Hybrid Static and Dynamic Analysis for Mobile Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques are inadequate in effectively protecting mobile devices from malicious applications (malware) due to the increasing threat of nefarious individuals and organizations targeting mobile devices with malware, especially as users shift towards mobile devices for both personal and business activities.
Innovation Solution
A system and process that combines static and dynamic analysis to detect and prevent mobile malware, utilizing a data appliance and cloud security service to intercept and analyze applications, generating signatures for known malicious files and blocking future downloads, while integrating with mobile device management to enforce security policies and deny access to enterprise resources if malware is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing security techniques are used to protect mobile devices, then some level of protection is provided, but the detection accuracy is insufficient and false positives occur frequently
Solution Approach 1:
The security analysis system is divided into two independent modules: static analysis and dynamic analysis. Each module performs different types of checks on the application - static analysis examines code structure and permissions without execution, while dynamic analysis monitors actual runtime behavior. This segmentation allows each module to specialize in detecting specific malware characteristics, improving overall detection accuracy while reducing false positives through complementary verification.
Solution Approach 2:
The patent combines static analysis and dynamic analysis into a unified security evaluation system. The results from both analysis methods are integrated to form a comprehensive security assessment. This merging allows the system to leverage the strengths of both approaches - static analysis for identifying suspicious code patterns and dynamic analysis for detecting actual malicious behavior - thereby improving detection accuracy while cross-validating results to reduce false positives.
2Reliability
If comprehensive security analysis is performed on all applications, then malware detection capability is improved, but system complexity and processing time increase
Solution Approach 1:
The system performs static analysis first, which examines application code, permissions, and structure without full execution. This preliminary action identifies obviously malicious applications early in the process, allowing the system to flag them for further review or block them immediately without requiring complex dynamic analysis. This reduces the overall system complexity by handling many cases through simpler initial checks.
Solution Approach 2:
The system applies dynamic analysis selectively rather than to all applications. After static analysis identifies applications that require deeper inspection, only those specific applications undergo resource-intensive dynamic analysis. This partial action approach maintains high security protection for applications that need it while avoiding the complexity and processing overhead of applying comprehensive analysis to every application in the ecosystem.
3Productivity
If static analysis alone is used to evaluate applications, then analysis speed is maintained, but detection accuracy is insufficient due to inability to observe actual behavior
Solution Approach 1:
Static analysis is performed as a preliminary step to quickly evaluate application code structure, permissions, and declared capabilities without execution. This maintains high analysis speed for the initial screening phase. Applications that pass or fail clear criteria during static analysis are handled quickly, preserving productivity while still gathering essential security information.
Solution Approach 2:
The system merges static analysis results with dynamic analysis results to achieve comprehensive detection accuracy. While static analysis provides fast initial evaluation, dynamic analysis supplements it by observing actual runtime behavior, network communications, and system interactions. The combination of both analysis types ensures that malware attempting to hide its true intentions during static analysis can be detected through their actual malicious behaviors during dynamic execution.
4Measurement precision
If dynamic analysis is performed on all applications, then detection accuracy improves through behavior observation, but processing time and resource consumption increase significantly
Solution Approach 1:
Dynamic analysis is applied partially rather than universally. The system uses static analysis to triage applications and identifies only those that require deeper inspection. Dynamic analysis is then performed selectively on applications that static analysis deems suspicious or high-risk. This partial application of dynamic analysis maintains high detection accuracy for problematic applications while avoiding the excessive time loss that would result from analyzing every application dynamically.
Solution Approach 2:
Static analysis serves as a preliminary filtering step that quickly processes applications and identifies candidates for dynamic analysis. This preliminary action reduces the volume of applications requiring time-consuming dynamic analysis, thereby maintaining high detection accuracy for the subset that needs it while minimizing overall time loss across the entire application ecosystem.
Data Source
AI summary
Techniques for performing static and dynamic analysis on a mobile device application are disclosed. Static analysis is performed on a mobile device application using a static analysis engine. A set of static analysis results is generated. Dynamic analysis of the application is selectively customized based at least in part on a presence of a permission in the set of static analysis results. Dynamic analysis is performed using a dynamic analysis engine. A determination of whether the application is malicious is made based at least in part on the dynamic analysis.