Rogue Software Detection via Interface and Signature Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Rogue software applications deceive users by mimicking legitimate software, making it difficult for conventional anti-virus and malware detection systems to identify and remove them, as these applications do not perform harmful actions that would trigger detection.
Innovation Solution
A method and system that analyze user-interface characteristics of software applications to determine legitimacy by comparing them to known legitimate applications, using binary signature detection and behavioral analysis, and presenting warnings to users to avoid installation and purchase of potentially harmful software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-virus and malware detection systems are used, then harmful malware can be detected and removed, but rogue software applications that mimic legitimate software cannot be identified
Solution Approach 1:
Instead of detecting rogue software by looking for harmful actions (traditional approach), the patent inverts the approach by detecting what legitimate software typically does have (digital signatures, update mechanisms, developer information) and identifying applications that lack these characteristics. This inversion enables detection of rogue software that mimics legitimate behavior without performing harmful actions.
Solution Approach 2:
The patent introduces an intermediary analysis layer that examines intermediate characteristics between completely benign software and malicious software. By analyzing the presence or absence of legitimate software attributes (digital signatures, update servers, developer credentials) rather than looking for malware behavior, the system can identify rogue applications that fall in this intermediate category.
2Measurement precision
If binary signature detection and behavioral analysis are used, then malware can be detected, but rogue software with legitimate-like behavior cannot be distinguished
Solution Approach 1:
The patent segments the detection process into multiple independent analysis components: digital signature verification, update mechanism analysis, developer information verification, and behavioral monitoring. Each segment checks for specific legitimate software characteristics, and the combination of these segmented analyses provides comprehensive identification of rogue software while maintaining precision in detecting actual malware.
3Measurement precision
If user-interface characteristics are compared to known legitimate applications, then rogue software mimicking legitimate apps can be identified, but false positives may occur
Solution Approach 1:
The patent applies partial verification by checking multiple legitimate software characteristics (digital signature, update mechanism, developer information, user interface) but requiring only a subset of these to be present for identification. This partial action approach improves detection of rogue software while reducing false positives, as rogue applications typically fail multiple checks rather than perfectly mimicking all aspects of legitimate software.
Data Source
AI summary
Software applications are analyzed to determine if they are legitimate applications and warnings are provided to users to avoid installation and/or purchases of unnecessary and/or potentially harmful software based on comparisons of user-interface characteristics of the software applications to visual characteristics of authentic applications to determine to what extent they match (or do not match) or are attempting to mirror the legitimate application.