Mobile Station Malicious Activity Detection via Model-Specific Behavior Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malware on mobile stations are ineffective due to limited resources and fail to protect against 'zero-day' attacks and web-based malware, as PC-style signature matching is not feasible and network-based signature matching is inadequate.
Innovation Solution
A method using mobile-station-model-specific-behavior-analysis algorithms generated based on generic malicious behavior patterns from a network-based profiling system to analyze and detect malicious activity, allowing for efficient observation and detection of malicious operations within the mobile station, including Webkit, HLOS, kernel, driver, and hardware activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PC-style signature matching is used on mobile devices, then malware detection capability is improved, but device resources (power, memory, bandwidth) are exhausted
Solution Approach 1:
The patent extracts the heavy computational tasks of signature matching and behavior analysis from the mobile device and performs them on remote servers. The mobile device only collects data and receives instructions, significantly reducing local resource consumption while maintaining detection capability through cloud-based processing
Solution Approach 2:
The patent introduces a remote server as an intermediary between the mobile device and the malware detection system. The server receives data from the device, performs comprehensive analysis using stored signatures and behavior patterns, and sends back detection results, enabling effective malware detection without exhausting device resources
2Use of energy by moving object
If network-based signature matching is used, then device resources are conserved, but protection against zero-day attacks and web-based malware is insufficient
Solution Approach 1:
The patent performs preliminary actions by pre-storing numerous malware signatures, behavior patterns, and operational characteristics in the remote server before actual detection is needed. This allows the system to rapidly match observed mobile device behavior against a comprehensive pre-built database of malicious patterns, enabling detection of zero-day attacks without requiring real-time learning or adaptation
Solution Approach 2:
The patent changes the detection parameters from simple signature matching to comprehensive behavior pattern analysis. By monitoring multiple operational parameters (app behavior, system calls, network activity, file operations) and comparing them against stored behavior patterns, the system can detect novel malware variants that don't match traditional signatures but exhibit characteristic malicious behavior
3Measurement precision
If comprehensive behavior analysis algorithms are generated in mobile station, then detection accuracy is improved, but algorithm complexity and processing requirements increase
Solution Approach 1:
The patent creates simplified copies of complex behavior analysis algorithms that are tailored to specific mobile device models. Instead of implementing the full complex analysis system locally, the device receives pre-generated model-specific algorithm copies that capture the essential detection logic for that particular device type, reducing complexity while maintaining accuracy
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed is a method for malicious activity detection in a mobile station of a particular model. In the method, generic malicious behavior patterns are received from a network-based malicious behavior profiling system. Mobile-station-model-specificbehavior- analysis algorithms are generated in the mobile station based on the generic malicious behavior patterns. Mobile station operations may be observed to generate a mobile station activity observation. The mobile station activity observation may be analyzed using the mobile-station-model-specific-behavior-analysis algorithms to generate an activity analysis. Malicious activity may be detected based on the activity analysis.