Trojan Package File Classification via Code Similarity and Signatory Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional systems for classifying mobile applications as Trojans are inefficient and time-intensive, struggling to keep up with the vast number of new applications and unable to automatically detect and differentiate between legitimate and malicious versions, especially in identifying suspicious features and signatory differences.
Innovation Solution
A computer-implemented method that detects resemblance between an unclassified package file and a known legitimate package file by comparing code and metadata, determines if the unclassified file is signed by a different signatory, and identifies suspicious features such as extra permissions or negative reputation, classifying it as a Trojan version if these conditions are met, and performs security actions like alerting developers or removing the file from stores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis is used to classify applications as Trojans, then detection accuracy can be maintained through expert judgment, but the system becomes inefficient and cannot keep up with the vast quantity of new mobile applications
Solution Approach 1:
The patent uses code similarity comparison to create a digital copy/representation of legitimate applications and compares new applications against these copies. By analyzing code structure, metadata, and features, the system automatically identifies Trojans that are modified versions of legitimate apps without requiring manual analysis of each application, thus maintaining detection accuracy while scaling to handle vast quantities of new applications
Solution Approach 2:
The patent replaces the mechanical manual analysis process with an automated computer-based system that uses algorithms to compare code similarity, analyze metadata, and detect suspicious features. This substitution of manual mechanical review with automated computational analysis enables the system to process applications at scale while maintaining consistent detection accuracy
2Difficulty of detecting and measuring
If traditional systems attempt to detect similar applications, then they can identify potential matches, but they fail to make value judgments about which applications are legitimate
Solution Approach 1:
The patent segments the analysis into distinct components: code similarity comparison, metadata analysis, signatory verification, and suspicious feature detection. By breaking down the legitimacy judgment into these separate analytical segments, the system can systematically evaluate each aspect and combine the results to make an overall determination about whether an application is legitimate or a Trojan
Solution Approach 2:
The patent introduces multiple intermediary checks between simple similarity detection and final legitimacy judgment, including signatory verification, permission analysis, and suspicious feature detection. These intermediaries act as additional validation layers that help the system make accurate value judgments about application legitimacy by examining multiple dimensions beyond just code similarity
3Measurement precision
If manual study is used to map Trojan applications to their corresponding legitimate applications, then accurate mapping can be achieved, but the process becomes time-intensive and unsustainable
Solution Approach 1:
The patent automatically creates and compares code representations (copies) of legitimate applications against new applications. By using code similarity algorithms and metadata comparison, the system can rapidly map Trojans to their legitimate counterparts without manual study, achieving accurate mapping through automated computational analysis of code structure, features, and identifying characteristics
Solution Approach 2:
The patent performs preliminary automated analysis of code similarity and metadata before any manual review would be needed. By pre-processing applications through automated comparison algorithms and identifying suspicious features early in the pipeline, the system reduces or eliminates the need for time-intensive manual mapping while maintaining accurate correspondence between Trojans and legitimate applications
Data Source
AI summary
A computer-implemented method for classifying package files as Trojans may include (1) detecting a resemblance between an unclassified package file and a known legitimate package file, (2) determining that the unclassified package file is signed by a different signatory than a signatory that signed the known legitimate package file, (3) determining that a feature of the unclassified package file is suspicious, the feature being absent from the known legitimate package file, and (4) classifying the unclassified package file as a Trojan version of the known legitimate package file based on the unclassified package file being signed by the different signatory and having the suspicious feature. Various other methods, systems, and computer-readable media are also disclosed.