Mobile Terminal Malicious File Detection via API Behavior Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing antivirus solutions for mobile terminals are inadequate in detecting new and unknown malicious codes that can initiate unapproved communication, particularly in synchronous systems like CDMA, as they rely on pattern matching which is limited to known patterns.

Innovation Solution

A method and apparatus for detecting malicious files in mobile terminals by examining executable files for unapproved communication attempts using a file examination unit that checks for the presence of multiple executable files, process creation APIs, call/connection and text transmission APIs, and GUI creation APIs, determining if a file can initiate unapproved communication.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If pattern matching technique is used for detecting malicious codes, then known malicious patterns can be detected, but new types of malicious codes cannot be detected

Engineering Contradiction:

Improvedetection accuracy for known patternsVSAvoidability to detect new malicious code types

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The invention changes the detection parameters from static pattern matching to dynamic behavior analysis. Instead of matching fixed malicious code patterns, the system monitors runtime parameters such as API function calls, communication attempts, and execution behavior to detect malicious activities, enabling detection of both known and new malicious code types

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The invention transitions from static pattern databases to dynamic runtime monitoring. The detection mechanism adapts by observing the actual execution behavior of programs, including system API calls and communication attempts, allowing it to identify malicious activities based on their behavioral characteristics rather than predefined patterns

Inventive Principle:

Principle #15Dynamics

2Reliability

If comprehensive examination of executable files is performed to detect unapproved communication, then detection capability is improved, but processing time increases

Engineering Contradiction:

Improvedetection reliabilityVSAvoidfile examination time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The invention applies partial examination by focusing on specific critical behaviors rather than analyzing all aspects of executable files. The system monitors key indicators such as communication API calls and unapproved network activities, performing sufficient examination to detect malicious behavior without exhaustive analysis of all file characteristics

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The system performs preliminary classification to identify executable files that require examination, then applies targeted monitoring only to those files. This preliminary sorting allows the system to prepare for potential malicious activities in advance while avoiding unnecessary examination of benign files

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8166543B2Apparatus and method for detecting malicious file in mobile terminal

Publication Date: 2012.04.24 ELECTRONICS & TELECOMM RES INST

AI summary

Provided is an apparatus and method for detecting a malicious file that attempts to initiate communication in a mobile terminal without a user's approval. The method of detecting a malicious file in a mobile terminal includes: determining whether a file to be examined is an executable file; when the file is an executable file, examining whether the file is a malicious file that can cause unapproved communication based on at least one predetermined examination condition; and outputting the result of examining whether the file is the malicious file. Accordingly, an attack caused by a new type of malicious code can be coped with.