Mobile App Component Grouping for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques are inadequate in effectively protecting mobile devices from malicious applications (malware) due to the increasing threat of mobile malware, which can spread through various channels such as app stores, websites, and email attachments, and are difficult to detect and prevent using current methods.
Innovation Solution
A system comprising a data appliance and cloud security service that performs static and dynamic analysis of mobile applications to classify and detect malware by intercepting potential threats, using a combination of signature recognition, real-time analysis, and behavioral monitoring, and generating signatures for automatic blocking of malicious files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing detection techniques are used, then mobile devices can be protected from malware, but the detection accuracy is insufficient and false positives occur frequently
Solution Approach 1:
The patent segments mobile applications into multiple components (manifest information, resource files, code files) and analyzes each component separately. This segmentation allows for more precise detection by examining specific suspicious elements within components rather than treating the entire application as a single unit, thereby improving detection accuracy while reducing false positives through targeted analysis.
Solution Approach 2:
The patent introduces an intermediary analysis system that acts as a mediator between the mobile application and the detection process. This intermediary system performs static and dynamic analysis, groups components by developer, and correlates behaviors across components to determine maliciousness, improving detection reliability by providing a comprehensive intermediate evaluation layer.
2Measurement precision
If comprehensive analysis methods are implemented, then malware detection accuracy improves, but the complexity of the detection system increases
Solution Approach 1:
By dividing the analysis into distinct segments (manifest analysis, resource file analysis, code file analysis, behavioral analysis), the system manages complexity through structured organization. Each segment handles specific aspects of malware detection, making the overall complex system more manageable and maintainable while achieving comprehensive detection accuracy.
Solution Approach 2:
The system performs self-service by automatically grouping components, analyzing behaviors, and generating detection results without requiring external intervention for each analysis step. The automated correlation of component behaviors and the self-directed analysis process reduce operational complexity while maintaining high detection accuracy.
3Reliability
If static and dynamic analysis are performed on all application components, then malware detection capability is enhanced, but the time and computational resources required increase
Solution Approach 1:
The system performs preliminary static analysis on manifest information, resource files, and code files before executing dynamic analysis. This preliminary action identifies suspicious components and behaviors in advance, allowing the system to focus computational resources on high-risk areas during dynamic analysis, thereby enhancing detection capability while reducing overall analysis time through prioritized processing.
Solution Approach 2:
The system applies partial analysis to less critical components and excessive (comprehensive) analysis to high-risk components identified during static analysis. By allocating analysis depth proportionally to risk levels, the system enhances detection capability for malicious applications while avoiding unnecessary computational expenditure on benign applications, thus optimizing the balance between detection reliability and analysis time.
Data Source
AI summary
A first mobile application is received. A reversing operation is performed on the first mobile application. A static analysis engine is used to determine a plurality of libraries included in the mobile application. Each library included in the plurality of libraries is categorized. A determination that the first mobile application is similar to a second mobile application based at least in part on a comparison of the respective categorizations of the respective libraries included in the respective first and second mobile applications. Commonality in the libraries of the two mobile applications can be used for a variety of purposes including detecting repackaging and also common authorship.