Predictive Malness Scoring for Mobile Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing prevalence of malware in personal and business mobile devices poses a significant threat to enterprise networks, as malicious applications can infiltrate and cause disruptions, resource misuse, unauthorized access, and network traffic increases, making it difficult to control access effectively.
Innovation Solution
A system and method that utilize 'epitypes' – characteristic code patterns – to predict and score the propensity for malness in applications, employing a learning model built with Predictive Model Markup Language (PMML) to classify malness levels, and a network architecture involving a malness analysis server, epitype storage server, and scoring engine server to provide real-time malness scores, enabling administrators to control access based on predefined thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then known malware can be blocked, but new and evolving malware variants cannot be detected
Solution Approach 1:
The system performs preliminary actions by building a learning model in advance using known malware epitypes and their associated malness scores. This pre-trained model is then applied to predict malness scores for new applications, enabling detection of previously unseen malware variants without requiring real-time updates of malware signatures.
Solution Approach 2:
The system creates simplified representations (epitypes) that capture the essential characteristics of malware behavior. These epitypes serve as copied patterns that can be matched against new applications, allowing the system to detect malware based on behavioral patterns rather than exact code matching, thus identifying new variants that exhibit similar malice patterns.
2Reliability
If comprehensive application analysis is performed to ensure network security, then malware detection improves, but system complexity and processing time increase
Solution Approach 1:
The system segments the malware detection task into distinct functional components: epitype extraction from applications, epitype matching against the learning model, and malness score calculation. This segmentation is implemented through separate server components (scoring engine server, epitype storage server, learning model server) that can operate independently and be scaled separately, reducing overall system complexity while maintaining comprehensive analysis capabilities.
Solution Approach 2:
The system introduces epitypes as intermediary representations between the application code and the security decision-making process. Instead of directly analyzing complex application binaries, the system extracts behavioral epitypes that serve as simplified intermediaries, making the analysis process more manageable and less computationally intensive while preserving security effectiveness.
3Reliability
If real-time malness scoring is implemented for all applications, then network protection improves, but processing speed and resource consumption decrease
Solution Approach 1:
The system applies partial action by focusing analysis only on the most relevant epitypes and characteristics needed for malness assessment, rather than performing exhaustive analysis of all application components. The learning model is trained to identify and weight only the most predictive epitype features, enabling faster processing while maintaining detection accuracy.
Solution Approach 2:
The system changes parameters by transforming application code into standardized epitype representations with specific numerical characteristics. This parameter transformation converts complex code analysis into numerical pattern matching, which can be processed more rapidly. The learning model operates on these transformed parameters rather than raw code, significantly improving processing speed for real-time scoring.
Data Source
AI summary
A system may be provided that comprises one or more servers to: receive information regarding known epitypes of malness, where the information includes malness scores and behaviors for the known epitypes of malness; store the information regarding the known epitypes of malness; generate rules for a model based on the information regarding the known epitypes of malness; input application data from an application on a device into the model; output a malness score from the model based on the application data; and allow the application and/or the device access to a network when the malness scores for the application is below a first threshold level, or block the application and/or the device access to the network when the malness score the application is above a second threshold level, where the first threshold level is less than the second threshold level.