Trusted Application Operation Limiting via Suspicious Program Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems are inadequate in preventing the theft of personal data by mobile applications, as they cannot always confirm or deny unauthorized access to sensitive information, even if an application has been verified as non-malicious.
Innovation Solution
A system and method that identifies trusted applications and checks for suspicious programs using detection rules, limiting the operation of trusted applications if a suspicious program is found to access protected information without authorization, by employing an analysis module, determination module, and blocking module to terminate or remove the suspicious program.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If antivirus programs verify applications as non-malicious and grant permissions, then application functionality is improved, but data security deteriorates when suspicious programs are present
Solution Approach 1:
The system performs preliminary analysis of application interactions before granting or maintaining permissions. It monitors and analyzes how applications access protected information, establishing a baseline of legitimate behavior before suspicious programs can compromise security. This preliminary action enables the system to detect anomalies and restrict permissions proactively rather than reactively.
Solution Approach 2:
The system introduces an intermediary analysis layer between applications and protected information. This intermediary monitors application behavior, analyzes interaction patterns, and mediates access decisions based on detected suspicious activities. The intermediary enables the system to maintain security controls even when applications are verified as non-malicious by traditional antivirus programs.
2Reliability
If traditional antivirus programs are used, then basic malware detection is achieved, but protection against data theft by verified applications deteriorates
Solution Approach 1:
The system segments the security analysis into multiple independent layers: traditional antivirus malware detection, behavioral interaction analysis, and permission monitoring. Each layer operates independently to detect different types of threats. This segmentation enables the system to identify data theft risks from verified applications that traditional single-layer antivirus programs miss.
Solution Approach 2:
The system changes the detection parameters from static virus signature matching to dynamic behavioral parameter monitoring. It tracks parameters such as application access patterns to protected information, frequency of data operations, and interaction anomalies. This parameter change enables detection of data theft activities even when applications pass traditional malware scans.
3Adaptability or versatility
If applications are granted broad permissions for data access, then application utility is improved, but vulnerability to suspicious program exploitation increases
Solution Approach 1:
The system implements dynamic permission management that adjusts access rights based on real-time behavioral analysis. Applications start with granted permissions for full utility, but the system continuously monitors their behavior and dynamically restricts permissions when suspicious patterns are detected. This dynamic approach maintains application versatility while reducing exploitation vulnerability through adaptive security controls.
Solution Approach 2:
The system establishes a feedback loop that continuously monitors application behavior and adjusts permission levels accordingly. When applications exhibit legitimate behavior, full permissions are maintained for optimal utility. When suspicious patterns are detected through behavioral analysis, the system provides feedback by restricting permissions to prevent exploitation while allowing legitimate applications to continue functioning normally.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are a system and a method for limiting the operation of trusted applications in the presence of suspicious programs. An example method includes: identifying one or more trusted applications installed on a computer; collecting data about applications and programs installed on the computer; checking for the presence of one or more suspicious programs using suspicious program detection rules, wherein a program is considered to be suspicious when it can access protected information of a trusted application without authorization; and when at least one suspicious program is found, limiting the operation of the trusted application until the suspicious program is terminated or removed from the computer.