Rogue Software Detection via UI Characteristic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Rogue software applications that mimic legitimate software are difficult to detect, as they do not perform harmful actions and are not adequately protected by conventional anti-virus and malware-detection applications, leading to users unknowingly installing and purchasing unnecessary or harmful software.
Innovation Solution
A method and system that analyze user interface characteristics of software applications to determine legitimacy by comparing them to known legitimate applications, using binary signature detection and behavioral functions, and inspecting digital signatures and source locations to identify potential rogue software, prompting users to avoid installation and providing remediation measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-virus software is used to detect malware, then harmful software can be identified, but rogue software that mimics legitimate applications cannot be detected
Solution Approach 1:
The patent segments the detection process into multiple independent analysis components: user interface characteristic extraction, visual appearance analysis, behavioral pattern monitoring, and digital signature verification. Each component analyzes a specific aspect of the software independently, allowing the system to detect rogue software through any single anomaly without requiring all detection methods to work simultaneously.
Solution Approach 2:
The patent extends detection from traditional binary code analysis into a new dimension by analyzing user interface characteristics and visual appearance. By capturing screenshots, analyzing UI element positions, colors, fonts, and layouts, the system creates a visual fingerprint that exists in a different dimensional space than traditional malware signatures, enabling detection of rogue software that appears legitimate.
2Loss of information
If users are presented with warning screens about potential threats, then legitimate security concerns are communicated, but users cannot distinguish between legitimate warnings and rogue software deception
Solution Approach 1:
The patent implements feedback by continuously monitoring software behavior and comparing it against known legitimate application patterns. The system provides real-time feedback to users about detected anomalies, such as unusual UI characteristics or suspicious behavioral patterns, enabling users to make informed decisions about whether to proceed with installation or execution.
Solution Approach 2:
The patent introduces an intermediary analysis layer between the user and the software warning. Instead of presenting raw warning messages directly to users, the system intercepts and analyzes the warning source, examining its digital signatures, UI characteristics, and behavioral patterns to verify legitimacy before presenting the warning to the user, thereby filtering out rogue software deceptions.
3Ease of manufacture
If rogue software is designed to look like legitimate applications, then user trust is gained, but detection becomes more difficult
Solution Approach 1:
The patent analyzes visual characteristics including colors, fonts, and graphical elements to detect rogue software. By comparing color palettes, font types, button styles, and overall visual composition against databases of legitimate applications, the system can identify subtle visual deviations that indicate rogue software, even when the overall appearance is designed to be convincing.
Solution Approach 2:
The patent creates visual fingerprints and behavioral profiles of legitimate applications that serve as reference copies. These copies include captured UI layouts, element positions, and typical behavior patterns that are stored and compared against unknown applications. By having authentic reference copies, the system can detect copying or mimicry attempts by rogue software.
Data Source
AI summary
Software applications are analyzed to determine if they are legitimate applications and warnings are provided to users to avoid installation and/or purchases of unnecessary and/or potentially harmful software based on comparisons of user-interface characteristics of the software applications to visual characteristics of authentic applications to determine to what extent they match (or do not match) or are attempting to mirror the legitimate application.