On-Device Binary Analysis for Mobile App Behavior Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for identifying and addressing performance degradation in mobile devices are inadequate, as they often require computationally-intensive processes, are limited to detecting known viruses, and do not efficiently handle the complex factors contributing to degradation over time, leading to significant resource consumption and user experience issues.
Innovation Solution
A method for generating lean classifier models on mobile devices by performing lightweight binary analysis to derive application-specific features, categorizing applications, and obtaining classifier models based on categories, allowing for efficient monitoring and classification of non-benign behaviors without extensive network dependence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If computationally-intensive processes are used to identify and address performance degradation, then detection accuracy is improved, but resource consumption increases
Solution Approach 1:
The patent segments the binary analysis process into lightweight static analysis and selective dynamic analysis. The static analysis extracts features from binary code without execution, while dynamic analysis is only performed when anomalies are detected or for specific high-risk scenarios. This segmentation reduces overall resource consumption while maintaining detection accuracy by avoiding unnecessary computationally-intensive operations.
Solution Approach 2:
The patent changes the operational parameters of the analysis system by adjusting the threshold for triggering dynamic analysis and selecting which features to monitor based on application category. By dynamically adjusting these parameters, the system maintains high detection accuracy for malicious behaviors while reducing resource consumption through selective monitoring rather than continuous full-scale analysis.
2Device complexity
If generic classifier models are used for all applications, then device complexity is reduced, but detection precision deteriorates
Solution Approach 1:
The patent implements a universal framework that handles both generic and application-specific classifier models through a unified interface. The system automatically selects or generates appropriate models based on application characteristics, allowing the same infrastructure to serve multiple purposes: using pre-trained generic models for common applications and generating specialized models when needed, thereby maintaining low complexity while improving precision.
Solution Approach 2:
The patent introduces dynamic model selection and generation capabilities where the classifier model adapts based on the application being analyzed. The system can switch between pre-trained generic models and dynamically generated application-specific models, adjusting the level of specialization according to the detected behavior patterns and risk levels, thus optimizing both complexity and precision.
3Measurement precision
If application-specific classifier models are generated for each application, then detection precision is improved, but device complexity and processing time increase
Solution Approach 1:
The patent performs preliminary static analysis of binary code to extract features and generate application-specific classifier models before the applications are actually executed on the device. By preparing these models in advance during the installation or registration phase, the system eliminates the need for time-consuming model generation during runtime, thus improving detection precision without significantly impacting productivity.
Solution Approach 2:
The patent reuses and adapts existing generic classifier models as templates for creating application-specific models. Instead of generating entirely new models from scratch for each application, the system copies proven effective generic models and customizes them with application-specific features extracted from binary analysis, significantly reducing model generation time while maintaining high detection precision.
4Measurement precision
If extensive binary analysis is performed on each application, then feature extraction accuracy is improved, but processing time and energy consumption increase
Solution Approach 1:
The patent extracts only the most relevant features from binary code through static analysis, focusing on key indicators such as API calls, system calls, and specific code patterns associated with malicious behaviors. By selectively extracting only the most discriminative features rather than analyzing all possible attributes, the system achieves high feature extraction accuracy while minimizing processing time and energy consumption.
Solution Approach 2:
The patent applies partial binary analysis by performing comprehensive static analysis on all applications but only performing dynamic analysis selectively on applications that exhibit suspicious characteristics or belong to high-risk categories. This partial action approach ensures high feature extraction accuracy for critical cases while avoiding the excessive time and energy costs of analyzing every application in detail.
Data Source
AI summary
Various aspects provide methods implemented by at least one processor executing on a mobile communication device to efficiently identify, classify, model, prevent, and/or correct the non-benign (e.g., performance degrading) conditions and/or behaviors that are related to an application operating on the device. Specifically, in various aspects, the mobile computing device may derive or extract application-specific features by performing a binary analysis of an application and may determine the application's category (e.g., a “games,”“entertainment,” or “news” category) based on the application-specific features. The mobile computing device may also obtain a classifier model associated with the application's category that includes various conditions, features, behaviors and corrective actions that may be used to quickly identify and correct non-benign behaviors (e.g., undesirable, malicious, and/or performance-degrading behaviors) occurring on the mobile computing device that are related to the application.