# US 10,375,576 B1 · Detection of malware apps that hijack app user interfaces

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,375,576 B1
- Document ID: US10375576B1
- Status: Granted
- Kind: B1
- Application number: 15/261,361
- Filed: 2016-09-09
- Granted: 2019-08-06
- Earliest claimed: 2016-09-09
- Assignees: Trend Micro Incorporated
- Applicants: Trend Micro Incorporated
- Inventors: Longping Wu; Liang Sun; Chengyu Fang
- Web page: https://patentgrep.com/patent/US10375576B1

## CPC

- H04W 12/12: Detection or prevention of fraud
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/567: {using dedicated hardware}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer-implement method of detecting malware apps includes receiving a sample app for a mobile operating system. The sample app is executed in an emulator of the mobile operating system. The behavior of the sample app in the emulator is monitored to collect a string that the sample app uses to detect whether or not a target app is running in a foreground of the emulator. A bait app, which is generated using the collected string, is switched to run in the foreground. The sample app is deemed to be a malware app when the sample app instead of the bait app is running in the foreground.

## Claims

### Claim 1

A computer-implemented method of detecting malware apps that hijack app user interfaces, the method comprising:
receiving a sample app of a mobile operating system;
running the sample app in an emulator of the mobile operating system;
monitoring behavior of the sample app in the emulator to collect a string that the sample app uses to detect whether or not a target app is currently running in a foreground of the emulator, wherein the collected string is a string employed by the sample app to detect a name of an activity of the target app;
generating a bait app configured as bait for a malware app to hijack using the collected string, wherein an activity of the bait app has the same name of the activity of the target app;
switching the bait app to run in the foreground; and
in response to switching the bait app to run in the foreground, deeming the sample app to be a malware app when the sample app instead of the bait app is running in the foreground.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
when the sample app is found to be detecting whether or not the sample app itself is running in the foreground, running a particular app in the foreground; and
deeming the sample app to be the malware app when the sample app instead of the particular app is running in the foreground.

### Claim 3 (depends on 2)

The method of claim 2, wherein the particular app is an app of the emulator of the mobile operating system.

### Claim 4 (depends on 1)

The method of claim 1, wherein the emulator comprises a sandbox.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
comparing the collected string to strings of activity names of known apps.

### Claim 6 (depends on 1)

The method of claim 1, wherein the sample app is received from a mobile computing device over a computer network.

### Claim 7 (depends on 1)

The method of claim 1, wherein the sample app is received from a smartphone.

### Claim 8

A computer system for detecting malware apps that hijack app user interfaces, the computer system comprising a memory and a processor, the memory including instructions that when executed by the processor perform the steps of:
receiving a sample app of a mobile operating system;
running the sample app in an emulator of the mobile operating system;
monitoring behavior of the sample app in the emulator to collect a string that the sample app uses to detect whether or not a target app is currently running in a foreground of the emulator, wherein the collected string is a string employed by the sample app to detect a name of an activity of the target app;
generating a bait app configured as bait for a malware app to hijack using the collected string, wherein an activity of the bait app has the same name of the activity of the target app;
switching the bait app to run in the foreground; and
in response to switching the bait app to run in the foreground, deeming the sample app to be a malware app when the sample app instead of the bait app is running in the foreground.

### Claim 9 (depends on 8)

The computer system of claim 8, wherein the instructions further perform the steps of:
when the sample app is detected to be determining whether or not the sample app itself is running in the foreground, running a particular app in the foreground; and
deeming the sample app to be the malware app when the sample app instead of the particular app is running in the foreground.

### Claim 10 (depends on 9)

The computer system of claim 9, wherein the particular app is an app of the emulator of the mobile operating system.

### Claim 11 (depends on 8)

The computer system of claim 8, wherein the emulator comprises a sandbox.

### Claim 12 (depends on 8)

The computer system of claim 8, wherein the instructions further perform the steps of:
comparing the collected string to strings of activity names of known apps.

### Claim 13

A computer-implemented method of detecting malware apps that hijack app user interfaces, the method comprising:
receiving a sample app of a mobile operating system;
running the sample app in a sandbox that emulates the mobile operating system;
monitoring a behavior of the sample app in the sandbox to collect a string that the sample app uses to detect whether or not a target app is currently running in a foreground of the emulated mobile operating system, wherein the collected string is a string employed by the sample app to detect a name of an activity of the target app;
generating a bait app configured as bait for a malware app to hijack using the collected string, wherein an activity of the bait app has the same name of the activity of the target app;
switching the bait app to run in the foreground; and
in response to switching the bait app to run in the foreground, deeming the sample app to be a malware app when the sample app instead of the bait app is running in the foreground.

### Claim 14 (depends on 13)

The method of claim 13, further comprising:
generating the bait app using a string employed by the sample app to make string comparisons to detect whether or not the target app is currently running in the foreground.