Fraud Detection Server for Mobile Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies for detecting malicious applications on terminal devices face challenges such as high resource usage, inefficient virus checking, and inability to detect malicious actions after an application is deleted, particularly in portable devices with limited resources.
Innovation Solution
A system comprising a terminal device and a fraud detection server that monitors application installation states, calculates feature values, and performs countermeasures, allowing for efficient detection and notification of malicious actions even after an application is deleted, with the server handling complex processing and storage tasks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virus checking is performed on the terminal device itself, then detection can be done locally without network dependency, but the terminal device's limited hardware resources are overwhelmed and detection accuracy is insufficient
Solution Approach 1:
A fraud detection server acts as an intermediary between terminal devices and the virus detection ecosystem. The server receives application information from terminals, performs comprehensive fraud detection analysis using sophisticated algorithms and databases, then returns detection results to terminals. This mediator approach enables high-accuracy detection while keeping terminal devices resource-light.
Solution Approach 2:
Instead of requiring terminal devices to possess full virus detection capabilities, the system creates simplified copies or representations of application data (application information, features, metadata) and sends these to the fraud detection server. The server performs the heavy lifting using these copied data structures, returning results without requiring terminals to maintain complex detection engines.
2Measurement precision
If comprehensive application monitoring is implemented on the terminal device, then all malicious actions can be detected, but power consumption increases and device performance degrades
Solution Approach 1:
The fraud detection server serves as an external intermediary that handles the computationally intensive monitoring and analysis tasks. Terminal devices only need to report application installation and execution states to the server, which then performs comprehensive fraud detection analysis. This division of labor enables precise monitoring without draining terminal battery resources.
Solution Approach 2:
The system implements partial monitoring on terminals (only tracking application state changes) while leaving the excessive or comprehensive analysis work to the fraud detection server. Terminals perform minimal local monitoring and offload the heavy analytical processing to the cloud-based server, achieving comprehensive detection coverage without excessive local resource consumption.
3Reliability
If traditional virus detection methods are used, then installed applications can be scanned, but applications deleted from the terminal cannot be detected after deletion
Solution Approach 1:
The fraud detection server performs preliminary fraud analysis on applications before they are installed on terminal devices. By detecting and blocking malicious applications in advance (prior to installation), the system prevents potential threats from ever reaching the terminal. This preliminary action approach ensures that even deleted applications cannot cause harm, as their malicious nature was already identified and reported to the server.
Solution Approach 2:
The system implements a feedback mechanism where the fraud detection server continuously monitors application states, receives updates about installed and deleted applications, and maintains an ongoing detection dialogue with terminals. When applications are deleted, the server is notified and can update its records and continue monitoring, ensuring detection coverage extends beyond currently installed applications to include historical and deleted applications.
Data Source
AI summary
The objective of the present invention is to provide technology for detecting malicious action of an application upon a terminal device using a low load as well as to increase accuracy of detection; in particular, to provide technology capable of performing detection even regarding an application which has been deleted upon the terminal device. A change in the installation state of an application in a terminal device is detected, upon which information for the installed application is reported to a fraud detection server so as to be recorded. In addition, a predetermined feature value based on an application file or component files configuring a package of the application is reported to the fraud detection server. The feature value is associated with the malicious action of the application so as to be registered in an application DB, whereupon if malicious action of the application is detected, fraud detection information is transmitted to the terminal device. When the fraud detection information is received, predetermined response processing is performed upon the terminal device.