Malicious App Diagnosis Using Unchangeable Common Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for diagnosing malicious applications in mobile operating systems are ineffective in identifying variant files created using automation tools, as they rely on hash values of specific files that can be easily altered.
Innovation Solution
An apparatus and method that utilize common feature information unchangeable in variant files, such as file paths, authentication certificates, and Java class features, to diagnose malicious applications by comparing collected information with stored signature data and diagnosis rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If hash values of specific files (AndroidManifest.xml and classes.dex) are used for diagnosis, then a single malicious file can be accurately diagnosed, but variant files created by automation tools cannot be diagnosed as malicious
Solution Approach 1:
The patent segments the Android application package into multiple component files (AndroidManifest.xml, classes.dex, resources.arsc, META-INF files) and extracts features from each component. By analyzing multiple segments rather than relying on a single hash value, the system can identify malicious patterns across variant files while maintaining accuracy for single file detection.
Solution Approach 2:
The patent creates a multi-functional diagnosis system that handles both single malicious files and variant files using a unified feature extraction and comparison approach. The signature database stores multiple feature types (file paths, package names, permission declarations, class structures) that can match against different kinds of malicious applications, making the system universally applicable to various malicious file formats and variants.
2Ease of manufacture
If hash values are used as signature data, then the diagnosis method is simple to implement, but the signature data can be easily altered in variant files making diagnosis ineffective
Solution Approach 1:
The patent uses composite signature data composed of multiple feature types extracted from different components of the Android application package. Instead of relying on a single hash value (analogous to a single material), the system combines file path information, package names, permission declarations, class structures, and other features into a composite signature profile. This composite approach ensures reliability even when some features are altered in variant files, as other features remain consistent for identifying the same malicious application family.
Data Source
AI summary
An apparatus for diagnosing malicious applications includes: a signature storage unit which stores malicious application executable files, which can be run in a mobile operating system, and common feature information of variant files derived from said malicious application executable files as signature data for diagnosing maliciousness; an information collection unit which collects information corresponding to common feature information from executable files which are targeted for diagnosis and are diagnosed as malicious or not; a diagnosis determination unit which compares the corresponding information collected by the information collection unit with the common feature information stored in the signature storage unit in order to determine whether the application executable files are malicious; and a result provision unit which provides the results of the determination of whether the application executable files are malicious from the diagnosis determination unit.