Mobile Malware Detection via Bytecode Vector Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus solutions for mobile devices are ineffective against malicious programs that utilize polymorphism, metamorphism, and obfuscation, as they are not adapted to mobile platforms and struggle to detect malware due to differences in malicious actions and API functions, leading to limitations in resource usage and detection accuracy.
Innovation Solution
A method that analyzes files by identifying classes and methods, determining bytecode instructions, grouping them by functionality, forming vectors, and comparing these vectors with known malicious files to determine similarity, thereby identifying malicious files on mobile devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If classical malware detection methods (search for code similarities, line patterns) are used, then the detection process is simple and fast, but the detection accuracy is low against polymorphic and metamorphic malware
Solution Approach 1:
The patent transforms the detection approach from classical parameter-based methods (searching for code similarities and line patterns) to a functional parameter-based method (analyzing bytecode instructions and their semantic meanings). This parameter transformation enables the system to detect malware based on its functional behavior rather than its surface-level code appearance, effectively countering polymorphic and metamorphic techniques that change code appearance while preserving functionality.
Solution Approach 2:
The patent replaces the mechanical code-matching system with a semantic analysis system that interprets bytecode instructions and their meanings. Instead of mechanically comparing code strings and patterns, the system uses virtual machine execution to interpret bytecode and analyze functional semantics, thereby achieving accurate detection of obfuscated and transformed malware.
2Ease of manufacture
If antivirus programs are adapted from PC to mobile devices, then existing solutions can be reused, but they fail to account for mobile platform specifics (API functions, resource limitations)
Solution Approach 1:
The patent creates a universal detection framework based on bytecode analysis that works across different mobile platforms. By focusing on the common bytecode instruction set and virtual machine execution model rather than platform-specific APIs, the system achieves broad adaptability to mobile platforms while maintaining a unified detection approach that doesn't require separate adaptations for each platform.
Solution Approach 2:
The patent introduces bytecode analysis as an intermediary layer between the malware and the detection system. This intermediary approach allows the system to detect malware based on its functional behavior through bytecode interpretation, without being directly coupled to platform-specific APIs or implementation details, thereby achieving both reusability and adaptability.
3Device complexity
If traditional code comparison methods are used, then the analysis process is straightforward, but they cannot detect malware that uses polymorphism, metamorphism, and obfuscation techniques
Solution Approach 1:
The patent replaces simple code comparison mechanics with virtual machine-based bytecode interpretation. By executing or simulating bytecode instructions in a controlled environment and analyzing their semantic meanings and functional effects, the system can reliably detect malware regardless of polymorphic or metamorphic transformations that preserve functional behavior while changing code appearance.
Solution Approach 2:
The patent changes the analysis parameters from superficial code properties (strings, patterns, syntax) to deep functional properties (bytecode semantics, instruction meanings, operational behavior). This parameter transformation enables reliable detection of obfuscated malware by focusing on what the code actually does rather than how it looks, thereby overcoming the limitations of traditional comparison methods.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Disclosed are systems and, methods for detecting malicious files on mobile devices. An example method includes: analyzing a file to identify classes and methods contained in said classes; identifying a bytecode array for each identified method; determining instructions contained in each method by identifying a corresponding operation code from the bytecode array of each method; dividing the determined instructions for each method into a plurality of groups based on similarity of functionality among said instructions; forming a vector for each method on the basis of the results of the division of the instructions into the plurality of groups; comparing the formed vectors with a plurality of vectors of known malicious files to determine a degree of similarity between the compared vectors; and determining whether the analyzed file is malicious or clean based on the degree of similarity between the compared vectors.