Dynamic Mobile Credential Leak Detection via Behavioral Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems are limited in identifying malicious servers beyond text string comparisons, failing to analyze other attributes that may indicate potential malware during login events.
Innovation Solution
A dynamic analysis method that compares user login events with expected behaviors associated with applications, including server traffic, application text, icons, URLs, and required libraries, to determine if an application is potentially malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If text string comparison methods are used to identify malicious servers, then the detection process is simple and fast, but the detection capability is limited and cannot identify other attributes of potentially malicious servers
Solution Approach 1:
The patent segments the malware detection process into multiple independent analysis components: text string comparison, server traffic analysis, application behavior monitoring, and credential interception detection. Each segment operates independently to evaluate different aspects of potential malware, allowing the system to maintain fast text-based filtering while adding deeper analysis layers for comprehensive detection.
Solution Approach 2:
The patent transitions from single-dimension text string comparison to multi-dimensional analysis by incorporating server traffic patterns, application behavior metrics, library usage patterns, and credential flow analysis. This dimensional expansion enables the system to detect malware that evades text-based detection by exhibiting malicious behavior across multiple analysis dimensions simultaneously.
2Measurement precision
If dynamic analysis comparing multiple attributes is performed, then the detection capability improves, but the system complexity increases
Solution Approach 1:
The patent implements a universal dynamic analysis framework that handles multiple analysis types (traffic analysis, behavior monitoring, credential detection) through a single integrated system architecture. The framework uses common infrastructure components such as event hooks, data collection modules, and comparison engines that serve multiple detection functions, reducing overall system complexity despite the multi-faceted analysis capability.
Solution Approach 2:
The patent introduces intermediary components that mediate between the complex multi-attribute analysis and the final detection decision. These intermediaries include behavior normalization modules, credential flow intermediaries, and analysis result aggregation components that simplify the integration of multiple analysis streams into coherent detection outcomes, managing complexity through structured intermediate processing layers.
3Reliability
If comprehensive dynamic analysis is performed on login events, then malware detection accuracy improves, but the analysis time and computational resources increase
Solution Approach 1:
The patent performs preliminary text string comparison and basic attribute validation before initiating comprehensive dynamic analysis. This preliminary filtering eliminates obviously malicious or benign cases without requiring full dynamic analysis, reserving intensive computational resources only for cases that require deeper inspection, thereby reducing overall analysis time while maintaining high detection accuracy.
Solution Approach 2:
The patent applies partial dynamic analysis by focusing on specific critical attributes and behaviors most indicative of malware based on risk assessment. Rather than analyzing all possible attributes equally, the system selectively intensifies analysis on high-risk indicators such as credential interception attempts or unusual server traffic patterns, achieving high detection accuracy with reduced computational overhead.
Data Source
AI summary
The present disclosure relates to systems and methods for detecting malware. In some embodiments, a method may include detecting, via a processor, a user login event at an application; dynamically comparing, via the processor, the user login event with one or more expected behaviors associated with the application; and determining, via the processor, whether the application is potential malware based at least in part on a result of the comparing.