External Frida Handshake Detection for Mobile Instrumentation Tools
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods and systems fail to effectively detect and disable instrumentation tools and malware that bypass detection on mobile communication devices, posing a cybersecurity threat.
Innovation Solution
A method and system that utilize a processor to initiate communication with a mobile device, check for open ports, perform a handshake operation with a server configured to execute instrumentation tools like Frida, and determine their presence by simulating the tool and comparing expected outputs with actual responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional virus detection software and malware detection capabilities are used, then a degree of protection is provided, but some instrumentation tools and malware applications can bypass conventional countermeasures and avoid detection
Solution Approach 1:
Instead of having the mobile device detect malware locally, the patent inverts the detection approach by having an external system connect to the device and detect instrumentation tools from outside. The external system performs handshake operations and port checks to identify malicious software, reversing the traditional client-side detection model to enable more effective detection of sophisticated malware that can bypass conventional countermeasures.
2Measurement precision
If port checking and handshake operations are performed to detect instrumentation tools, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent introduces an external detection system as an intermediary between the mobile device and the analysis process. This external system handles the complex port checking and handshake operations, acting as a mediator that connects to the device through standard communication protocols. By offloading the complex detection logic to an external intermediary rather than embedding it in the mobile device itself, the system achieves high detection accuracy while managing complexity through separation of concerns.
Data Source
AI summary
A system and a method for detecting a presence of an instrumentation tool and/or a malware application, such as Frida, is provided. The method includes: initiating a communication with a mobile device; determining whether a predetermined port of the mobile device is open; connecting with the mobile device via the predetermined port; performing a handshake operation with a server that is configured to execute the instrumentation tool; and using a result of the handshake operation to determine whether the instrumentation tool is installed on the mobile device.