Mobile App Event Profiling for Adaptive Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods struggle to identify sophisticated malware that evades detection by altering its behavior based on device type, location, and user patterns, leading to inadequate protection for a large number of users.
Innovation Solution
A method that aggregates event sequences from multiple client devices to form a behavioral signature for determining malware, by selecting and arranging events caused by a target application across devices to identify malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional static analysis and behavioral analysis methods are used to detect malware, then detection of obvious malicious software is improved, but detection of sophisticated malware that evades detection by altering behavior is worsened
Solution Approach 1:
The patent combines static analysis and behavioral analysis into a unified detection framework that aggregates events from multiple devices. By merging individual device observations into collective event profiles, the system overcomes the limitations of each method alone - static analysis provides baseline detection while aggregated behavioral data reveals sophisticated malware patterns that individual devices cannot detect independently.
Solution Approach 2:
The patent transitions from single-device behavioral analysis to multi-device aggregated event profiling, adding a dimensional aspect of collective behavior analysis. This dimensional shift allows detection of malware that adapts to individual devices by identifying patterns across the population of infected devices, revealing malicious behavior that would be invisible in isolated single-device analysis.
2Reliability
If security software monitors individual device behavior for malicious activities, then detection of malware on that device is improved, but detection of malware that attacks only a small fraction of devices is worsened
Solution Approach 1:
The patent merges security monitoring across multiple devices by aggregating events into collective profiles. This combination allows the system to maintain reliable per-device protection while improving overall detection efficiency - devices that would individually show no malicious patterns contribute to a collective profile that reveals the malware's true nature when combined with data from other infected devices.
Solution Approach 2:
The patent segments the malware detection problem into individual device event collection and collective profile aggregation. Each device independently monitors and reports events, then the system segments and aggregates these events by malware family to create collective profiles. This segmentation allows efficient distribution of monitoring tasks while achieving comprehensive detection through combination.
3Adaptability or versatility
If sophisticated malware tailors behavior to specific device types and locations, then malware evasion and selective attack capability is improved, but observability of malicious behavior for signature development is worsened
Solution Approach 1:
The patent adds the dimension of device population aggregation to overcome the invisibility of adaptive malware behavior. By collecting and aggregating events across many devices with different characteristics, the system creates collective profiles that reveal common malicious patterns despite individual device variations. This dimensional approach transforms unobservable individual adaptive behaviors into observable collective patterns.
Solution Approach 2:
The patent applies local quality by allowing malware behavior to vary across different device contexts (local conditions) while identifying universal malicious patterns through aggregation. The system accepts and processes device-specific behavioral variations as expected local differences, then uses aggregation to extract the underlying universal malicious patterns that persist across all local variations.
Data Source
AI summary
Described systems and methods protect client devices such as personal computers and IoT devices against malicious software. In some embodiments, a plurality of client devices report the occurrence of various events to a security server, each such event caused by a local instance of a target application (e.g., mobile app) executing on a respective device. The security server then collates the behavior of the respective target application across the plurality of client devices. Some embodiments compute an aggregate event set and/or sequence combining events detected on one device with events detected on other devices, and determine whether the target application is malicious according to the aggregate event set/sequence.