Mobile Web Malware Detection via Behavioral Emulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices are vulnerable to drive-by malware attacks that infect devices simply by visiting compromised webpages, exploiting browser vulnerabilities and compromising user data without user interaction, posing risks such as backdoor access and resource exhaustion.
Innovation Solution
Implementing a behavioral analysis system that emulates a mobile device operating system to analyze webpages for malicious behavior, combining soft and hard signals to determine the likelihood of malware presence, and taking proactive measures such as blocking or redirecting users from infected sites to prevent infection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If mobile devices access webpages directly, then user convenience and access speed are improved, but vulnerability to drive-by malware attacks increases
Solution Approach 1:
The patent introduces a server-based intermediary system that acts as a mediator between mobile devices and webpages. The server performs behavioral analysis of webpages before they are accessed by mobile devices, analyzing JavaScript code and simulated device behaviors to detect malware. This intermediary layer allows users to access webpages conveniently while the server filters out malicious content, thus resolving the contradiction between ease of operation and security risk.
Solution Approach 2:
The patent implements preliminary analysis of webpages on the server side before they reach mobile devices. The system pre-analyzes webpage content, JavaScript code, and potential malicious behaviors by simulating mobile device interactions. This preliminary action identifies and flags malicious webpages before user access, allowing the system to block or warn users about infected sites while maintaining convenient access to safe content.
2Measurement precision
If behavioral analysis is performed on all webpages, then malware detection accuracy is improved, but system complexity and processing time increase
Solution Approach 1:
The patent segments the malware detection system into distinct functional modules: a behavioral analysis server that handles complex JavaScript and malware detection, and mobile devices that simply access webpages and receive security decisions. The analysis process itself is segmented into multiple stages including code parsing, behavior simulation, and threat assessment. This segmentation allows high-accuracy analysis to be performed centrally while keeping individual device complexity low.
Solution Approach 2:
The server acts as an intermediary that centralizes the complex behavioral analysis processing. Instead of requiring each mobile device to perform complex malware analysis, the server handles all sophisticated JavaScript parsing, behavior simulation, and malware detection. This intermediary approach maintains high detection accuracy while simplifying the complexity burden from individual devices to a centralized system.
3Productivity
If users visit more webpages, then information access is improved, but exposure to malicious content and resource exhaustion increases
Solution Approach 1:
The system performs preliminary security analysis of webpages before users access them. By pre-analyzing webpage content and detecting malware in advance on the server side, the system allows users to freely access information without worrying about encountering malicious content. This preliminary action protects users from resource exhaustion and security threats while maintaining high information access efficiency.
Solution Approach 2:
The system implements a feedback mechanism where analysis results from previously scanned webpages are stored and reused. When users access webpages, the system checks against previously analyzed content and only performs full behavioral analysis on new or updated pages. This feedback approach maintains high security reliability while improving information access efficiency by avoiding redundant analysis of the same content.
Data Source
AI summary
Behavioral analysis of a mobile webpage is performed to determine whether the webpage is malicious. During analysis, the webpage is visited by an emulated mobile device to cause behaviors to occur which may be malicious. The behaviors occurring after accessing the webpage are stored. The behaviors are classified as hard or soft signals. A probability of the webpage being malicious is determined through combining soft signals, and the webpage is classified as malicious or non-malicious. Users of the webpage, the developer of the webpage, or a distributor of the webpage are notified of the webpage classification to enable responsive action.