Periodic Mobile Forensics for Enterprise Android Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise systems face challenges in detecting malicious activity on unsecured Android mobile devices, as current security mechanisms can only identify known malicious applications, leaving unknown threats and unauthorized users undetected, which increases the risk of data loss.
Innovation Solution
The system employs a periodic mobile forensics method that scans mobile devices for changes in memory data, reconstructs snapshot images at a remote server, and analyzes these images to detect malicious activity by comparing current and baseline data, allowing for the identification of unauthorized users and unknown threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If local virus scanners are installed on mobile devices to detect malicious applications, then known malicious applications can be detected, but unknown malicious applications and unauthorized users remain undetected
Solution Approach 1:
The system performs preliminary actions by creating a baseline image of the mobile device's file system before malicious activity occurs. This baseline serves as a reference point for detecting unknown threats, allowing the system to identify any deviations from the original state regardless of whether the threat is known or unknown.
Solution Approach 2:
The detection process is segmented into distinct phases: creating a baseline image, periodically capturing snapshot images, comparing snapshots to the baseline, and analyzing differences. This segmentation allows the system to detect unknown threats by focusing on changes rather than relying solely on signature matching.
2Measurement precision
If complete snapshot images are stored for each mobile device to enable forensic analysis, then detailed analysis is possible, but storage requirements increase significantly
Solution Approach 1:
The system extracts only the essential elements needed for forensic analysis by storing baseline images and snapshot images in a centralized repository rather than storing complete detailed images for each device. This extraction approach maintains forensic analysis capability while reducing storage requirements.
Solution Approach 2:
Instead of storing multiple complete images, the system creates copies of the baseline image and uses differential comparison with snapshot images. This copying strategy allows comprehensive forensic analysis while minimizing storage space by only retaining the essential reference images.
3Reliability
If periodic scanning is performed on all mobile devices to detect changes, then malicious activity can be detected, but system resources and processing time increase
Solution Approach 1:
The system implements periodic action by scanning mobile devices at scheduled intervals rather than continuously. Snapshot images are captured periodically and compared to baseline images, maintaining detection capability while reducing resource consumption compared to continuous monitoring.
Solution Approach 2:
The system applies partial action by focusing scanning efforts only on critical file systems and areas most likely to contain malicious activity. This selective approach maintains high detection reliability while minimizing the processing overhead and resource usage.
Data Source
AI summary
A forensics analysis is conducted on each of multiple mobile devices in an enterprise system to detect malicious activity. The systems and methods described include storing a single baseline image for the multiple mobile devices at a server. A client-side application on each mobile device scans storage locations to identify changes in data compared to a previous scan. At least a portion of the information about the changes is sent to the server. The server reconstructs snapshot images for each mobile device based on the baseline image and the received information. Malicious activity is detected by comparing the reconstructed snapshot image to a previous snapshot image for each mobile device.