Malware Detection System and Method for Mobile Platforms

• US 20070240218A1
• Filed: 04/06/2007
• Published: 10/11/2007
• Est. Priority Date: 04/06/2006
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Tuvell, George, Venugopal, Deepak
• Granted Patent: US 9,104,871 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A system and method for detecting malware optimized for mobile platforms. The system and method compares hashed portions of one or more malware signatures to hashes hashed from a suspect application, to determine whether the suspect application is malware-free. A second stage robust hash and splatter set of pseudorandomly selected blocks of the malware signatures reduce false positives allowing for improved detection of malware.

Claims

1. A method of detecting malware, comprising:

selecting one or more first hash values hashed from a first-portion-sized string of one or more malware signatures;

hashing a plurality of first-portion-sized strings of a target application to create a plurality of second hash values; and

,

comparing said plurality of second hash values to said first hash values to determine if there is a match, wherein if there is no said match then said target application is malware-free.

2. The method of claim 1, wherein said first-portion-sized string is an entire length of said malware signatures.

3. The method of claim 1, wherein said first-portion-sized string is a prefix of said malware signatures, said prefix having a length no longer than a shortest malware signature.

4. The method of claim 1, wherein said first hash value is selected from the group consisting of:

a 32-bit value, a 64-bit value, a 96-bit value, and a 128-bit value.

5. The method of claim 1, further comprising:

selecting a first splatter set of blocks derived from a first-portion-sized string of one of said malware signatures;

deriving a second splatter set of blocks from said target application starting at a same location in said target application wherein said match occurred, wherein said first splatter set and said second splatter set are equally sized and equally patterned splatter sets of blocks; and

,

comparing said first splatter set and said second splatter set to determine if there is a splatter set match, wherein if there is no said splatter set match then said target application is malware-free.

6. The method of claim 5, wherein said deriving of said first splatter set and said second splatter set is performed using a pseudorandom function.

7. The method of claim 5, further comprising:

selecting a first rigorous hash value hashed from a second-portion-sized string of one of said malware signatures;

selecting a second rigorous hash value from a second-portion-sized string of said target application starting at a same location in said target application wherein said match occurred; and

comparing said first rigorous hash value and said second rigorous hash value to determine if there is a rigorous hash match, wherein if there is no said rigorous hash match then said target application is malware-free.

8. The method of claim 1, further comprising:

selecting a first rigorous hash value hashed from a second-portion-sized string of one of said malware signatures;

selecting a second rigorous hash value from a second-portion-sized string of said target application starting at a same location in said target application wherein said match occurred; and

comparing said first rigorous hash value and said second rigorous hash value to determine if there is a rigorous hash match, wherein if there is no said rigorous hash match then said target application is malware-free.

9. The method of claim 8, wherein said second-portion-sized string is an entire length of said malware signatures.

10. The method of claim 8, wherein said second-portion-sized string is a prefix of said malware signatures, said prefix having a length no longer than a shortest malware signature.

11. The method of claim 1, wherein a set of search values is created at an operational support system, each of said search values selected from the group consisting of:

a first hash value, a splatter set, and a rigorous hash value, said method further comprising;

distributing said set of search values to a mobile platform.

12. The method of claim 11, wherein said distributing is performed using an device independent secure management protocol.

13. The method of claim 11, wherein said distributing is performed by an operational support system.

14. The method of claim 1, further comprising:

reporting said target application to an operational support system when said target application is malware-infected.

15. A system of detecting malware, comprising:

a data store, said data store comprising a plurality of hash values hashed from a plurality of first-portion-sized strings of a plurality of malware signatures;

a hash selecting means for selecting one or more first hash values from said plurality of hash values;

a hashing means for hashing a plurality of first-portion-sized strings of a target application to create a plurality of second hash values; and

,

a hash comparing means for comparing said plurality of second hash values to said first hash values to determine if there is a match, wherein if there is no said match then said target application is malware-free.

16. The system of claim 15, wherein the system resides on a mobile platform.

17. The system of claim 16, wherein said mobile platform is selected from a group consisting of:

a mobile telephone, a smart phone, a mobile computing device, a smart handheld device, and a network element.

18. The system of claim 15, wherein said data store further comprises a plurality of splatter sets computed from said first-portion-sized strings of said malware signatures, and further comprising:

a splatter set selecting means for selecting a first splatter set from said plurality of splatter sets;

a computing means for computing a second splatter set from said target application; and

,

a splatter set comparing means for comparing said second splatter set to said first splatter set to determine if there is a splatter set match, wherein if there is no said splatter set match then said target application is malware-free.

19. The system of claim 18, wherein said data store further comprises a plurality of rigorous hash values rigorously hashed from said plurality of second-portion-sized strings of said plurality of malware signatures, and further comprising:

a rigorous hash selecting means for selecting a first rigorous hash value from said plurality of rigorous hash values;

a rigorous hashing means for rigorous hashing a second rigorous hash value from said target application; and

,

a rigorous hash comparing means for comparing said second rigorous hash value to said first rigorous hash value to determine if there is a rigorous hash match, wherein if there is no said rigorous hash match then said target application is malware-free.

20. The system of claim 15, wherein said data store further comprises a plurality of rigorous hash values rigorously hashed from said plurality of second-portion-sized strings of said plurality of malware signatures, and further comprising:

a rigorous hash selecting means for selecting a first rigorous hash value from said plurality of rigorous hash values;

a rigorous hashing means for rigorous hashing a second rigorous hash value from said target application; and

a rigorous hash comparing means for comparing said second rigorous hash value to said first rigorous hash value to determine if there is a rigorous hash match, wherein if there is no said rigorous hash match then said target application is malware-free.

21. The system of claim 15, further comprising:

a receiving means for allowing an operational support system to modify said data store.

22. The system of claim 15, wherein said receiving means supports a device independent secure management protocol.

23. The system of claim 15, further comprising:

a reporting means for reporting said target application to an operational support system when said target application is malware-infected.

24. A system for creating search strings to detect malware, comprising:

a hashing means for hashing a plurality of hash values from a plurality of first-portion-sized strings of a plurality of malware signatures.

25. The system of claim 24, further comprising:

a rigorous hashing means for rigorous hashing a plurality of rigorous hash values from a plurality of second-portion-sized strings of said plurality of malware signatures.

26. The system of claim 24, further comprising:

a computing means for computing a plurality of splatter sets from said first-portion-sized strings of said malware signatures.

27. The system of claim 24, comprising:

a set of search values, each of said search values selected from the group consisting of;

a first hash value, a splatter set, and a rigorous hash value; and

a distributing means for distributing said search values to a data store of a mobile platform.

28. The system of claim 27, wherein said distributing means supports a device independent secure management protocol.

29. The system of claim 24, further comprising:

an operational support system.