Malicious App Detection via Structural Feature Digests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious mobile apps, such as cryptographic hash functions and pattern-matching, face challenges with highly obfuscated variants generated by automated generation software, leading to increased computational resource consumption and high false positive rates.
Innovation Solution
Generating a structural feature digest from the manifest, bytecode, and resource parts of a mobile app, which is then compared to known malicious app digests, using a non-cryptographic hashing function to facilitate efficient detection of variants and packed apps.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If cryptographic hash functions are used to generate digests of known malicious mobile apps, then detection accuracy is improved, but the number of digests that need to be generated and matched increases significantly for highly-obfuscated variants
Solution Approach 1:
The patent segments the malicious app detection process by dividing the app into multiple parts (e.g., manifest, bytecode, resources) and generating separate digests for each part. This segmentation allows the system to detect malicious apps based on partial matches rather than requiring complete digest matches, thereby reducing the number of digests that need to be generated and matched while maintaining detection accuracy for obfuscated variants.
2Reliability
If pattern-matching is used to detect malicious mobile apps, then detection capability is improved, but patterns become useless when automated generation systems encrypt variables and values
Solution Approach 1:
The patent transforms the detection approach from pattern-matching based on character strings and regular expressions to digest-based matching of structural features. By changing the parameter being matched from text patterns to cryptographic digests of app components, the system maintains detection capability against encrypted and obfuscated variants where traditional patterns fail.
3Measurement precision
If sandboxing is used to execute and monitor runtime behavior of unknown mobile apps, then detection thoroughness is improved, but computational resource consumption increases significantly
Solution Approach 1:
The patent performs preliminary analysis by generating digests of structural features (manifest, bytecode, resources) before runtime execution. This preliminary action allows the system to detect malicious apps based on their static structural characteristics without requiring full runtime execution in a sandbox, thereby reducing computational resource consumption while maintaining detection thoroughness.
4Adaptability or versatility
If Dexofuzzy hash generator is used to generate locality-sensitive digests, then variant detection is improved, but false positive rates increase and scanning times increase
Solution Approach 1:
The patent applies local quality by generating digests for specific structural components (manifest, bytecode, resources) rather than treating the entire app as a single unit. This localized approach to digest generation allows for more precise matching and comparison, reducing false positives while maintaining the ability to detect variants through the locality-sensitive nature of structural feature analysis.
Data Source
AI summary
A mobile app is in a form of a package file. A structural feature digest is generated from contents of a manifest part, bytecode part, and resource part of the package file. A mobile device receives an unknown mobile app, generates a structural feature digest of the unknown mobile app, and sends the structural feature digests to a backend system over a computer network. In the backend system, the structural feature digest of the unknown mobile app is compared to structural feature digests of known malicious mobile apps. The unknown mobile app is detected to be malicious when its structural feature digest is similar to that of a known malicious mobile app.