DETECTION AND FILTERING OF MALWARE BASED ON TRAFFIC OBSERVATIONS MADE IN A DISTRIBUTED MOBILE TRAFFIC MANAGEMENT SYSTEM

• US 20120278886A1
• Filed: 04/27/2012
• Published: 11/01/2012
• Est. Priority Date: 04/27/2011
• Status: Abandoned Application

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks Inc
• Inventors: Luna, Michael
• Application Number:
  US13/458,844
• Publication Number:
  US 20120278886A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: H04L 67/5683 Storage of data provided by user terminals, i.e. reverse caching
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Systems and methods for detections and filtering of malware based on traffic observations made in a distributed mobile traffic management system are disclosed. One embodiment of a method which can be implemented on a system includes, collecting information about a request or information about a response to the request initiated at the mobile device and using the information collected about the request or the response to identify or to detect malicious traffic. The information that is collected about the request or response received for the request initiated at the mobile device can be further used to determine cacheability of the response.

Claims

1. A method of detecting malicious traffic on a mobile device, the method, comprising:

collecting information about a request or information about a response to the request initiated at the mobile device;

using the information collected about the request or the response to identify or to detect malicious traffic;

wherein the information collected about the request or response received for the request initiated at the mobile device is further used to determine cacheability of the response.

2. The method of claim 1, wherein, the information includes request characteristics information associated with the request or response characteristics information associated with the response received for the request.

3. The method of claim 2, wherein, the request characteristics information includes timing characteristics between the request and other requests initiated at the mobile device.

4. The method of claim 3, wherein, the timing characteristics include, one or more of, time of day, frequency of occurrence of the requests, and time interval between the requests.

5. The method of claim 2, wherein, the request characteristics information includes periodicity information between the request and other requests initiated at the mobile device.

6. The method of claim 5, wherein, periodicity is detected when the request and the other requests generated by the same client occur at a fixed rate or nearly fixed rate;

further comprising, flagging requests as malicious or potentially malicious traffic when the requests from the same client have a change in the periodicity from prior requests.

7. The method of claim 2, wherein, the request characteristics information includes destination address information.

8. The method of claim 3, wherein, the requests and the other requests are made by a same application or appearing to be made by the same application on the mobile device or by different applications on the mobile device.

9. The method of claim 7, wherein, the destination address information includes, IP address, an URI or URL, an originating country or a destination country.

10. The method of claim 7, wherein, the destination address information is used to identify suspicious destinations based on a client making the request relative to a specified destination of the request.

11. The method of claim 10, further comprising, determining whether the specified destination of the request is an expected destination according to the client that is or appearing to make the request.

12. The method of claim 1, further comprising, in response to detecting or identifying malicious or potentially malicious traffic, generating a notification to be delivered via the mobile device.

13. The method of claim 12, wherein, the notification prompts a user of the mobile device whether the user wishes to allow the malicious or potentially malicious traffic.

14. The method of claim 12, wherein, the notification is delivered to an operating system of the mobile device or a network operator servicing the mobile device.

15. The method of claim 1, further comprising, in response to detecting or identifying malicious or potentially malicious traffic, storing information about the malicious traffic for use in subsequent detections or detection and filtering on other mobile devices.

16. A system for mobile network malware detection, the system, comprising:

means for, tracking a request generated by a client to identify associated locations of the request,

means for, analyzing the associated locations of the request generated by the client;

means for, blocking the request and other requests of the client in response to determining that the requests constitute malicious traffic or potentially malicious traffic based on the associated locations of the request;

means for, notifying a network service provider of the malicious or potentially malicious traffic.

17. The system of claim 16, wherein, the associated locations is determined from, one or more of, an IP address, a URI or URL, an originating country or a destination country of the request.

18. The system of claim 16, wherein, the associated locations is used to identify suspicious destinations based on the client making the request relative to a specified destination of the request.

19. The system of claim 16, further comprising, means for, determining whether a specified destination of the request is an expected destination according to the client that is or appearing to make the request.

20. A system for malware detection and filtering on a mobile device, the method, comprising:

a proxy server able to use information about requests initiated at the mobile device, to determine whether any of incoming or outgoing traffic from a mobile device constitute malicious or potentially malicious traffic;

wherein, the proxy server blocks the malicious or potentially malicious traffic that is incoming to the mobile device;

wherein, the proxy server also manages cache on the mobile device;

wherein, the proxy server is physically distinct from the mobile device and able to communicate wirelessly with the mobile device.

21. The system of claim 20, wherein, the proxy server intercepts or redirects the malicious or potentially malicious traffic;

wherein, the proxy server collects the information about the requests.

22. The system of claim 20, wherein, a local proxy on the mobile device collects the information about the requests and communicates the information about the requests to the proxy server.

23. The system of claim 20, wherein, the proxy server notifies one or more of multiple entities when the malicious or the potentially malicious traffic is detected,

24. The system of claim 20, wherein, the multiple entities includes, one or more of, a user of the mobile device, the mobile device, an operating system of the mobile device.

25. The system of claim 20, wherein, the multiple entities include, one or more of, a network or cellular service provider, an application service provider, Internet service provider, and content provider.

26. The system of claim 20, wherein, the information about requests includes content of the requests.

27. The system of claim 20, wherein, in response to detection that the content of the requests includes personal information, the traffic containing the requests is identified as malicious or potentially malicious.

28. The system of claim 27, wherein, personal information includes, one or more of, user information, user cache, user data, location data, browsing data, call records, application usage.

29. The system of claim 27, wherein, the personal information includes, one or more of user authentication information, credit card information, or other financial data.

30. The system of claim 20, wherein, the proxy server uses a list of blacklisted destinations to determine whether the request constitutes malicious traffic;

wherein one or more blacklisted destinations are stored on the proxy server;

wherein one or more blacklisted destinations are stored on the proxy server and aggregated from analysis of traffic requests of multiple mobile devices.