Static Analysis Vector for Mobile Malware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Detecting malware on mobile devices is challenging due to limited processing power, battery reserves, and operating system restrictions that prevent monitoring of other applications, making it difficult to effectively identify malicious software, especially when network connectivity is sparse or unavailable.

Innovation Solution

A method using static analysis to classify mobile applications as malicious or legitimate by generating vectors based on function calls, permissions requested, and presence of specific character strings, allowing for local malware detection on client devices without requiring network connectivity or monitoring of executing applications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If dynamic analysis or monitoring of application execution is used to detect malware, then detection accuracy is improved, but it requires operating system permissions and monitoring capabilities that are restricted on mobile devices

Engineering Contradiction:

Improvemalware detection accuracyVSAvoidoperating system permission requirements

Core Design Contradiction:

Measurement precisionVSEase of operation

Solution Approach 1:

Instead of monitoring application execution dynamically (traditional approach), the patent inverts the approach by performing static analysis on application code, bytecode, and manifests before execution. This allows malware detection without requiring runtime monitoring permissions that are restricted on mobile devices.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent performs malware detection analysis before the application is executed or installed. By analyzing static code characteristics, bytecode patterns, and manifest permissions in advance, the system identifies malicious applications without needing runtime monitoring capabilities.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If resource-intensive malware detection methods are used, then detection capability is improved, but mobile devices have limited processing power, battery reserves, and storage

Engineering Contradiction:

Improvemalware detection capabilityVSAvoiddevice resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent extracts only the essential static features from application code that are most indicative of malware, such as permission requests, bytecode patterns, and code structure characteristics. This selective extraction reduces processing requirements while maintaining detection effectiveness.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system uses lightweight static analysis techniques that consume minimal processing power and battery resources compared to full dynamic analysis. The analysis can be performed quickly on device without requiring sustained high-performance computing resources.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Reliability

If network connectivity is required for malware detection, then detection resources can be enhanced, but network connectivity may be sparse or bandwidth constrained

Engineering Contradiction:

Improvedetection resource availabilityVSAvoidnetwork dependency

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements self-service malware detection by providing all necessary detection capabilities locally on the mobile device. The static analysis engine and feature extraction mechanisms are embedded in the device, allowing it to autonomously analyze applications without requiring external server resources or network connectivity.

Inventive Principle:

Principle #25Self-service

4Measurement precision

If comprehensive static analysis features are collected, then malware detection accuracy is improved, but the complexity of vector generation and classification increases

Engineering Contradiction:

Improvemalware classification accuracyVSAvoidstatic analysis system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the static analysis into distinct feature categories: permission requests, bytecode patterns, code structure characteristics, and manifest information. Each segment is processed independently and then combined, making the overall system more manageable while comprehensively capturing malware indicators.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS10929532B1Detecting malware in mobile applications via static analysis

Publication Date: 2021.02.23 ZIMPERIUM INC

AI summary

A trained classifier is received from a server. Static analysis is performed on a mobile application to generate a vector storing values representing the number of times the mobile application calls functions from each of multiple namespaces, and an indication of the permissions the mobile application requests. The received trained classifier is then applied to the generated vector to identify whether the mobile application contains malware. Based on the output of the trained classifier, a security policy is applied.