Android Malware Classification via Function Similarity Blacklist
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of malicious Android applications poses a challenge due to the limitations of existing antivirus software, which can be ineffective in detecting malware since all Android applications, including antivirus apps, run in a sandbox environment, restricting access to the operating system's resources, and users may grant permissions that allow malicious software to operate outside the sandbox.
Innovation Solution
A classification technique that identifies malicious Android software applications by extracting and comparing functions from known malicious apps, calculating similarity values, and creating a blacklist database of common malicious function sets or similarity identifiers to classify unknown apps as malicious or not.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software is used to detect malicious Android applications, then detection capability is provided, but effectiveness is reduced due to sandbox limitations
Solution Approach 1:
The patent introduces a blacklist database as an intermediary component that stores pre-identified malicious function sets. This blacklist acts as a mediator between the sandboxed application environment and the detection system, allowing effective malware identification without requiring access to operating system resources outside the sandbox. The blacklist contains function sets that have been previously determined to be malicious through analysis of known malware samples.
Solution Approach 2:
The patent creates a simplified representation of malicious behavior by copying and storing function sets from known malicious applications into the blacklist database. Instead of analyzing entire applications or requiring deep system access, the system copies relevant function-level characteristics into the blacklist, enabling efficient comparison and detection within the sandbox environment.
2Measurement precision
If function extraction and comparison is performed to identify malicious apps, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary action by pre-identifying and storing malicious function sets in the blacklist database before actual detection is needed. During detection, the system only needs to compare application functions against the pre-prepared blacklist entries, rather than performing complex analysis in real-time. This preliminary preparation significantly reduces processing time during actual malware detection while maintaining high accuracy.
Solution Approach 2:
The patent segments the detection process into two distinct phases: (1) offline blacklist creation where malicious function sets are identified and stored, and (2) online detection where applications are compared against the blacklist. This segmentation allows computationally intensive function extraction and comparison to be performed once during blacklist creation, while runtime detection only requires faster function matching against pre-stored patterns.
3Reliability
If common function sets are used to identify malicious apps, then false positives are reduced, but detection coverage may decrease
Solution Approach 1:
The patent applies local quality by requiring that at least one function in a matched set be identified as a malicious function. This localized quality control ensures that not all functions in a matched set need to be malicious for detection to occur, but at least one must be confirmed malicious. This approach reduces false positives by requiring verified malicious indicators while maintaining coverage through the set-based matching approach.
Data Source
AI summary
Known malicious Android applications are collected and their functions are extracted. Similarity values are calculated between pairs of functions and those functions with a low similarity value are grouped together and assigned a unique similarity identifier. A common set of functions or common set of similarity identifiers are identified within the applications. If at least one function in the common set is determined to be malicious then the common set is added to a blacklist database either by adding functions or by adding similarity identifiers. To classify an unknown Android application, first the functions in the application are extracted. These functions are then compared to the set of functions identified in the blacklist database. If each function in the set of functions is present (either by matching or by similarity) in the group of extracted functions from the unknown application then the unknown application is classified as malicious.