Application Download Interception Using Hash-Based Risk Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying risky applications during download are prone to missed interceptions due to frequent changes in website addresses, leading to potential security risks.
Innovation Solution
An interception method that determines the risk of a target application during the download process by obtaining data from the installation package and comparing it with a risky application database, either locally or through an interception server, to provide real-time risk assessment and notification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If website address comparison method is used for risky application detection, then detection process is simple, but detection accuracy deteriorates due to frequent website address changes
Solution Approach 1:
The patent extracts the core identifying feature from the application package (data digest/hash value) rather than using the website address. This extraction allows comparison against a database of known risky application signatures, maintaining simplicity while dramatically improving detection accuracy by focusing on immutable application characteristics rather than mutable download addresses
Solution Approach 2:
The patent changes the detection parameter from website address (which changes frequently) to data digest/hash value of the application package (which remains constant for the same application). This parameter transformation resolves the contradiction by using a stable identifier that accurately represents the application's identity
2Reliability
If complete installation package is downloaded before detection, then detection comprehensiveness is improved, but time consumption and traffic increase
Solution Approach 1:
The patent performs detection during the download process rather than after complete download. By calculating the data digest/hash value of the downloaded portion and comparing it against the risky application database in real-time, the system achieves comprehensive detection without waiting for the complete package, thereby reducing time consumption and traffic usage
Solution Approach 2:
The patent enables early termination of the download process when a risky application is detected. By continuously monitoring the downloaded data and performing detection checks, the system can skip the remaining download steps once risk is identified, significantly reducing time and traffic consumption for malicious applications
Data Source
AI summary
An electronic device receives a download operation performed by a user on a target application. In response to the download operation, the electronic device obtains a download address of the target application, and downloads an installation package of the target application from a download server based on the download address. In the download process, the electronic device determines first data of the target application based on downloaded data in the installation package, and sends the first data to an interception server. When the interception server determines, based on the first data, that the target application has a security risk, the interception server returns a first detection result to the electronic device. When it is determined that the target application has a security risk, the electronic device output a risk prompt in response to the first detection result.