Malware Detection via Bait App Foreground Hijacking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting malware apps on mobile operating systems is challenging due to their ability to remain dormant unless a specific target app is present, making traditional detection methods tedious and inefficient.
Innovation Solution
A method involving a sample app executed in an emulator to monitor behavior, generate a bait app, and determine if it hijacks the user interface, with the sample app being deemed malware if it targets itself instead of the bait app.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional detection methods are used to identify malware apps, then detection accuracy may be maintained, but detection efficiency deteriorates due to tedious trial and error processes
Solution Approach 1:
The system performs preliminary analysis by extracting strings from the malware app code that are used to detect target apps. This preliminary action identifies detection mechanisms before actual malware execution, allowing the system to proactively set up bait apps with matching strings, thereby improving detection efficiency and reducing trial-and-error complexity
Solution Approach 2:
Bait apps serve as intermediaries between the detection system and malware apps. These bait apps contain specific strings that act as mediators to trigger malware detection mechanisms, enabling indirect observation of malware behavior without direct confrontation, thus simplifying the detection process while maintaining accuracy
2Reliability
If malware apps are designed to remain dormant without target apps, then malware detection difficulty increases, but malware harm potential is reduced when target apps are absent
Solution Approach 1:
The system creates simplified copies of target apps (bait apps) that contain only the necessary strings and identifiers needed to trigger malware detection. These copies replicate the essential characteristics of real target apps without their full functionality, enabling reliable malware detection while reducing the complexity of actual target app interactions
Solution Approach 2:
The system changes the parameter of app identification by extracting and utilizing string parameters from malware code. Instead of analyzing complex app behaviors or structures, the system focuses on specific string parameters that malware uses for detection, simplifying the detection mechanism while improving reliability
Data Source
AI summary
A computer-implement method of detecting malware apps includes receiving a sample app for a mobile operating system. The sample app is executed in an emulator of the mobile operating system. The behavior of the sample app in the emulator is monitored to collect a string that the sample app uses to detect whether or not a target app is running in a foreground of the emulator. A bait app, which is generated using the collected string, is switched to run in the foreground. The sample app is deemed to be a malware app when the sample app instead of the bait app is running in the foreground.