Malware Risk Management in Mobile OS via Virtual Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile malware detection methods are limited to rule-based or blacklist-based approaches, making them ineffective against unknown new mobile malware attacks, as they cannot detect or prepare for novel threats.
Innovation Solution
An apparatus and method that utilize a deducing unit to analyze malware characteristics under a virtual environment, a classifying unit to apply machine learning algorithms, and a calculating unit to assess risk, enabling the detection of unknown malware by categorizing asset value, threat, and vulnerability, and visualizing the risk degree for efficient detection and management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rule-based or blacklist-based methods are used for malware detection, then detection accuracy for known malware is improved, but the ability to detect unknown new malware deteriorates
Solution Approach 1:
The system performs static analysis and dynamic analysis under virtual environment in advance to extract malware characteristics before actual malware execution. This preliminary extraction of indicators of compromise (IOCs) enables the system to prepare detection signatures ahead of time, improving both detection accuracy for known malware and adaptability to new threats through continuous characteristic extraction
Solution Approach 2:
The system creates a virtual copy of the mobile operating system environment to safely execute and analyze malware behavior. By copying the target environment to a virtual sandbox, the system can observe malware characteristics without risking the actual system, enabling accurate detection while maintaining system safety and allowing analysis of unknown malware variants
2Adaptability or versatility
If machine learning algorithms are applied to classify malware behavior, then the ability to detect unknown malware is improved, but system complexity increases
Solution Approach 1:
The malware analysis system is divided into distinct modular components: static analysis unit, dynamic analysis unit under virtual environment, characteristic extraction unit, and machine learning classification unit. Each module performs a specific function and can be independently optimized or replaced, reducing overall system complexity while maintaining high detection capability for unknown malware
Solution Approach 2:
The system introduces a virtual environment sandbox as an intermediary layer between the malware and the analysis system. This intermediary enables safe execution and observation of malware behavior without direct interaction with the host system, simplifying the analysis process while improving detection accuracy through controlled observation of malware characteristics
3Measurement precision
If static analysis and dynamic analysis under virtual environment are performed, then malware characteristic extraction is improved, but analysis time increases
Solution Approach 1:
The system performs static analysis first to extract preliminary malware characteristics and indicators of compromise before executing dynamic analysis. This preliminary extraction allows the system to identify suspicious patterns early, reducing the need for extensive dynamic analysis and thereby reducing overall analysis time while maintaining high characteristic extraction accuracy
Solution Approach 2:
The system merges static analysis results with dynamic analysis observations to create a comprehensive malware profile. By combining both analysis methods and their respective findings, the system achieves high characteristic extraction accuracy while optimizing analysis time through synergistic integration of complementary analysis techniques
Data Source
AI summary
Disclosed is an apparatus for managing a risk of a malware behavior in a mobile operating system, which includes: a deducing unit configured to deduce characteristics of a malware from results of a static analysis on mobile malware data and a dynamic analysis thereon under a virtual environment by using a blacklist including an indicator of compromise (IOC) utilized in an existing mobile malware.