Illegitimate Application Detection via System File Timing Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anti-malware techniques are costly and ineffective on mobile platforms due to their reliance on static-string-based detection mechanisms, which can be circumvented by malware authors, and fail to detect malicious applications that modify system files without user awareness.
Innovation Solution
A system and method that identifies illegitimate applications by detecting changes to system files prior to their installation, determining the timing and legitimacy of these changes, and performing remediation actions, such as uninstallation or quarantine, to prevent malicious rooting and additional illegitimate application installations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static-string-based malware detection techniques are used, then detection capability is provided, but detection effectiveness deteriorates because malware authors can circumvent these mechanisms by modifying their malware
Solution Approach 1:
The system performs preliminary actions by monitoring and recording system file states before application installation occurs. This allows the system to establish a baseline of legitimate system files and subsequently detect any unauthorized modifications that occur after installation, thereby preventing malware from evading detection through post-installation modifications.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring system file changes and comparing them against the recorded baseline state. When changes are detected, the system provides feedback by identifying the responsible application and triggering appropriate remediation actions, creating a closed-loop detection system that adapts to new threats.
2Reliability
If traditional anti-malware techniques are deployed on mobile platforms, then malware detection is attempted, but computational cost increases making the approach impractical for mobile devices
Solution Approach 1:
The system extracts only the essential monitoring function from complex anti-malware analysis by focusing solely on detecting system file changes. This extraction approach allows mobile devices to perform lightweight file integrity monitoring without the heavy computational burden of traditional static-string-based malware scanning, significantly reducing energy consumption while maintaining detection effectiveness.
3Measurement precision
If the system monitors system file changes to detect illegitimate applications, then detection accuracy improves, but system complexity increases due to the need to track and compare file states
Solution Approach 1:
The system applies local quality by focusing monitoring efforts specifically on system files with privileged access rather than all files on the device. This targeted approach maintains high detection accuracy for malicious applications while minimizing system complexity by limiting the scope of file state tracking to only those files most likely to be modified by illegitimate applications.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method for detecting illegitimate applications may include 1) identifying an installation of an application on a computing system, 2) determining, in response to identifying the installation of the application, that at least one system file with privileged access on the computing system has changed prior to the installation of the application, 3) determining that the application is illegitimate based at least in part on a time of the installation of the application relative to a time of a change to the system file, and 4) performing a remediation action on the application in response to determining that the application is illegitimate. Various other methods, systems, and computer-readable media are also disclosed.