Static Malware Detection via Package Name and Icon Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware detection methods, such as signature-based detection and dynamic analysis, are inefficient for mobile devices due to storage and computational limitations, and are time-consuming and costly for low-power devices like mobile phones.
Innovation Solution
A system using machine learning for generic and static malware detection, which involves extracting package names from executable applications, classifying them using a language model, and further evaluating icons with a deep neural network (DNN) model for classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection is used for malware detection, then detection accuracy is improved, but storage space and computational ability requirements increase
Solution Approach 1:
The patent extracts only the essential features (package names and icons) from the malware installation package, rather than storing and analyzing the entire package or using comprehensive signatures. This extraction approach maintains detection accuracy while significantly reducing storage requirements on mobile devices.
Solution Approach 2:
The detection process is segmented into two stages: first analyzing package names using a language model, then analyzing icons using a DNN model only for packages that pass the first stage. This segmentation reduces overall computational burden and storage requirements while maintaining high detection accuracy.
2Reliability
If dynamic analysis is performed for malware detection, then detection reliability is improved, but time consumption and computational cost increase
Solution Approach 1:
The patent performs preliminary static analysis of package names and icons before any dynamic execution. The language model evaluates package names and the DNN model evaluates icons in advance, filtering out obviously malicious packages without requiring full dynamic analysis, thus reducing time consumption while maintaining reliability.
Solution Approach 2:
Instead of performing complete dynamic analysis on all packages, the system applies partial analysis (static analysis of package names and icons) to all packages, and only performs full dynamic analysis on packages that pass the preliminary filters. This partial action approach maintains detection reliability while significantly reducing time consumption.
Data Source
AI summary
Systems and methods for generic and static detection of malware using machine learning are provided. According to one embodiment, a computing device receives an executable application or a part thereof. A package name associated with the received application is extracted. The received executable application is classified as being malicious or non-malicious based on evaluation of the package name using a language model. When the received executable application is classified as being non-malicious by the language model, then a further classification process is performed on the received executable application by extracting one or more icons associated with the received executable application. A set of icons of the one or more icons is evaluated using a deep neural network (DNN) model.