Mobile Intrusion Detection Using Log-Based Program Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Determining whether a program is performing a targeted intrusion on a computing device, particularly mobile devices, is difficult due to operating systems designed to prevent real-time monitoring, making it challenging to identify malware or unauthorized access to system resources.
Innovation Solution
A system generates a log file that records details of all installed and executing programs, which is analyzed to determine if any program is indicative of bypassing restricted mode or performing a targeted intrusion, with the analysis potentially occurring locally or remotely to ensure real-time detection and mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the operating system prevents real-time monitoring of programs, then device security and stability are maintained, but the ability to detect malware and targeted intrusions is significantly limited
Solution Approach 1:
The system performs preliminary actions by generating comprehensive log files that record detailed information about all installed and executing programs before analysis. These log files capture program behaviors, system resource access patterns, and execution metadata in advance, enabling subsequent detection of targeted intrusions without requiring continuous real-time monitoring that would compromise device security
Solution Approach 2:
The patent introduces log files as an intermediary medium between the restricted security program and the programs being monitored. Instead of directly monitoring program execution (which is blocked by OS restrictions), the system analyzes log file data that indirectly reveals program behaviors, allowing detection of malware and targeted intrusions while maintaining the operating system's security restrictions
2Measurement precision
If comprehensive log file analysis is performed to detect targeted intrusion, then detection accuracy improves, but device power consumption and processing load increase
Solution Approach 1:
The system extracts only the essential and relevant information needed for intrusion detection from comprehensive log files, rather than analyzing all log data in full. By identifying and focusing on specific indicators of targeted intrusion (such as unusual program behaviors, unauthorized access patterns, and suspicious execution sequences), the system achieves high detection accuracy while minimizing processing requirements and power consumption
Solution Approach 2:
The patent employs partial action by performing analysis on selected portions of log file data rather than complete exhaustive analysis. The system identifies key parameters and specific log entries that are most indicative of targeted intrusion, analyzing only those critical portions to achieve effective detection while reducing overall computational burden and energy usage
3Productivity
If security programs are given unrestricted access to monitor other programs, then real-time detection capability improves, but device stability and security architecture are compromised
Solution Approach 1:
The system performs preliminary data collection by generating log files that capture program execution information before security analysis begins. This preliminary action allows the security program to have comprehensive data available for analysis without requiring ongoing unrestricted access to other programs, maintaining both detection capability and system stability
Solution Approach 2:
The patent uses log files as an intermediary that enables security analysis without direct program-to-program monitoring. The security program analyzes log data rather than directly observing or interfering with other program executions, achieving effective security monitoring while preserving the operating system's stability and the integrity of the restricted mode architecture
Data Source
AI summary
Techniques to determining a program installed on a computing device may be indicative of performing a targeted intrusion of the computing device is described. A log file associated with the computing device may be generated. Various indicators from the log file may be determined. A security program may determine that the program may be indicative of performing the targeted intrusion based on at least one of the indicators. The security program may determine an action to take based on the indication of performing the targeted intrusion.