Behavioral Scanning of Mobile Applications for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods relying on signature scanning are ineffective against malware variants, allowing infected applications to evade detection and infect mobile devices.
Innovation Solution
Implementing a behavioral analysis system that simulates user interactions on a software emulation platform to analyze applications for malicious behavior, combining hard and soft signals to determine the likelihood of malware presence, and taking remedial actions such as notification or removal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature scanning is used for malware detection, then detection speed is improved, but detection accuracy deteriorates due to inability to detect malware variants
Solution Approach 1:
The patent replaces the mechanical signature-matching approach with a behavioral analysis system that observes and analyzes application behaviors. Instead of relying on static signature patterns, the system dynamically monitors application actions, system calls, and operational characteristics to detect malware variants based on their behavioral patterns rather than their code signatures.
Solution Approach 2:
The patent changes the detection parameters from static signature matching to dynamic behavioral parameters. The system monitors multiple behavioral parameters including system calls, file operations, network activities, and execution patterns. By analyzing changes in these behavioral parameters over time, the system can identify malware variants even when their signatures have been modified or obfuscated.
2Measurement precision
If behavioral analysis is implemented to detect malware variants, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the behavioral analysis system into distinct functional modules: a behavioral profiler that captures application behaviors, a behavioral database that stores known patterns, and an analysis engine that compares observed behaviors against stored patterns. This segmentation allows each module to specialize in specific tasks, reducing overall system complexity while maintaining high detection accuracy.
Solution Approach 2:
The patent introduces a behavioral database as an intermediary between the behavioral profiler and the analysis engine. This database stores pre-analyzed behavioral patterns and serves as a reference for comparison. The intermediary layer simplifies the analysis process by providing structured, pre-processed behavioral data rather than requiring direct complex analysis of raw application behaviors.
3Measurement precision
If comprehensive behavioral monitoring is performed, then malware detection capability is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary behavioral profiling during application installation or initial execution, capturing baseline behaviors before the application is fully deployed. By pre-analyzing and storing behavioral patterns in advance, the system reduces processing time during actual malware detection, as the analysis engine can quickly compare observed behaviors against pre-stored patterns rather than analyzing everything from scratch.
Solution Approach 2:
The patent implements periodic behavioral sampling rather than continuous monitoring of all application actions. The system captures behavioral data at strategically selected intervals and triggers detailed analysis only when suspicious patterns are detected. This periodic approach maintains high detection capability while significantly reducing overall processing time and resource consumption.
Data Source
AI summary
Behavioral analysis of a mobile application is performed to determine whether the application is malicious. During analysis, various user interactions are simulated in an emulated environment to activate many possible resulting behaviors of an application. The behaviors are classified as hard or soft signals. A probability of the application being malicious is determined through combining soft signals, and the application is classified as malicious or non-malicious. Users of the application, the developer of the application, or a distributor of the application are notified of the application classification to enable responsive action.