Kernel Module Malware Detection via System Call Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile application vetting methods, whether automated or manual, face challenges in reliably detecting malware, with automated systems being inefficient and manual analysis being costly and time-consuming, while also risking detection by advanced malware.
Innovation Solution
A hybrid system that combines automated and manual analysis techniques by capturing and analyzing system calls between mobile applications and the operating system, formatting data for human readability, and utilizing a kernel module to monitor and log system calls without impacting performance, allowing for efficient detection of malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated emulation environments are used to vet mobile applications, then the vetting process becomes more efficient and scalable, but advanced malware can easily detect the emulation environment and avoid analysis
Solution Approach 1:
The system segments the analysis process into multiple stages: automated static analysis of application code, automated dynamic analysis through controlled execution, and manual review of generated artifacts. This segmentation allows efficient automated processing while reserving human expertise for cases requiring sophisticated judgment, thereby maintaining both productivity and detection reliability
Solution Approach 2:
The system introduces an intermediary layer that generates and analyzes artifacts (such as modified application code, execution logs, and behavioral data) created during controlled execution. This intermediary approach enables detection of malware behaviors without requiring the malware to directly interact with the analyst, improving both efficiency and detection capability
2Reliability
If manual analysis is used to vet mobile applications, then detection reliability improves, but the process becomes expensive and time-consuming
Solution Approach 1:
The analysis workflow is divided into automated preliminary processing and manual expert review stages. Automated tools perform initial scanning, code analysis, and behavioral monitoring to generate structured artifacts, which are then reviewed by human analysts. This segmentation enables high-volume processing while maintaining expert-level detection reliability for complex cases
Solution Approach 2:
The system employs automated tools that can independently analyze application code, execute applications in controlled environments, and generate comprehensive analysis reports without human intervention. This self-service capability handles routine detection tasks efficiently, freeing human analysts to focus on complex cases requiring sophisticated judgment
3Measurement precision
If sophisticated interactive disassembler tools are used for manual analysis, then analysis reliability improves, but the cost and time requirements increase significantly
Solution Approach 1:
The system performs preliminary automated analysis of application code before manual review, generating disassembled code, identifying suspicious functions, and preparing analysis artifacts in advance. This preliminary action reduces the time required for manual analysis by pre-processing data and highlighting key areas requiring expert attention
Solution Approach 2:
The system replaces manual mechanical analysis processes with automated computational tools that can rapidly disassemble code, trace execution paths, and analyze behavioral patterns. This substitution maintains high analysis precision while dramatically reducing the time and effort required compared to purely manual approaches
Data Source
AI summary
A system and method for test a mobile device software application is provided. In one example, a mobile application can interface with an emulation environment or mobile device that has been loaded with a kernel module that is configured to intercept certain system calls made by the mobile application, log the system calls, and generate a report based on the logged system calls. A user of the test environment can interface with the environment via a web browser that can also be used to load one or more tests that can be applied to the mobile device software application.