Handler Functions for Malware Detection in Mobile Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing popularity of mobile devices and wireless communication systems has led to new security challenges, including malware threats and unauthorized access, which existing technologies have not adequately addressed, particularly in protecting mobile platforms like Android and iOS.
Innovation Solution
A system that creates an isolated environment, or container, on mobile devices to control access to protected resources by replacing application programming interface (API) functions with handler functions, which analyze and manage access to prevent malicious behavior, including blocking or warning users of potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If applications are placed in an isolated environment with handler functions to control access to protected resources, then security against malware and unauthorized access is improved, but device complexity increases due to the need for modified applications and handler function libraries
Solution Approach 1:
The patent introduces handler functions as intermediary components between applications and protected system resources. These handlers intercept API function calls, analyze them for malicious behavior, and control access to protected resources. This intermediary layer enables security monitoring without requiring fundamental changes to the application execution model, thus improving security while managing complexity through a standardized interface.
Solution Approach 2:
The system segments the application execution environment by creating isolated containers with controlled access to system resources. Each container has its own set of handler functions that manage access to protected resources, allowing security policies to be applied at the container level. This segmentation enables granular security control while maintaining independence between different application environments.
2Measurement precision
If API function calls are monitored and analyzed for malicious behavior characteristics, then detection precision of malware is improved, but processing time increases due to the analysis overhead
Solution Approach 1:
The handler functions implement partial monitoring by focusing analysis on specific API function calls that are more likely to exhibit malicious behavior characteristics. Rather than analyzing every single API call in detail, the system applies targeted analysis to suspicious patterns while allowing routine operations to proceed with minimal overhead, thus balancing detection precision with processing time.
Solution Approach 2:
The system performs preliminary analysis of API function calls by establishing baseline behavior patterns and pre-defining malicious behavior characteristics. Handler functions are pre-configured with security policies and detection rules, enabling rapid comparison against incoming API calls without requiring complex real-time analysis, thereby reducing processing time while maintaining detection precision.
Data Source
AI summary
Disclosed system and methods for detecting malicious applications. The system provides a library of handler functions. The handlers functions control access of one or more applications to protected resources on a user device. The system also modifies the one or more applications to access the library of handler functions instead of corresponding application program interface (API) functions of the user device. The handler functions receive API function calls from a modified application. The system analyzes the received API function calls for malicious behavior characteristics. When the API function calls do not exhibit malicious behavior characteristics, the handler functions perform the API function calls to the protected resources. When the API function calls exhibit malicious behavior characteristics, the system prevents access of the modified application to the protected resources.