Mobile Malware Detection via Permission Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods for mobile devices are ineffective in identifying malicious applications due to limited access to underlying instructions, and the increasing security risks from misconfigured cellular mobile devices pose challenges in enabling secure connectivity across diverse platforms.
Innovation Solution
A malware detection process that analyzes application permissions to determine whether an application represents malware, utilizing a threat management center to set and distribute normal and suspect permission profiles to mobile devices, allowing for the identification of malicious software without accessing underlying instructions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware detection methods (pattern matching, virus detection applications) are used on mobile devices, then detection capability is limited, but device complexity and resource consumption increase
Solution Approach 1:
The patent extracts the malware detection function from the mobile device itself and relocates it to a remote server. The mobile device only needs to send application permission data for analysis, while the complex detection algorithms and databases reside on the server. This resolves the contradiction by maintaining high detection capability through server-side analysis while keeping the mobile device simple and resource-efficient.
Solution Approach 2:
The patent introduces a remote server as an intermediary between the mobile device and the malware detection process. The server acts as a mediator that receives permission data from the device, performs comprehensive analysis using pattern matching and comparison with known malware signatures, and returns detection results. This intermediary approach enables sophisticated detection without burdening the mobile device with complex detection systems.
2Reliability
If malware detection applications are installed on mobile devices, then security monitoring is improved, but device performance and battery life deteriorate
Solution Approach 1:
The patent extracts the energy-intensive malware detection computations from the mobile device and performs them remotely on a server. The device only transmits small permission data sets and receives detection results, avoiding the high energy consumption associated with running local detection algorithms, maintaining databases, and performing pattern matching operations.
Solution Approach 2:
Instead of running full malware detection applications locally, the system uses a lightweight copying approach where only essential permission data is transmitted to the server for analysis. The server maintains copies of malware signature databases and detection algorithms, while the mobile device uses a minimal local component that does not consume significant device resources.
3Reliability
If users install multiple security applications on mobile devices, then malware protection is enhanced, but device stability and network connectivity deteriorate
Solution Approach 1:
The patent implements a universal remote server that can analyze permission data from multiple different mobile device platforms and application types using a single detection system. This server-based approach eliminates the need for users to install multiple platform-specific security applications, as one universal server provides comprehensive protection across all devices, reducing device complexity and improving stability.
Solution Approach 2:
By extracting the malware detection functionality from individual device applications and consolidating it on a remote server, the patent eliminates the conflicts and resource competition that arise from having multiple security applications installed locally. The server handles all detection operations, allowing the mobile device to maintain stability while still receiving comprehensive malware protection.
4Measurement precision
If mobile devices access underlying application instructions for malware detection, then detection accuracy is improved, but security vulnerabilities and access restrictions increase
Solution Approach 1:
The patent extracts the detection analysis process from the mobile device environment and performs it on a remote server. This extraction allows the system to achieve high detection accuracy by analyzing application permission data without requiring the mobile device to grant access to underlying instructions or sensitive system resources. The server performs the analysis in a controlled environment, eliminating security vulnerabilities associated with local access restrictions.
Data Source
AI summary
In one example, a mobile device includes a network interface configured to receive data for an application including a set of application permissions describing elements of the mobile device to which the application will have access upon installation of the application, and a processing unit configured to determine a type for the application and, based on an analysis of the set of application permissions and the type for the application, determine whether the application includes malware.