Pre-installation Malware Detection via Installation Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile device anti-malware systems are ineffective in detecting malware before it is installed, as they typically scan for signatures after the application is downloaded and installed, allowing potential security compromises during the installation window.
Innovation Solution
Intercepting communications of an application installation agent to identify partially downloaded applications, scanning them for malware before installation, and performing security actions if malware is detected, using a system comprising an interception module, identification module, scanning module, determination module, and security module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-malware systems scan applications after installation, then the scanning process is simple and straightforward, but the mobile device is vulnerable to malware compromise during the installation window
Solution Approach 1:
The patent implements preliminary scanning of applications before they are installed on the mobile device. The anti-malware system intercepts the application installation process, scans the application package file before installation completes, and blocks installation if malware is detected. This preliminary action eliminates the security vulnerability window that exists in traditional post-installation scanning systems.
Solution Approach 2:
The patent introduces an intermediary scanning mechanism that sits between the application installer and the mobile device file system. The anti-malware system intercepts application packages during the installation process, performs security scanning as an intermediate step, and only allows installation to proceed if the scan is clean. This intermediary layer prevents malware from reaching the device without compromising the overall system architecture.
2Measurement precision
If anti-malware systems perform comprehensive scanning, then malware detection accuracy improves, but the scanning time and installation delay increase
Solution Approach 1:
The patent implements a two-stage scanning approach where a quick preliminary scan checks for obvious malware signatures first, and only applications that pass this initial check undergo more comprehensive scanning. This partial action strategy ensures high detection accuracy for clearly malicious applications while reducing unnecessary scanning time for legitimate applications, thereby balancing security precision with installation speed.
3Reliability
If pre-installation scanning is implemented, then the security window is reduced, but the complexity of intercepting and managing installation communications increases
Solution Approach 1:
The patent implements a universal interception mechanism that handles multiple types of installation communications through a single anti-malware interface. The system can intercept application package files, installation requests, and various communication protocols using a unified scanning and blocking mechanism. This multi-functional approach reduces the complexity that would otherwise arise from implementing separate interception methods for different communication types.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method for pre-installation detection of malware on mobile devices may include intercepting one or more communications of an application installation agent that installs applications on a mobile computing device. The method may further include identifying, based on the one or more intercepted communications, an application that has been at least partially downloaded by the application installation agent. The method may also include, in response to identifying the application, and before the application is installed on the mobile computing device, scanning the application for malware. The method may additionally include determining, based on the scan, that the application contains malware. The method may finally include performing a security action in response to determining that the application contains malware. Various other methods, systems, and computer-readable media are also disclosed.