Dynamic Fake Email Trap for Malicious App Detection

The patent introduces an intermediary trap (fake email address) that mediates between the monitoring system and the malicious application. Instead of directly monitoring application behavior or scanning files with heavy algorithms, the system creates a deceptive email address that the malicious application may attempt to send data to. This intermediary approach allows detection of data leakage attempts without requiring intensive processor usage or large storage space for signatures, thus resolving the contradiction between detection effectiveness and resource consumption.

The patent converts the harmful behavior of malicious applications (attempting to send stolen data to external servers) into a beneficial detection mechanism. By creating fake email addresses that mimic legitimate communication channels, the system allows malicious applications to reveal their true nature when they attempt to use these traps. Legitimate applications will not attempt to send data to randomly generated fake email addresses, thus the trap specifically identifies malicious behavior without causing false positives against legitimate applications.

The patent employs cheap, short-lived trap objects (fake email addresses) that are dynamically created and discarded. Each trap is a simple string of characters requiring minimal memory and processing resources. The traps are created temporarily when an application is installed and discarded after a short monitoring period or when no longer needed. This approach provides effective security detection capability while maintaining device performance and resource availability, as the traps consume negligible resources compared to traditional antivirus algorithms.