Unauthorized application detection system and method

A terminal used in a malicious application detection system, comprising a terminal on which a user is able to properly install an application and a fraud detection server for detecting a malicious action of the application installed on the terminal, wherein the terminal comprises:

• an installation state detection unit for detecting a change in an installation state of the application;
• an installation notification unit for notifying the fraud detection server of information about the installed application when the installation state is changed;
• a feature value calculation unit for calculating a specific feature value based on a file of the application or element files that form a package of the application;
• a feature value transmission unit for notifying the fraud detection server of the information about the application and the feature value of the application;
• a fraud detection information reception unit for receiving fraud detection information from the fraud detection server when the malicious action of the application is detected;
• and
• an anti-malicious action unit for performing a specific countermeasures in the terminal when the fraud detection information is received.

A fraud detection server used in a malicious application detection system comprising a terminal on which a user is able to properly install an application and a fraud detection server for detecting a malicious action of the application installed on the terminal, wherein the fraud detection server comprises:

• an installation notification reception unit for receiving the information about the installed application from the installation notification unit of the terminal;
• a feature value reception unit for receiving the feature value from the feature value transmission unit of the terminal;
• a fraud detection unit for detecting a malicious action of a registered application within the server or externally obtaining and detecting the malicious action of the registered application;
• a fraud detection result recording unit for registering the feature value, associated with the information about the malicious action, with an application DB;
• and
• a fraud detection information transmission unit for sending fraud detection information to the terminal when the malicious action of the application is detected at least.

A method of detecting a malicious application installed on a terminal using the terminal on which a user is able to properly install an application and a fraud detection server for detecting a malicious action of the application installed on the terminal, wherein the method comprises:

• an installation state detection step of detecting a change in an installation state of the application installed on the terminal;
• an installation notification step of notifying the fraud detection server of information about the installed application when the installation state is changed;
• a feature value transmission step of notifying the fraud detection server of a specific feature value based on a file of the application or element files that form a package of the application;
• a fraud detection result recording step of registering the feature value, associated with the information about the malicious action, with an application DB;
• a fraud detection information transmission step of sending fraud detection information to the terminal when the malicious action of the application is detected at least;
• and
• a fraud countermeasures processing step of performing specific countermeasures in the terminal when the fraud detection information is received.