Mutated App Detection via Host Feature Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malware, particularly mutated applications, are inadequate as they rely on classical signature models that can be bypassed by modifying malicious code and require prior knowledge of the malware, failing to identify new or modified malware variants.
Innovation Solution
A method that involves obtaining features of an Application Under Check (AUC) and comparing them with sets of features of trusted applications to determine if it is a mutated version, using a positive signature approach that identifies the hosting app and performs a predetermined action upon detection, such as blocking or notifying the user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If classical signature models are used to detect malware, then known malware variants can be identified, but mutated or new malware cannot be detected and the system can be bypassed by code modification
Solution Approach 1:
Instead of searching for malicious code signatures, the patent inverts the approach by searching for legitimate host application signatures. The system identifies what the app should be (based on legitimate app features) rather than what it shouldn't be (malicious signatures), allowing detection of mutations by comparing against the expected legitimate version
Solution Approach 2:
The system performs preliminary analysis by extracting features from the app under check and comparing them against a database of legitimate application features before execution. This preliminary feature comparison enables early detection of mutated apps by identifying discrepancies from their legitimate host versions
2Reliability
If classical signature models require prior knowledge of malware, then known malware can be identified, but new malware without prior knowledge cannot be detected
Solution Approach 1:
The patent shifts from requiring prior knowledge of malware signatures to requiring prior knowledge of legitimate application signatures. By building a database of features from legitimate apps and comparing against these, the system can detect new malware variants by identifying deviations from legitimate app characteristics without needing pre-existing malware knowledge
3Adaptability or versatility
If code modification is made to bypass signatures, then the app can evade detection, but the underlying legitimate structure may remain identifiable
Solution Approach 1:
By inverting the detection approach to focus on legitimate host application features rather than malicious code signatures, the system can identify mutated apps even when the malicious code has been modified. The comparison against expected legitimate app structures reveals mutations regardless of how the malicious code is obfuscated or changed
Solution Approach 2:
The system creates feature representations (copies) of legitimate application characteristics and uses these to compare against the app under check. This copying approach allows identification of deviations from the legitimate version without being affected by modifications to the malicious code portions
Data Source
AI summary
System, method and product for detection of mutated apps and usage thereof. A method comprises obtaining features of an Application Under Check (AUC); comparing the features with sets of features of applications to determine a host application of the AUC; determining that the AUC is a mutated application of the host application, wherein said determined comprises comparing the AUC with the host application; and in response to said determining, performing a predetermined action. A server may be configured to perform the steps of collecting features relating to trusted applications, wherein the trusted applications are potentially useable as a basis for a mutated application, wherein the features are features that are indicative of a mutated versions of the trusted applications; and retaining the features in a repository, whereby collecting and retaining a list of positive signatures of trusted applications that are useful to approximately identify a host application of a mutated application.