Detection of malware apps that hijack app user interfaces
AssigneeTrend Micro Incorporated
InventorsLongping Wu, Liang Sun, Chengyu Fang
Life of this patent
Estimating the term…
Abstract
A computer-implement method of detecting malware apps includes receiving a sample app for a mobile operating system. The sample app is executed in an emulator of the mobile operating system. The behavior of the sample app in the emulator is monitored to collect a string that the sample app uses to detect whether or not a target app is running in a foreground of the emulator. A bait app, which is generated using the collected string, is switched to run in the foreground. The sample app is deemed to be a malware app when the sample app instead of the bait app is running in the foreground.
Claims14
A computer-implemented method of detecting malware apps that hijack app user interfaces, the method comprising:
- receiving a sample app of a mobile operating system;
- running the sample app in an emulator of the mobile operating system;
- monitoring behavior of the sample app in the emulator to collect a string that the sample app uses to detect whether or not a target app is currently running in a foreground of the emulator, wherein the collected string is a string employed by the sample app to detect a name of an activity of the target app;
- generating a bait app configured as bait for a malware app to hijack using the collected string, wherein an activity of the bait app has the same name of the activity of the target app;
- switching the bait app to run in the foreground;
- and
- in response to switching the bait app to run in the foreground, deeming the sample app to be a malware app when the sample app instead of the bait app is running in the foreground.
A computer system for detecting malware apps that hijack app user interfaces, the computer system comprising a memory and a processor, the memory including instructions that when executed by the processor perform the steps of:
- receiving a sample app of a mobile operating system;
- running the sample app in an emulator of the mobile operating system;
- monitoring behavior of the sample app in the emulator to collect a string that the sample app uses to detect whether or not a target app is currently running in a foreground of the emulator, wherein the collected string is a string employed by the sample app to detect a name of an activity of the target app;
- generating a bait app configured as bait for a malware app to hijack using the collected string, wherein an activity of the bait app has the same name of the activity of the target app;
- switching the bait app to run in the foreground;
- and
- in response to switching the bait app to run in the foreground, deeming the sample app to be a malware app when the sample app instead of the bait app is running in the foreground.
A computer-implemented method of detecting malware apps that hijack app user interfaces, the method comprising:
- receiving a sample app of a mobile operating system;
- running the sample app in a sandbox that emulates the mobile operating system;
- monitoring a behavior of the sample app in the sandbox to collect a string that the sample app uses to detect whether or not a target app is currently running in a foreground of the emulated mobile operating system, wherein the collected string is a string employed by the sample app to detect a name of an activity of the target app;
- generating a bait app configured as bait for a malware app to hijack using the collected string, wherein an activity of the bait app has the same name of the activity of the target app;
- switching the bait app to run in the foreground;
- and
- in response to switching the bait app to run in the foreground, deeming the sample app to be a malware app when the sample app instead of the bait app is running in the foreground.
Dependencies are inferred from the claim text.