Malware Detection on Limited Access Mobile Platforms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware detection methods face challenges in mobile networks and devices due to fragmented data, limited processing power, memory constraints, and the need for frequent updates, making it difficult to efficiently detect and prevent malware on mobile platforms.
Innovation Solution
A malware detection system that uses intelligently generated signatures, hashing algorithms, on-write scanning frameworks, checksum application integrity checking, feature-based detection, and heuristic approaches to identify malware without requiring full decompression of data packets or extensive computational resources, enabling real-time monitoring and updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature detection methods are used on mobile devices, then malware detection capability is improved, but processing power and memory requirements increase significantly
Solution Approach 1:
The patent segments the malware detection process into two parts: (1) extraction of invariant features from malware samples to generate compact signatures, and (2) matching of these compact signatures against application data. This segmentation reduces the computational complexity from comprehensive binary analysis to targeted feature matching, making it feasible for mobile devices with limited resources.
Solution Approach 2:
The patent extracts only the essential invariant features from malware binaries to create compact signatures, rather than analyzing entire binaries. This extraction approach retains detection effectiveness while dramatically reducing the size and processing requirements of signature databases on mobile devices.
2Measurement precision
If comprehensive malware signature databases are maintained on mobile devices, then detection accuracy is improved, but device performance and battery life deteriorate
Solution Approach 1:
The patent changes the parameters of signature representation from complete binary data to compact invariant feature sets. This parameter transformation maintains detection accuracy by preserving essential malware characteristics while reducing signature size, thereby improving device performance and reducing battery consumption during scanning operations.
3Speed
If malware scanning is performed on compressed and fragmented data packages, then network transmission efficiency is improved, but detection accuracy worsens due to data fragmentation
Solution Approach 1:
The patent performs preliminary extraction of invariant features from malware samples before deployment to mobile devices. These pre-extracted features enable accurate detection even when application data is received in compressed or fragmented form, as the matching process operates on characteristic patterns rather than requiring complete data reconstruction.
4Reliability
If traditional binary code access methods are used on limited access mobile platforms, then malware detection capability is improved, but system compatibility worsens due to access restrictions
Solution Approach 1:
Instead of attempting to access binary code directly on restricted platforms, the patent inverts the approach by analyzing applications during installation or through alternative interfaces where access is permitted. The invariant feature extraction is performed on accessible data, and the resulting signatures are used for detection without requiring direct binary code access on the restricted platform.
Data Source
AI summary
A system and method for detecting malware on a limited access mobile platform in a mobile network. The system and method uses one or more feature sets that describe various non-executable portions of malware-infected and malware-free applications, and compares a application on the limited access mobile platform to the features sets. A match of the features in a suspect application to one of the feature sets provides an indication as to whether the suspect application is malware-infected or malware-free.