Software Trojan Detection via Source Metadata Comparison

Solution Overview

Problem

Detecting Trojan horse malware in software applications without resorting to detailed code analysis or emulation is inefficient and resource-intensive, especially in the context of application stores where malware can be disguised as legitimate applications.

Innovation Solution

A method that determines the source of a suspicious software application and compares it to the source of a known clean version, using metadata such as vendor identity, version numbers, and access controls to identify potential Trojan horses, optionally involving a backend server for comparison and verification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If detailed code analysis or emulation is used to detect Trojan horses, then detection accuracy is improved, but detection time and resource consumption increase significantly

Engineering Contradiction:

Improvedetection accuracyVSAvoiddetection time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies preliminary action by pre-collecting and storing metadata (such as digital signatures, hash values, vendor information, and application characteristics) from legitimate application stores before detection is needed. When a suspicious application is encountered, the system compares its metadata against the pre-stored legitimate metadata, enabling rapid detection without time-consuming code analysis or emulation.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent extracts only the essential identifying metadata from applications (such as digital signatures, vendor information, and application characteristics) rather than analyzing the complete application code. This extraction approach maintains detection accuracy by focusing on key identifying features while dramatically reducing the time and computational resources required for comparison.

Inventive Principle:

Principle #2Taking out (Extraction)

2Measurement precision

If detailed code analysis or emulation is used to detect Trojan horses, then detection accuracy is improved, but computational resources and processing power increase significantly

Engineering Contradiction:

Improvedetection accuracyVSAvoidcomputational resources

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent extracts only the essential identifying metadata from applications (such as digital signatures, vendor information, and application characteristics) rather than analyzing the complete application code. This extraction approach maintains detection accuracy by focusing on key identifying features while dramatically reducing the time and computational resources required for comparison.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent uses lightweight metadata comparisons instead of resource-intensive code analysis or emulation. The metadata structures are designed to be computationally inexpensive to process, enabling rapid detection with minimal energy consumption while maintaining effective Trojan horse identification.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Productivity

If metadata comparison is used to detect Trojan horses, then detection speed is improved, but detection complexity decreases requiring simpler analysis methods

Engineering Contradiction:

Improvedetection speedVSAvoiddetection method complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-collecting and storing metadata (such as digital signatures, hash values, vendor information, and application characteristics) from legitimate application stores before detection is needed. When a suspicious application is encountered, the system compares its metadata against the pre-stored legitimate metadata, enabling rapid detection without time-consuming code analysis or emulation.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8726387B2Detecting a trojan horse

Publication Date: 2014.05.13 RPX CORP

AI summary

A method and apparatus for detecting a Trojan horse in a suspicious version of a software application in the form of at least one electronic file. A computer device determines a source from which the suspicious version of the software application was obtained. A comparison is then made between the source from which the suspicious version of the software application was obtained and a source from which an original, clean version of the software application was obtained. If the sources differ, then it is determined that the suspicious version of the software application is more likely to contain a Trojan horse than if the sources were the same.