Dynamic detection for mobile device security

A non-transitory computer-readable storage medium storing executable computer instructions that, when executed by one or more processors, cause the one or more processors to perform operations that detect a malicious activity on a mobile device, the malicious activity including a risk of an attack to the mobile device, the detecting, the instructions comprising instructions to:

• maintain, by the mobile device, a file that is executable on the mobile device, the file comprising a plurality of primitives, wherein each primitive comprises a piece of detection logic that, when executed, performs a security function of the mobile device;
• receive instructions, by the mobile device from a server, to chain a subset of the plurality of primitives, wherein the subset of primitives, when chained together, form a detection process for the malicious activity, the malicious activity including a risk of an attack to the mobile device and identified based on activity relating to the risk performed by a plurality of mobile devices including the mobile device, the instructions received responsive to the server identifying a vulnerability that the malicious activity may be performed on the mobile device and transmitting an indication of the vulnerability to each of the plurality of mobile devices;
• chain, by the mobile device, the subset of the plurality of primitives, by the mobile device, based on the instructions;
• and
• identify, by the mobile device, the malicious activity by executing the chained subset of primitives.

A system comprising:

• memory with instructions encoded thereon;
• and
• one or more processors that, when executing the instructions, are caused to perform operations comprising:
• maintaining, by a mobile device, a file that is executable on the mobile device, the file comprising a plurality of primitives, wherein each primitive comprises a piece of detection logic that, when executed, performs a security function of the mobile device;
• receiving instructions, by the mobile device from a server, to chain a subset of the plurality of primitives, wherein the subset of primitives, when chained together, form a detection process for malicious activity, the malicious activity including a risk of an attack to the mobile device and identified based on activity relating to the risk performed by a plurality of mobile devices including the mobile device, the instructions received responsive to the server identifying a vulnerability that the malicious activity may be performed on the mobile device and transmitting an indication of the vulnerability to each of the plurality of mobile devices;
• chaining, by the mobile device, the subset of the plurality of primitives, by the mobile device, based on the instructions;
• and
• identifying, by the mobile device, the malicious activity by executing the chained subset of primitives.