Context-Based Malware Detection via Component Dependency Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques are inadequate in effectively protecting mobile devices from malicious applications (malware) due to the increasing use of mobile devices for work and personal activities, as they struggle to detect and prevent malware propagation across various distribution platforms and networks.
Innovation Solution
A system comprising a data appliance and cloud security service that performs static and dynamic analysis of applications, using a combination of firewall technologies and machine learning techniques to identify and classify malware, and enforce policies to block malicious applications, while also utilizing a multi-core CPU and FPGAs for real-time threat detection and prevention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security techniques are used to protect mobile devices, then device complexity is reduced, but malware detection accuracy and protection effectiveness deteriorate
Solution Approach 1:
The security system is divided into multiple independent analysis modules: static analysis module for examining application structure, dynamic analysis module for monitoring runtime behavior, and machine learning module for pattern recognition. Each module operates independently and can be activated based on threat level, resolving the contradiction between comprehensive detection capability and system complexity.
Solution Approach 2:
The system dynamically adjusts its analysis depth and activation of different modules based on the risk level of detected applications. High-risk applications trigger both static and dynamic analysis, while low-risk applications undergo only static analysis. This dynamic approach maintains high detection accuracy while reducing overall system complexity through selective activation.
2Measurement precision
If comprehensive static and dynamic analysis is performed on all applications, then malware detection accuracy is improved, but analysis time and processing speed deteriorate
Solution Approach 1:
The system performs preliminary static analysis on all applications before they are allowed to execute. This preliminary action filters out obvious malware and low-risk applications, so that comprehensive dynamic analysis is only performed on applications that pass the initial static check but still require deeper inspection. This resolves the contradiction by performing quick preliminary screening on all applications while reserving intensive analysis for only those that need it.
Solution Approach 2:
The analysis process is made dynamic by adjusting the depth of inspection based on initial findings. Applications flagged as high-risk undergo both static and dynamic analysis, while benign applications undergo only static analysis. This dynamic stratification maintains high accuracy for problematic applications while preserving overall processing speed.
3Reliability
If real-time threat detection is implemented, then protection effectiveness is improved, but computational resources and energy consumption deteriorate
Solution Approach 1:
The system performs preliminary static analysis of applications before they execute, creating a baseline understanding of their structure and intended functionality. This preliminary action reduces the computational burden during real-time execution, as the system only needs to perform lightweight dynamic monitoring rather than complete re-analysis, thus maintaining real-time protection effectiveness while reducing energy consumption.
Solution Approach 2:
The system uses machine learning models that continuously improve based on observed application behavior patterns. Once trained, the models can autonomously classify applications and detect anomalies without requiring intensive computational resources during real-time operation. The system essentially teaches itself to recognize malware patterns, reducing the need for continuous heavy computational analysis.
Data Source
AI summary
Evaluating samples is disclosed. A sample is received. A system component dependency graph is built for the sample. The system component dependency graph includes a plurality of nodes and at least one edge. A first node included in the plurality of nodes is one of: (1) a system component, (2) an indirect call component, or (3) a system event. The edge is an indirect call instruction. A verdict for the sample is determined based at least in part on the system component dependency graph.