Malware Detection via Package Name String Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The rapid advancement of media delivery systems and data technologies has made it challenging to detect malicious software (malware) among unknown applications, as it is inefficient to block all unknown applications due to the small percentage of malware, necessitating a method to identify potentially malicious software.
Innovation Solution
A method and apparatus for detecting malicious software on mobile devices by analyzing the package name of unknown applications in relation to categorized applications, using string metrics such as edit distance to determine the likelihood of malware presence, and categorizing applications as likely malware, indeterminate, or clean based on predetermined thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all unknown applications are blocked to avoid malware, then security reliability is improved, but system productivity deteriorates due to blocking legitimate applications
Solution Approach 1:
The patent changes the detection parameter from binary blocking (block/allow) to probabilistic scoring based on package name analysis. By calculating a malware likelihood score based on string metrics and comparing against thresholds, the system can selectively block only high-risk applications while allowing legitimate ones, thus maintaining security reliability without sacrificing productivity
Solution Approach 2:
The patent replaces the mechanical blocking mechanism with an analytical detection mechanism. Instead of universally blocking unknown applications, the system uses package name analysis, string metric calculations, and statistical comparisons to identify malware characteristics, enabling differentiated treatment that preserves both security and productivity
2Measurement precision
If malware detection analysis is performed on all unknown applications, then detection precision is improved, but processing time increases
Solution Approach 1:
The patent applies partial action by performing comprehensive package name analysis only on applications that meet certain criteria (e.g., unknown developer, suspicious permissions) while using lighter inspection for others. The system calculates string metrics and compares against malware databases selectively, achieving high detection precision for critical cases without universally applying heavy processing
Solution Approach 2:
The patent performs preliminary filtering based on package name structure and known malware patterns before conducting full analysis. By pre-identifying suspicious characteristics in the package name itself, the system can quickly eliminate benign applications or flag high-risk ones for deeper inspection, reducing overall processing time while maintaining detection precision
Data Source
AI summary
A method for detecting malicious software is described. In one embodiment, the method includes identifying an unknown application on mobile device, identifying a package name of the unknown application, analyzing the package name of the unknown application in relation to package names of one or more categorized applications, and determining a likelihood the unknown application includes malware based at least in part on analyzing the package name of the unknown application.