Application-Level Sandboxing for Mobile Malware Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a growing need for improved techniques to identify and mitigate malware, particularly on mobile devices, as malicious software increasingly targets these platforms, exploiting user behavior changes and compromising personal and business operations.
Innovation Solution
The implementation of an application-level sandboxing system on mobile devices, which isolates newly installed applications within a secure environment, allowing them to run with fake data and restricted access, while static and dynamic analysis is performed to determine their maliciousness, preventing harm until a verdict is reached.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application-level sandboxing is implemented on mobile devices, then malware detection and protection capability is improved, but device complexity and resource consumption increase
Solution Approach 1:
The patent divides the mobile device into multiple sandboxed application containers, each isolated from the others and from the host system. This segmentation allows malware contained in one sandbox to be isolated from legitimate applications and system resources, enabling secure execution of untrusted code while maintaining overall system stability. The segmentation principle directly addresses the complexity issue by creating modular, contained environments rather than a monolithic system.
Solution Approach 2:
The patent introduces a host computer as an intermediary between the mobile device and the cloud-based analysis system. The host computer receives application code from the mobile device, performs preliminary analysis, and facilitates communication with remote servers. This intermediary layer distributes the computational burden and provides a buffer that protects the mobile device from direct exposure to malicious code while enabling sophisticated analysis capabilities.
2Measurement precision
If dynamic analysis is performed on applications, then detection accuracy is improved, but analysis time and processing resources increase
Solution Approach 1:
The patent performs preliminary static analysis of application code before it is deployed to the mobile device. This preliminary action includes analyzing code structure, identifying potential malicious patterns, and preparing analysis results in advance. By performing analysis before deployment, the system can make quick decisions about whether to allow execution, thereby reducing the time required for detection during actual device operation while maintaining high accuracy through comprehensive preliminary examination.
Solution Approach 2:
The patent implements a feedback loop where analysis results from sandboxed applications are continuously fed back to improve detection algorithms and update malware signatures. The system monitors application behavior within the sandbox, collects data on execution patterns, and uses this feedback to refine future analysis. This feedback mechanism enables the system to learn from each analysis and improve its accuracy over time while reducing redundant analysis work.
3Reliability
If applications are isolated in sandbox environments, then security against malware is improved, but ease of operation and application functionality are reduced
Solution Approach 1:
The patent creates a universal sandbox environment that can execute multiple types of applications (native apps, web apps, third-party apps) within a single isolated framework. This universal approach maintains consistent user experience across different application types while preserving security isolation. The sandboxed environment provides standardized interfaces and resource access for all applications, ensuring they operate smoothly despite isolation requirements.
Solution Approach 2:
The patent dynamically adjusts sandbox parameters such as resource allocation, permission levels, and isolation strength based on the specific application being executed and its trust level. For highly trusted applications, the sandbox provides minimal restrictions for smoother operation. For untrusted applications, enhanced isolation and resource management are applied. This parameter adjustment allows the system to optimize between security and ease of operation on a per-application basis rather than applying uniform restrictions.
Data Source
AI summary
Execution of an application in an application-level sandbox is disclosed. A request to launch an application is received by an operating system executing on a device. A determination is made that a stored copy of the application should be executed within an application-level sandbox. The stored copy of the application is executed in the application-level sandbox.