Malicious App Detection via UI Layout Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks often involve malicious applications that masquerade as trustworthy entities by mimicking legitimate applications, making it difficult for users to distinguish between safe and malicious software, especially when the malicious application's user interface layout is suspiciously similar to that of a trusted application.
Innovation Solution
A method involving static and runtime analysis to detect malicious applications by comparing the user interface layout of a new application with that of existing trusted applications, generating alerts and preventing installation or execution if similarities are detected, and monitoring inter-process communications for potential phishing attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis is used to scan applications before installation, then security detection capability is improved, but analysis completeness deteriorates when the application's user interface is dynamically generated
Solution Approach 1:
The system performs static analysis of the application package before installation to examine code structure, imported libraries, and declared user interface layouts. This preliminary action allows early detection of phishing applications that attempt to emulate trusted applications, blocking them before they can execute or cause harm.
Solution Approach 2:
The system transitions from static analysis to runtime analysis when static analysis is indeterminate. At runtime, the system dynamically generates and captures the actual user interface layout of the executing application, enabling comparison with trusted applications even for dynamically generated interfaces that cannot be fully analyzed in advance.
2Measurement precision
If runtime analysis is performed to capture dynamically generated user interfaces, then detection capability is improved, but system resource consumption increases
Solution Approach 1:
The system performs runtime analysis selectively rather than universally. It conducts runtime user interface capture and comparison only when static analysis returns an indeterminate result, partially applying the more resource-intensive analysis only where needed to maintain detection capability while conserving system resources.
Solution Approach 2:
The system uses feedback from static analysis results to determine whether runtime analysis is necessary. When static analysis provides a definitive result (safe or malicious), runtime analysis is skipped. When static analysis is indeterminate, the system triggers runtime analysis to capture the actual user interface layout, using the feedback loop to optimize resource consumption.
3Reliability
If the system blocks installation of applications with similar user interface layouts, then security is improved, but false positives increase reducing ease of operation
Solution Approach 1:
The detection system segments the analysis into multiple independent stages: static analysis of code structure and libraries, determination of possible user interface layouts, and runtime analysis of actual user interface generation. Each stage contributes to the overall security assessment, allowing the system to gather comprehensive evidence before blocking an application, thereby reducing false positives while maintaining security.
Solution Approach 2:
The system changes the parameters of analysis based on the application's behavior. It examines code structure and imported libraries in static analysis, then transitions to capturing and comparing actual user interface layout parameters at runtime. This multi-parameter approach allows for more accurate differentiation between legitimate and malicious applications with similar interfaces, reducing false positives.
Data Source
AI summary
A first application being presented for installation on a processing system can be detected. The first application can be scanned, via a static analysis, to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system. If the static analysis is indeterminate, a runtime analysis of the first application can determine whether the interface layout implemented by the first application is suspiciously similar to the user interface layout of the second application. If the user interface layout implemented by the first application is suspiciously similar to the user interface layout of the second application installed on the processing system, the first application can be identified as being unsafe.