Execution Session Context Vector for Malicious Behavior Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems fail to accurately determine the intent behind software application activities by solely relying on operational states, neglecting the context in which tasks are performed, leading to insufficient classification of benign or malicious behaviors.
Innovation Solution
A method for determining the execution session context of a software application on a mobile device by monitoring system and user activities, correlating them, and generating an execution session context vector to select a behavior classifier model, which assesses whether the application is benign or malicious based on user interaction and system resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware detection systems rely solely on operational state to classify application behavior, then the classification process is simple and fast, but the accuracy of determining malicious or benign behavior is insufficient
Solution Approach 1:
The patent segments the classification process into multiple independent components: execution state detection, context vector generation, probability determination, and classifier model selection. Each component processes specific aspects of application behavior separately, then combines them to achieve accurate classification without requiring a monolithic complex system
Solution Approach 2:
The patent introduces an execution session context vector as an intermediary data structure that bridges raw operational data and final classification results. This vector aggregates execution state, user interaction patterns, and system activity information, serving as a mediator that enables accurate classification while keeping the detection system modular and manageable
2Loss of information
If the system monitors only operational state without considering execution context, then the monitoring process is simple and resource-efficient, but it cannot accurately determine user intent behind application activities
Solution Approach 1:
The patent implements partial monitoring by selectively tracking only the most relevant context parameters (execution state, user interaction events, system activity) rather than all possible system states. This approach captures sufficient information to determine user intent while avoiding the excessive resource consumption that would result from comprehensive monitoring of all system activities
Solution Approach 2:
The system performs preliminary classification by generating execution session context vectors that pre-process and aggregate monitoring data before final classification. This preliminary action organizes raw monitoring data into structured context information, reducing the computational burden of subsequent analysis and enabling efficient determination of user intent
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Methods, systems and devices compute and use the execution session contexts of software applications to perform behavioral monitoring and analysis operations. A mobile device may be configured to monitor user activity and system activity of a software application, generate a shadow feature value that identifies actual execution session context of the software application during that activity, generate a behavior vector that incorporates context into the values describing behaviors, and determine whether the activity is malicious or benign based, at least in part, on the generated behavior vector. The mobile device processor may also be configured to intelligently determine whether the execution session context of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the execution session contexts of the software applications for which such determinations are relevant.