Devices, systems, and methods for detecting proximity-based mobile malware propagation

• US 9,553,890 B2
• Filed: 10/19/2015
• Issued: 01/24/2017
• Est. Priority Date: 12/08/2010
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Wang, Wei, Xu, Gang, de los Reyes, Gustavo
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US14/886,421
• Publication Number:
  US 20160044050A1
• Time in Patent Office: 463 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Devices, systems, and methods are disclosed. An agent resides in a mobile communication device. The agent detects Proximity-based Mobile Malware Propagation. The agent injects one or more trigger network connections in the candidate connection list. These connections appear as legitimate networks and devices, but instead trigger connection to an agent server on a service provider'"'"'s network. By attempting to connect through the trigger network connection, the malware reveals itself. The system helps collect the malware signature within a short period of time after the malware outbreak in local areas, though such attacks typically bypass network based security inspection in the network.

Claims

1. A device comprising:

a processor;

a transceiver; and

a memory that stores an agent logic that, when executed by the processor, causes the processor to perform operations comprising

compiling a list of discovered devices in a proximity of the transceiver,

creating a trigger network connection that, when selected, causes the agent logic to connect to an agent server that collects malware signatures,

inserting the trigger network connection into the list of the discovered devices,

receiving a request to connect to the trigger network connection, and

in response to receiving the request to connect to the trigger network connection, connecting to the agent server and reporting malware activity to the agent server.

2. The device of claim 1, wherein the trigger network connection appears to be a bluetooth device.

3. The device in claim 1, wherein the trigger network connection appears to be a WiFi device.

4. The device of claim 3, wherein the transceiver communicates using WiFi.

5. The device of claim 1, wherein the transceiver communicates using a short range wireless protocol.

6. The device of claim 1, wherein the request to connect to the trigger network connection is received from a malware.

7. The device of claim 6, wherein the reporting comprises sending a malware signature associated with the malware to the agent server.

8. A system comprising:

a mobile communications device that stores an agent logic that, when executed by the mobile communications device, causes the mobile communications device to perform operations comprising

compiling a list of discovered devices in a proximity of the mobile communications device,

creating a trigger network connection that, when selected, causes the agent logic to connect to an agent server,

inserting the trigger network connection into the list of the discovered devices,

receiving a request to connect to the trigger network connection, and

in response to receiving the request to connect to the trigger network connection, connecting to the agent server and reporting malware activity to the agent server.

9. The system of claim 8, wherein the discovered devices comprise a wireless access point.

10. The system of claim 8, wherein the agent logic, when executed by the mobile communications device, causes the mobile communications device to perform operations further comprising:

receiving a request to discover the discovered devices in the proximity of the mobile communications device; and

discovering the discovered devices in response to the request.

11. The system of claim 8, wherein the request to connect to the trigger network connection is received from a malware.

12. The system of claim 8, wherein the trigger network connection appears to be a WiFi device.

13. The system of claim 8, wherein the trigger network connection appears to be a bluetooth device.

14. A method comprising:

compiling, by a mobile communications device that executes an agent logic, a list of discovered devices in a proximity of the mobile communications device;

creating, by the mobile communications device, a trigger network connection that, when selected, causes the agent logic to connect to an agent server that collects malware signatures;

inserting, by the mobile communications device, the trigger network connection into the list of the discovered devices;

receiving, by the agent logic, a request to connect to the trigger network connection; and

in response to receiving the request to connect to the trigger network connection, connecting, by the mobile communications device, to the agent server and reporting malware activity to the agent server.

15. The method of claim 14, further comprising:

receiving a request to discover the discovered devices; and

discovering the discovered devices in the proximity of the mobile communications device in response to the request.

16. The method of claim 14, wherein the trigger network connection appears to be a WiFi device.

17. The method of claim 14, wherein the trigger network connection appears to be a further mobile communications device.

18. The method of claim 14, wherein the trigger network connection appears to be a bluetooth device.

19. The method of claim 14, further comprising hiding the trigger network connection.

20. The method of claim 14, wherein the request to connect to the trigger network connection is received from a malware, and wherein the reporting includes sending a malware signature associated with the malware to the agent server.