Mobile Device Fingerprinting for Compromised Software Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices are vulnerable to malicious software that can compromise their operating systems and applications, making it difficult to detect and respond to security breaches effectively, as hackers can modify software to evade detection and corrective actions.
Innovation Solution
Implementing a hierarchical security system that stores fingerprints of software environments, compares them to a database of valid fingerprints, and performs corrective measures such as disabling accounts or evaluating risk after a deliberate delay, to identify and address compromised devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security measures are implemented to detect compromised devices, then data security is improved, but hackers can modify malicious software to evade detection
Solution Approach 1:
The system performs preliminary actions by establishing a baseline fingerprint of the un compromised software environment before malware can modify it. This baseline is created by collecting software environment characteristics (libraries, frameworks, system files) from legitimate devices and storing them as reference data. When a device is monitored, its current environment is compared against this pre-established baseline to detect deviations indicating compromise.
Solution Approach 2:
The system implements feedback by continuously monitoring software environment characteristics and comparing them against the baseline fingerprint. When deviations are detected, the system provides feedback through alerts to security administrators and can trigger automated responses. This closed-loop feedback mechanism enables dynamic detection and response to evolving malware threats.
2Speed
If corrective actions are performed immediately upon detecting compromise, then response time is improved, but hackers can react by modifying software to avoid the triggering feature
Solution Approach 1:
The system performs preliminary analysis by collecting and analyzing software environment characteristics before triggering corrective actions. It establishes a comprehensive baseline fingerprint that includes multiple components (libraries, frameworks, system files) rather than relying on a single feature. This preliminary characterization makes it harder for malware to evade detection by modifying only one element.
Solution Approach 2:
The system changes parameters by monitoring multiple software environment characteristics simultaneously rather than relying on a single parameter. It tracks variations in library versions, framework configurations, and system file states. By monitoring multiple parameters, the system creates a more robust detection mechanism that is harder for malware to circumvent through single-point modifications.
3Measurement precision
If fingerprints are compared against a large database to ensure accuracy, then detection precision is improved, but processing time increases
Solution Approach 1:
The system extracts only the essential and most discriminative software environment characteristics to form the fingerprint, rather than analyzing the entire software environment. It identifies and extracts key components (critical libraries, core frameworks, essential system files) that provide the highest detection value. This extraction approach maintains high detection accuracy while reducing the data volume that must be processed and compared.
Solution Approach 2:
The system applies local quality by focusing computational resources on comparing specific critical fingerprint elements rather than uniformly processing all software characteristics. It prioritizes comparison of high-value components that provide the most discriminative power for detecting compromise. This selective focus improves processing efficiency while maintaining detection precision.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for storing a plurality of stored fingerprints, wherein each of the stored fingerprints is associated with a respective software environment and a respective mobile device; receiving from a first mobile device a first fingerprint of a first software environment in the first mobile device; determining whether the stored fingerprints include less than a threshold amount of fingerprints identical to the first fingerprint; based on a determination that the stored fingerprints include less than the threshold amount of fingerprints identical to the first fingerprint, determining that the first software environment is a compromised software environment; and performing a corrective measure.