Mobile Malware Detection via Function-Level Feature Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting repackaged or replicated mobile malware are inefficient due to their reliance on massive string distance algorithms, leading to slow and inaccurate security detection in the vast landscape of mobile software big data.
Innovation Solution
A method utilizing fuzzy hash algorithms and feature hashing to compress and compare mobile software, calculating similarity based on hash values, description entropy, and compressed strings, with the Hdsim and entropy_descpt_sim methods to determine repackaging, allowing for quick and intelligent security detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If string distance algorithms are used to compare mobile software codes, then detection accuracy can be maintained, but detection speed becomes extremely slow due to the huge volume of calculation required for big data
Solution Approach 1:
The patent segments mobile software into function-level units and extracts representative features (hash values, description entropy, compressed strings) from each function. This segmentation transforms the comparison task from analyzing entire large-scale software codes to comparing compact feature representations, dramatically reducing computational volume while maintaining detection accuracy through function-level granularity.
Solution Approach 2:
The patent extracts key representative features (hash values, description entropy, compressed strings) from mobile software functions as fingerprints. By taking out these essential characteristics rather than comparing complete software codes, the system achieves rapid comparison with reduced computational overhead while preserving the ability to detect repackaged or replicated malware accurately.
2Reliability
If traditional code comparison methods are used on massive mobile software data, then comprehensive analysis can be performed, but the computational complexity and time required become unmanageable
Solution Approach 1:
The patent transforms the comparison problem by changing parameters from raw code content to derived features (hash values, description entropy, compressed strings). This parameter transformation maintains detection comprehensiveness by capturing essential function characteristics while dramatically reducing computational complexity through dimensionality reduction and feature abstraction.
Solution Approach 2:
The patent creates simplified copies (feature representations) of mobile software functions instead of working with complete code. These copies contain essential identifying characteristics (hash values, entropy, compressed strings) that enable comprehensive comparison with minimal computational resources, effectively replacing complex original data with manageable representations.
Data Source
AI summary
A method for detecting mobile malware, including step S1: compressing a mobile software subject to detection and a primary mobile software each containing N functions, wherein each of the functions is compressed into a hash value, a description entropy and a compressed string; S2: calculating a quantity of identical functions between the mobile software subject to detection and the primary mobile software; and then finding out a quantity of similar functions using Hdsim method or entropy_descpt_sim method; and then calculating a degree of similarity to obtain a value of similarity; S3: comparing the value of similarity with a predetermined threshold value; if the value of similarity is greater then or equal to the predetermined threshold value, the mobile software subject to detection is suspected to repackaging; if the value of similarity is smaller than the predetermined threshold value, the mobile software subject to detection is not suspected to repackaging.