Mobile Malware Detection via Background Permission Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anti-malware techniques are costly and ineffective on mobile platforms due to malware authors modifying their malware to circumvent static-string-based detection mechanisms, and there is a need for improved systems to detect malware that uses mobile platform permissions without user input or awareness.
Innovation Solution
A computer-implemented method and system that identifies applications using mobile platform permissions while executing as background applications, determines if the permission use is suspect, and performs remediation actions such as marking or removing the application, using modules for identification, determination, suspicion, and remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static-string-based malware detection techniques are used, then malware detection can be performed, but the detection effectiveness deteriorates because malware authors regularly modify their malware to circumvent these mechanisms
Solution Approach 1:
The patent changes the detection parameter from static string patterns to dynamic behavioral parameters. Instead of searching for fixed malware signatures, the system monitors runtime parameters such as permission usage patterns, execution context, and system calls. This transformation makes detection resilient to malware modifications because behavioral parameters remain consistent even when code strings change.
Solution Approach 2:
The patent introduces dynamic analysis by monitoring application behavior at runtime rather than performing static analysis on packaged code. The system dynamically tracks permission requests, execution context, and system interactions, allowing it to detect malware based on its operational characteristics rather than its code structure. This dynamic approach adapts to malware variations that preserve malicious intent while modifying implementation details.
2Reliability
If traditional anti-malware techniques are applied on mobile platforms, then malware detection is attempted, but the computational cost increases making the system costly to perform
Solution Approach 1:
The patent extracts only the essential behavioral parameters needed for malware detection from the complex mobile computing environment. Instead of analyzing all application code and behavior, the system focuses specifically on permission usage patterns and execution context, which are the most indicative of malicious behavior. This selective extraction reduces computational overhead while maintaining detection effectiveness.
Solution Approach 2:
The patent employs lightweight monitoring mechanisms that consume minimal computational resources. The system uses efficient data structures and algorithms to track permission requests and execution context, avoiding heavy static analysis computations. These lightweight monitoring components can be continuously executed with minimal energy consumption, making them suitable for mobile platforms with limited resources.
3Measurement precision
If comprehensive permission monitoring is implemented to detect malware, then detection accuracy improves, but the system complexity increases
Solution Approach 1:
The patent segments the permission monitoring system into distinct functional modules: permission request interceptors, execution context trackers, and anomaly detection analyzers. Each module handles a specific aspect of monitoring, processing only the relevant data for its function. This segmentation reduces overall system complexity by breaking down the comprehensive monitoring task into manageable, independent components that can be implemented and maintained separately.
Data Source
AI summary
A computer-implemented method for detecting malware may include 1) identifying an application configured to use a permission on a mobile computing platform, the permission enabling the application to access a feature of the mobile computing platform, 2) determining that the application is configured to use the permission while executing as a background application on the mobile computing platform, 3) determining that the use of the permission is suspect based on the application being configured to use the permission while executing as the background application, and 4) performing a remediation action in response to determining that the use of the permission is suspect. Various other methods, systems, and computer-readable media are also disclosed.