal transmitted by wire.

[0107] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network interface in each computing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the corresponding computing device.

[0108] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (Instruction-Set-Architecture, ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages ​​and traditional programmed programming languages). Computer-readable program instructions (as independent software packages) can be performed completely on the user's computer, partly on the user's computer, partly on the user's computer and partly on a remote computer or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network (including LAN or WAN), or can be connected to an external computer (for example, through the Internet). In some respects, electronic circuits (including for example programmable logic circuits, field programmable gate arrays (FPGAs) or programmable logic arrays (Programmable Logic Arrays, PLAs)) can be performed by utilizing the state information of computer-readable program instructions to personalize the electronic circuit, thereby performing aspects of the present invention.

[0109] In various aspects, the systems and methods described in the present invention can be processed in modules. The term "module" as used herein refers to, for example, a real-world device, component, or arrangement of components implemented using hardware (e.g., by an application-specific integrated circuit (ASIC) or FPGA), or to a combination of hardware and software, such as a microprocessor system and an instruction set that implements the module's functions (the instruction set converts the microprocessor system into a special-purpose device when executed). A module can also be implemented as a combination of two modules, in which certain functions are facilitated by hardware alone and other functions are facilitated by a combination of hardware and software. In some implementations, at least a portion of a module (and in some cases, all of a module) can be implemented in a computer system (such as above). Figure 4Therefore, each module can be implemented in various suitable configurations and should not be limited to any specific implementation illustrated in this article.

[0110] For the sake of clarity, not all routine features of various aspects are disclosed herein. It should be appreciated that in the development of any practical implementation of the present invention, many specific implementation decisions must be made in order to achieve the developer's specific goals, and these specific goals will vary for different implementations and different developers. It should be understood that such development efforts can be complex and time-consuming, but are still a routine task of engineering for those of ordinary skill in the art who understand the advantages of the present invention.

[0111] In addition, it should be understood that the words or terms used herein are for the purpose of description rather than limitation, so that the terms or terms of this specification should be interpreted by those skilled in the art according to the teachings and guidance provided herein in combination with the knowledge of (one or more) relevant technical personnel. In addition, it is not intended to attribute any term in this specification or claims to an uncommon or special meaning unless explicitly stated as such.

[0112] The various aspects disclosed herein include the present and future known equivalents of the known modules cited herein in an illustrative manner. In addition, although various aspects and applications have been shown and described, it will be apparent to those skilled in the art who understand the advantages of the present invention that more modifications than those mentioned above are feasible without departing from the inventive concept disclosed herein.

Claims

1. A method for performing antivirus scanning on an object on a mobile device, the method include: The security module receives a command from the protection module of the third-party application program to use the security module to perform an anti-virus scan on the object; checking, by the security module, whether a mobile security application has been installed or pre-installed on the mobile device; When the mobile security application is installed or pre-installed, determining whether the mobile security application is activated, and when the mobile security application is not activated, activating the mobile security application; When the mobile security application is not installed or pre-installed on the mobile device, installing and activating the mobile security application; sending, by the security module, the object to the mobile security application to perform an antivirus scan on the object; performing an antivirus scan on the object to determine whether the object is malicious; The security module sends the result of the antivirus scan to the protection module of the third-party application; selecting, by the protection module, at least one response measure based on the result of the antivirus scan; as well as The selected at least one response measure is applied by the security module.

2. The method according to claim 1, in, The command to perform an antivirus scan on the object is obtained after detecting suspicious activity, and wherein the suspicious activity is associated with at least one object.

3. The method according to claim 2, in, The suspicious activity is detected using a protection module that uses behavior blockers or dangerous application behavior patterns.

4. The method according to claim 1, in, The command for performing an antivirus scan on the object includes at least the following information: a location of the object and a name of the object.

5. The method according to claim 1, in, The object for performing antivirus scanning includes at least one of the following: document; Link; Message text; Spam; and Network packets.

6. The method according to claim 1, in, Activation and installation of the Mobile Security Application is performed in one of the following ways: by providing a request to a user of said mobile device; According to a group policy of the mobile device; and In automatic mode when installing said third-party application.

7. The method according to claim 1, in, Performing an antivirus scan of the object using at least one of: Interaction with cloud security services; and A database located within said mobile security application.

8. The method according to claim 1, in, The at least one response measure is intended to ensure the security of the third-party application of the mobile device and includes at least one of the following: Remove malicious objects; changing access permissions to said malicious object; placing said malicious object in a spam category; Alerting the user that the malicious object exists on the mobile device; Isolating the malicious object; Block incoming traffic by IP address; disconnecting the mobile device from the Internet; When the malicious object is detected, providing information support to a user of the mobile device; changing settings of the mobile security application on the mobile device; Block clicks on phishing links; Updating the operating system or rolling back the operating system of the mobile device to factory settings; as well as Update said third-party applications to the latest version.

9. A system for performing antivirus scanning on an object on a mobile device, include: at least one memory; as well as At least one hardware processor coupled to the at least one memory and configured, alone or in combination, to: The security module receives a command from the protection module of the third-party application program to use the security module to perform an anti-virus scan on the object; checking, by the security module, whether a mobile security application has been installed or pre-installed on the mobile device; When the mobile security application is installed or pre-installed, determining whether the mobile security application is activated, and when the mobile security application is not activated, activating the mobile security application; When the mobile security application is not installed or pre-installed on the mobile device, installing and activating the mobile security application; sending, by the security module, the object to the mobile security application to perform an antivirus scan on the object; performing an antivirus scan on the object to determine whether the object is malicious; The security module sends the result of the antivirus scan to the protection module of the third-party application; selecting, by the protection module, at least one response measure based on the result of the antivirus scan; as well as The selected at least one response measure is applied by the security module.

10. The system according to claim 9, in, The command to perform an antivirus scan on the object is obtained after detecting suspicious activity, and wherein the suspicious activity is associated with at least one object.

11. The system according to claim 10, in, The suspicious activity is detected using a protection module that uses behavior blockers or dangerous application behavior patterns.

12. The system according to claim 9, in, The command for performing an antivirus scan on the object includes at least the following information: a location of the object and a name of the object.

13. The system according to claim 9, in, The object for performing antivirus scanning includes at least one of the following: document; Link; Message text; Spam; and Network packets.

14. The system according to claim 9, in, Activation and installation of the Mobile Security Application is performed in one of the following ways: by providing a request to a user of said mobile device; According to a group policy of the mobile device; and In automatic mode when installing said third-party application.

15. The system according to claim 9, in, Performing an antivirus scan of the object using at least one of: Interaction with cloud security services; and A database located within said mobile security application.

16. The system according to claim 9, in, The at least one response measure is intended to ensure the security of the third-party application of the mobile device and includes at least one of the following: Remove malicious objects; changing access permissions to said malicious object; placing said malicious object in a spam category; Alerting the user that the malicious object exists on the mobile device; Isolating the malicious object; Block incoming traffic by IP address; disconnecting the mobile device from the Internet; When the malicious object is detected, providing information support to a user of the mobile device; changing settings of the mobile security application on the mobile device; Block clicks on phishing links; Updating the operating system or rolling back the operating system of the mobile device to factory settings; as well as Update said third-party applications to the latest version.

17. A non-transitory computer-readable medium having stored thereon computer-executable instructions for performing an anti-virus scan on an object on a mobile device, the computer-executable instructions comprising instructions for: The security module receives a command from the protection module of the third-party application program to use the security module to perform an anti-virus scan on the object; checking, by the security module, whether a mobile security application has been installed or pre-installed on the mobile device; When the mobile security application is installed or pre-installed, determining whether the mobile security application is activated, and when the mobile security application is not activated, activating the mobile security application; When the mobile security application is not installed or pre-installed on the mobile device, installing and activating the mobile security application; sending, by the security module, the object to the mobile security application to perform an antivirus scan on the object; performing an antivirus scan on the object to determine whether the object is malicious; The security module sends the result of the antivirus scan to the protection module of the third-party application; selecting, by the protection module, at least one response measure based on the result of the antivirus scan; as well as The selected at least one response measure is applied by the security module.

18. The non-transitory computer readable medium of claim 17, in, The command to perform an antivirus scan on the object is obtained after detecting suspicious activity, and wherein the suspicious activity is associated with at least one object.

19. The non-transitory computer readable medium of claim 18, in, The suspicious activity is detected using a protection module that uses behavior blockers or dangerous application behavior patterns.

20. The non-transitory computer readable medium of claim 17, in, The command for performing an antivirus scan on the object includes at least the following information: a location of the object and a name of the object.

Images