Fake Antivirus Detection via GUI Text Classification and Code Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus technologies find it difficult to detect fake antivirus software due to its resemblance to legitimate antivirus software, making it challenging to differentiate using pattern matching algorithms.
Innovation Solution
A method involving retrieving and classifying text content from graphical user interfaces of application programs, combined with scanning for suspicious code, to determine if an application is fake antivirus, and evaluating the reputation of websites to prevent the download of fake antivirus software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If conventional pattern matching algorithms are used to detect antivirus software, then detection simplicity is maintained, but detection accuracy deteriorates because fake antivirus mirrors legitimate antivirus layout and behavior
Solution Approach 1:
The detection system segments the analysis into multiple independent components: (1) retrieving text content from GUI windows, (2) classifying text content to determine antivirus category, and (3) scanning associated files for suspicious code. This segmentation allows each component to specialize in detecting specific indicators, thereby improving overall detection accuracy without requiring a single complex algorithm
Solution Approach 2:
The patent introduces text content classification as an intermediary step between the application interface and the final detection decision. By first classifying the text content to determine if the application belongs to the antivirus category, the system creates a intermediate verification layer that helps distinguish fake antivirus from legitimate antivirus before proceeding to file scanning, thereby improving detection accuracy
2Adaptability or versatility
If fake antivirus uses changed icons and keywords to avoid detection, then evasion capability improves, but conventional pattern matching effectiveness deteriorates
Solution Approach 1:
The patent extracts text content directly from the GUI window of the application program, separating the detection process from reliance on external indicators like icons and keywords that can be easily changed. By extracting and classifying the actual functional text content within the application interface, the system identifies the antivirus category based on inherent functional characteristics rather than superficial elements, making detection resistant to icon and keyword changes
Solution Approach 2:
The patent transitions from two-dimensional pattern matching (icons and keywords) to a new dimension of analysis by retrieving and classifying text content from the application's graphical user interface. This dimensional shift allows detection based on functional text characteristics that remain consistent even when superficial elements like icons and keywords are changed, thereby maintaining detection effectiveness against evasive fake antivirus
3Object-affected harmful factors
If fake antivirus is packed as executable file with legitimate-looking GUI, then disguise effectiveness improves, but conventional antivirus detection deteriorates
Solution Approach 1:
The patent merges two detection approaches into a unified system: (1) text content classification to identify antivirus category from the GUI, and (2) file scanning to detect suspicious code in associated executable files. By combining these two detection dimensions, the system can identify fake antivirus even when it presents a legitimate-looking GUI, because the file scanning component will detect the malicious packed code regardless of the GUI appearance
Solution Approach 2:
The patent introduces text content classification as an intermediary verification step between the GUI interface and the final detection conclusion. By first analyzing the text content to determine if the application claims to be antivirus software, the system creates an intermediate layer of verification that, when combined with file scanning results, provides robust detection of disguised fake antivirus while maintaining legitimacy of legitimate antivirus
Data Source
AI summary
Detection of fake antivirus includes classifying text content of a user interface of an application program and scanning files associated with the application program for suspicious code. The user interface may be a graphical user interface (GUI) window of the application program. The text content may be obtained from a painted portion of the GUI window and by intercepting text changing operations performed on the GUI window. The text content may be input to a learning model to determine whether or not the application program belongs to the antivirus category. The application program is deemed to be fake antivirus when the application program is classified as belonging to the antivirus category and has a file with suspicious code.