API Parameter Analysis for Malicious Application Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for safeguarding computers are inadequate in detecting all potentially malicious applications downloaded and executed, as they may fail to identify malicious content effectively.
Innovation Solution
The system detects potentially malicious applications by analyzing parameters passed into APIs during file download requests, using a security server to identify suspicious parameters and classify applications as potentially malicious based on previous attempts to download known malicious files, and performs security actions such as blocking downloads or warning users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional methods for safeguarding computers are used, then the system is simple and easy to operate, but the detection capability for potentially malicious applications is insufficient
Solution Approach 1:
The system performs preliminary analysis of download requests by examining parameters (URLs, file paths, HTTP headers) before the actual file download occurs. This allows the security system to identify and block potentially malicious applications before they can execute harmful code, improving detection capability in advance rather than reacting after infection occurs
Solution Approach 2:
The patent introduces an intermediary security layer between the application and the file download operation. This intermediary component analyzes download requests, compares parameters against known malicious patterns, and mediates the download process by blocking suspicious requests while allowing legitimate ones to proceed, thus enhancing detection without requiring complete system redesign
2Reliability
If traditional file scanning methods are used, then the system has simple architecture, but it cannot detect all potentially malicious applications
Solution Approach 1:
Instead of waiting for file execution and then detecting malware through scanning, the system performs preliminary analysis of download parameters (URLs, file paths, HTTP headers, user agents) before the download completes. This proactive approach detects malicious applications based on their download behavior patterns, significantly improving detection reliability before harmful code is executed
Solution Approach 2:
The patent shifts the detection dimension from post-execution file scanning to pre-download parameter analysis. By examining the metadata and parameters of download requests rather than just the file content itself, the system adds a new analytical dimension that captures malicious behavior patterns before file writing occurs, enhancing detection reliability
3Measurement precision
If the system analyzes parameters passed into APIs during download requests, then detection capability improves, but the complexity of analyzing each parameter increases
Solution Approach 1:
The system segments the parameter analysis into distinct categories: URL analysis, file path analysis, HTTP header analysis, and user agent analysis. Each parameter type is examined separately using specific detection rules and patterns, making the overall complex analysis task manageable through systematic segmentation. This allows precise detection of malicious patterns in each parameter dimension without overwhelming complexity
Data Source
AI summary
The disclosed computer-implemented method for detecting potentially malicious applications may include (1) detecting a request issued by an application running on a client device to download a file from a remote device, (2) determining that the request calls an application programming interface that enables the client device to download the file from the remote device, (3) determining that a parameter passed to the application programming interface in the request has been implicated in a previous attempt to download a known malicious file, and then in response to determining that the parameter has been implicated in a previous attempt to download a known malicious file, (4) classifying the application that issued the request as potentially malicious. Various other methods, systems, and computer-readable media are also disclosed.