Malicious Change Detection via Feature Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious applications on mobile operating systems face challenges in accurately identifying embedded malicious code, leading to false positives and inability to differentiate between legitimate and malicious functionalities, especially with rapidly evolving software and increasing types of malicious software.
Innovation Solution
A method and system that analyze applications by calculating sets of features, identifying distinguishing features between similar files, and using heuristic or signature analysis to detect potentially malicious changes, focusing on API functions, code loaders, and encrypted resources to reduce false identifications and enhance operational accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If generalized heuristic search for malicious code is used, then detection coverage is improved, but false positive rate increases
Solution Approach 1:
The patent segments the application analysis by comparing only specific modified files against their original versions, rather than analyzing the entire application. This segmentation focuses the heuristic search on differential changes, improving detection coverage for malicious code while reducing false positives by excluding analysis of legitimate unchanged portions.
Solution Approach 2:
The patent applies local quality by performing detailed heuristic analysis only on the differential portions of applications (the changes between versions), rather than uniformly analyzing entire applications. This localized approach concentrates detection resources on potentially malicious modifications while avoiding false positives from legitimate code.
2Measurement precision
If entire application analysis is performed, then detection accuracy is improved, but analysis time increases
Solution Approach 1:
The patent divides the application into original and modified segments, performing comprehensive analysis only on the differential portion. This segmentation maintains detection accuracy for malicious changes while significantly reducing analysis time by excluding examination of unchanged legitimate code.
Solution Approach 2:
The patent applies partial action by performing full heuristic analysis only on the necessary differential portion rather than the entire application. This partial analysis approach achieves sufficient detection accuracy for security purposes while minimizing time loss.
3Measurement precision
If feature-based comparison is used, then differentiation between legitimate and malicious changes is improved, but feature calculation complexity increases
Solution Approach 1:
The patent extracts and compares only specific feature sets that are relevant to detecting malicious changes (such as API calls, permissions, and code structures) rather than analyzing all possible features. This extraction approach improves differentiation accuracy while reducing calculation complexity by focusing on discriminative features.
Solution Approach 2:
The patent uses universal feature representations that can serve multiple detection purposes simultaneously. The same feature set is used for both identifying malicious changes and classifying their types, reducing overall calculation complexity while maintaining high differentiation accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems and methods for detecting potentially malicious changes in an application. In one example, an exemplary method comprises, selecting a first file to be analyzed and at least one second file similar to the first file, for each of the at least one second file, calculating at least one set of features, identifying a set of distinguishing features of the first file by finding, for each of the at least one second file, a difference between a set of features of the first file and the calculated at least one set of features of the second file, and detecting a presence of potentially malicious changes in the identified set of distinguishing features of the first file.