Mobile Malware Detection via Bytecode Vector Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus solutions for mobile devices are ineffective against malicious programs that utilize polymorphism, metamorphism, and obfuscation, as they fail to adapt to the unique characteristics of mobile platforms like Android OS, and classical malware detection methods are insufficient in revealing such threats.
Innovation Solution
A method involving a hardware processor to analyze files by identifying classes and methods, determining bytecode arrays, grouping instructions based on functionality, forming vectors, and comparing these vectors with known malicious files to determine similarity and classify files as malicious or clean.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If classical malware detection methods are used, then the detection process is simple, but they are ineffective against polymorphic and metamorphic malicious programs
Solution Approach 1:
The patent transforms the detection approach by changing parameters from comparing original code to comparing bytecode representations. This allows detection of malicious programs even when their code structure changes through polymorphism or metamorphism, as the bytecode execution flow remains consistent for functionally equivalent code
Solution Approach 2:
The patent creates a copy of the malicious program's execution flow in the form of a bytecode array representation. This copy captures the essential behavioral characteristics without being affected by code obfuscation or transformation, enabling reliable comparison and detection
2Ease of manufacture
If antivirus programs are adapted from PC to mobile devices, then existing solutions can be reused, but they fail to account for mobile platform specificities
Solution Approach 1:
The patent adapts the detection solution to mobile platforms by focusing on local characteristics of mobile code execution, specifically the bytecode format used in Android's Dalvik virtual machine. This localized approach ensures reliability on mobile platforms while maintaining the general framework of behavioral analysis
Solution Approach 2:
The patent creates a universal detection mechanism based on bytecode analysis that can identify malicious programs across different mobile platforms. The approach is platform-agnostic in its core logic while being specifically optimized for mobile bytecode formats, enabling broad applicability
3Measurement precision
If system resources are fully utilized for antivirus scanning, then detection thoroughness improves, but mobile device limitations are exceeded
Solution Approach 1:
The patent extracts only the essential execution flow information from the malicious program into a bytecode array, omitting unnecessary details such as code obfuscation artifacts and platform-specific implementations. This extraction achieves thorough detection while minimizing resource consumption by focusing only on critical behavioral characteristics
Data Source
AI summary
Disclosed are system, method and computer program product for detecting malicious files on mobile devices. An example method includes: analyzing a file to identify classes and methods contained in said classes; identifying a bytecode array for each identified method; determining instructions contained in each method by identifying a corresponding operation code from the bytecode array of each method; dividing the determined instructions for each method into a plurality of groups based on similarity of functionality among said instructions; forming a vector for each method on the basis of the results of the division of the instructions into the plurality of groups; comparing the formed vectors with a plurality of vectors of known malicious files to determine a degree of similarity between the compared vectors; and determining whether the analyzed file is malicious or clean based on the degree of similarity between the compared vectors.