Dynamic API Extraction for Mobile Malware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for evaluating security vulnerabilities in mobile applications are limited in accurately reflecting and evaluating the actual behaviors of applications, as they rely on subjective permission requests and user reviews, failing to account for background services and objectivity.

Innovation Solution

A method of application malware detection based on dynamic API extraction, which involves classifying APIs as malicious or benign using a machine learning algorithm, generating a training dataset by measuring API frequency and Mutual Information values, and creating an API classifier to objectively assess application behavior.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional security evaluation methods using permission requests and user reviews are used, then the evaluation process is simple and fast, but the accuracy and objectivity of detecting actual application behaviors is poor

Engineering Contradiction:

Improvedetection accuracy of application behaviorsVSAvoidcomplexity of security evaluation system

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent replaces manual security evaluation methods (permission checking and user reviews) with an automated machine learning-based API classification system. The system uses supervised learning algorithms to automatically analyze and classify API calls, substituting human judgment with computational analysis to improve detection accuracy while maintaining operational efficiency

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system enables self-service security evaluation by automatically training classification models using labeled API datasets. The machine learning model autonomously learns from training data and performs security assessments without requiring manual intervention for each evaluation, allowing the system to serve itself in both model development and deployment phases

Inventive Principle:

Principle #25Self-service

2Reliability

If dynamic API extraction and machine learning classification are implemented, then the objectivity and accuracy of security evaluation is improved, but the computational complexity and processing time increase

Engineering Contradiction:

Improveobjectivity of security evaluationVSAvoidprocessing time for malware detection

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by pre-training the machine learning classification model using a large labeled dataset of benign and malicious APIs before actual security evaluations. This advance preparation creates a ready-to-use classification system that can quickly assess new applications without requiring time-consuming analysis during the actual detection phase

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The security evaluation process is segmented into distinct phases: API extraction, feature engineering, model training, and classification. By dividing the complex task into manageable segments, the system can optimize each phase independently and process applications more efficiently

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11019099B2Method of application malware detection based on dynamic API extraction, and readable medium and apparatus for performing the method

Publication Date: 2021.05.25 FOUND OF SOONGSIL UNIV IND COOP

AI summary

Provided is a method of application malware detection based on dynamic Application Programming Interface (API) extraction, and a readable medium and an apparatus for performing the same. The method of application malware detection based on dynamic API extraction includes generating an API classifier which classifies an input API as malicious or benign using API used in a sample application classified as malicious application apps or benign application apps, and inputting a pre-stored target API into the API classifier to classify the target API as malicious or benign.