Shim Application for Mobile Malware Detection via Remote Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices face challenges in preventing malicious application installations due to limited memory and processing resources, which are further exacerbated by the need for frequent updates and bandwidth constraints in antivirus software systems.
Innovation Solution
A method involving a shim application that intercepts installation requests, generates a unique key for the application, and sends it to a back-end server for analysis, allowing the server to maintain a database of application statuses, thereby allowing or blocking installations based on the server's assessment without requiring extensive local resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus applications with malware signature databases are deployed on mobile devices, then malware detection capability is improved, but memory consumption and processing requirements exceed mobile device capabilities
Solution Approach 1:
The patent extracts the malware detection functionality from the mobile device and relocates it to a remote server. The mobile device only retains minimal local capabilities to intercept installation requests and communicate with the server, while the computationally intensive tasks of maintaining and querying malware databases are performed remotely. This extraction resolves the contradiction by eliminating the need for large memory consumption on mobile devices while maintaining comprehensive malware detection capability through server-side resources.
Solution Approach 2:
The patent introduces a communication protocol and data exchange mechanism as an intermediary between the mobile device and remote server. This intermediary layer enables the mobile device to leverage remote server resources for malware detection without directly implementing the resource-intensive database systems. The intermediary handles data transmission, request routing, and response processing, allowing the mobile device to achieve malware detection capability while consuming minimal local memory.
2Reliability
If traditional antivirus applications with frequent definition file updates are deployed on mobile devices, then malware detection capability is improved, but bandwidth consumption and data costs increase
Solution Approach 1:
The patent extracts the bandwidth-intensive definition file update functionality from the mobile device and relocates it to the remote server. Instead of downloading large definition files to mobile devices, the system performs remote lookups of application hashes against server-side malware databases. This extraction eliminates the need for frequent large-scale data transfers to mobile devices, significantly reducing bandwidth consumption while maintaining up-to-date malware detection capability through server-side updates.
Solution Approach 2:
The patent uses hash values as compact copies or representations of application binaries for identification and comparison. Instead of transferring or storing complete application files or large definition databases on mobile devices, the system generates and transmits small hash values (e.g., SHA-256 hashes) that uniquely identify applications. These compact hash copies enable efficient remote comparison against malware databases without requiring substantial bandwidth or local storage, resolving the contradiction between detection capability and bandwidth consumption.
3Reliability
If traditional antivirus scanning processes are executed on mobile devices, then malware detection capability is improved, but processing power requirements exceed mobile device capabilities
Solution Approach 1:
The patent extracts the computationally intensive malware scanning and analysis processes from the mobile device and relocates them to the remote server. The mobile device's role is reduced to intercepting installation requests, generating application hashes, and communicating with the server. The heavy lifting of malware detection, including database queries, pattern matching, and threat analysis, is performed on the server with its superior processing power. This extraction resolves the contradiction by maintaining comprehensive malware detection capability while eliminating the need for mobile devices to consume excessive processing power.
4Measurement precision
If comprehensive malware signature databases are maintained on mobile devices, then malware detection accuracy is improved, but device complexity and resource requirements increase
Solution Approach 1:
The patent extracts the complex malware signature database management and maintenance functionality from the mobile device and relocates it to the remote server. The mobile device implements a simplified system that only needs to intercept installation requests, generate application identifiers, and communicate with the server. The server handles database maintenance, signature updates, and complex detection logic. This extraction resolves the contradiction by maintaining high malware detection accuracy through comprehensive server-side databases while significantly reducing the complexity and resource requirements of the mobile device system.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A combination of shim and back-end server applications may be used to identify and block the installation of malicious applications on mobile devices. In practice, a shim application registers with a mobile device's operating system to intercept application installation operations. Upon intercepting an attempted installation operation, the shim application identifies the application seeking to be installed, generates a key uniquely identifying the application, and transmits the key over a network connection to a back-end server. The back-end server may be configured to crawl the Internet to identify malicious applications and compile and maintain a database of such applications. Upon receiving a key from the shim application, the back-end server can search its database to locate a matching application and, if found, respond to the mobile device with the application's status (e.g., malicious or not). The shim application can utilize this information to allow or block installation of the application.