Neuromorphic Hardware for Mobile App Malware Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current malware detection mechanisms for mobile applications are inadequate in continuously and reliably identifying zero-day vulnerabilities and stealthy attacks, as they either require significant computational resources, miss malicious execution paths, or are evaded by adversaries through obfuscation and time-based malicious activities.

Innovation Solution

A system utilizing power-efficient neuromorphic hardware for continuous monitoring of mobile applications, which includes a neuromorphic hardware component that detects and classifies pattern anomalies associated with known malware threats, and employs Associative Transfer Entropy (ATE) and Zero-Shot Learning (ZSL) to identify new threats, filtering out false alarms and isolating applications with a risk of malware above a predetermined threshold.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If static analysis approaches are used to detect malware, then detection is fast and efficient, but the system is incapable of identifying zero-day vulnerabilities and can be easily circumvented by program obfuscation

Engineering Contradiction:
Improvedetection speedVSAvoiddetection accuracy
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The system merges static analysis and dynamic analysis into a hybrid architecture. Static analysis components provide fast initial screening using malware signatures and pattern matching, while dynamic analysis components continuously monitor runtime behavior to detect zero-day threats and obfuscated malware. The results from both analysis types are integrated to produce comprehensive security decisions, combining the speed of static methods with the reliability of dynamic methods.

Inventive Principle:
Principle #5Merging (Combining)

2Reliability

If dynamic analysis approaches are used to detect malware, then zero-day and sophisticated attacks can be detected, but the system requires additional computational power and time, often utilizing external infrastructure

Engineering Contradiction:
Improvedetection accuracyVSAvoidcomputational power
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system segments malware detection functionality into distinct modules: lightweight runtime behavior monitoring components that run continuously on the mobile device with minimal computational overhead, and more intensive analysis components that operate periodically or when triggered by suspicious events. This segmentation allows the system to maintain continuous protection while consuming acceptable power levels by alternating between low-power monitoring and higher-power analysis modes.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system implements periodic behavior analysis where full dynamic analysis is performed at scheduled intervals rather than continuously. Between periodic analyses, a lightweight monitoring layer tracks basic runtime parameters. This periodic approach reduces overall computational power consumption while maintaining detection capability, as intensive analysis is performed only when needed rather than continuously.

Inventive Principle:
Principle #19Periodic action

3Reliability

If SandBox approaches are used to analyze applications, then dynamic behavior can be monitored, but malicious execution paths can be missed if triggered by non-trivial events or if adversaries use anti-emulation techniques

Engineering Contradiction:
Improvedetection coverageVSAvoidanalysis complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system dynamically adjusts the monitoring strategy based on runtime conditions and detected behaviors. Rather than using a fixed SandBox environment with predetermined triggers, the system adapts its analysis depth and focus in response to observed application behavior. When suspicious patterns are detected, the system intensifies monitoring; when normal behavior is observed, monitoring is reduced. This dynamic approach covers more execution paths without requiring complex predetermined test scenarios.

Inventive Principle:
Principle #15Dynamics

4Reliability

If hybrid analysis combining static and dynamic approaches is used, then malware coverage is increased while false alarms are minimized, but the system complexity increases

Engineering Contradiction:
Improvemalware coverageVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system performs preliminary static analysis before initiating dynamic analysis. Static analysis components examine malware signatures, permissions, and code patterns first to identify high-risk applications. Only applications that trigger static analysis alerts or exhibit suspicious characteristics proceed to dynamic behavior monitoring. This preliminary filtering reduces the number of applications requiring complex dynamic analysis, thereby reducing overall system complexity while maintaining high malware coverage through the combined approach.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3743843B1System for continuous validation and protection of mobile applications
Publication Date: 2023.03.01 HRL LAB
  • EP3743843B1 patent drawingFigure 1
  • EP3743843B1 patent drawingFigure 2
  • EP3743843B1 patent drawingFigure 3

AI summary

Described is a low power system for mobile devices that provides continuous, behavior-based security validation of mobile device applications using neuromorphic hardware. A mobile device comprises a neuromorphic hardware component that runs on the mobile device for continuously monitoring time series related to individual mobile device application behaviors, detecting and classifying pattern anomalies associated with a known malware threat in the time series related to individual mobile device application behaviors, and generating an alert related to the known malware threat. The mobile device identifies pattern anomalies in dependency relationships of mobile device inter-application and intra-applications communications, detects pattern anomalies associated with new malware threats, and isolates a mobile device application having a risk of malware above a predetermined threshold relative to a risk management policy.