Mobile Malware Detection Using AST Features for Obfuscated Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile malicious application detection methods face high false positive rates due to limitations in detecting obfuscated applications, particularly when using APIs as features, and fail to accurately classify applications based on their behaviors.
Innovation Solution
A method and apparatus that decompiles labeled applications to remove preset information, extracts Abstract Syntax Trees (AST) for each method, generates and vectorizes an AST node list as a learning dataset, and uses deep learning to classify applications as normal or malicious based on their behaviors, focusing on actual implementation features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If API-based features are used for detecting malicious applications, then the detection can identify actual behavior, but the number of usable APIs is limited and false detection rate increases
Solution Approach 1:
The patent extracts implementation features from the abstract syntax tree (AST) representation of application code, separating the essential behavioral patterns from the limited set of APIs. By transforming code structures into AST nodes and extracting meaningful features from these trees, the system can detect malicious behavior without being constrained by the limited number of detectable APIs, thereby resolving the contradiction between detection accuracy and adaptability.
2Device complexity
If static analysis of applications is performed, then the detection process is simple, but the ability to detect obfuscated applications is insufficient
Solution Approach 1:
The patent applies preliminary decompilation and AST extraction before the actual detection process. By first transforming the application code into an abstract syntax tree and extracting implementation features, the system prepares the data in a form that is resistant to obfuscation. This preliminary transformation makes the subsequent detection more reliable for obfuscated applications while maintaining reasonable process complexity through automated pipelines.
3Stability of the object's composition
If normal libraries are included in the analysis, then the application structure is preserved, but false positive rate increases
Solution Approach 1:
The patent extracts and removes normal libraries and third-party libraries from the application code before AST extraction and feature analysis. By separating these standard components from the core application logic, the system preserves the essential behavioral structure needed for detection while eliminating sources of false positives. This extraction process allows the detection system to focus on genuine malicious behavior patterns without being confused by legitimate library calls.
Data Source
AI summary
A method for detecting a mobile malicious application is disclosed. The method includes decompiling a labeled application to remove preset information; extracting abstract syntax tree (AST) that is an implementation feature for each method; generating an AST node list; generating and vectorizing the generated AST node list as a learning dataset for deep learning; generating a classification model by learning a vectorized learning dataset; and outputting a classification result of a target application based on the classification model.