Systems and methods for identifying malware

Patent metadata

Field	Value
Publication number	US-8984632-B1
Application number	US-201213619978-A
Country	US
Kind code	B1
Filing date	Sep 14, 2012
Priority date	Sep 14, 2012
Publication date	Mar 17, 2015
Grant date	Mar 17, 2015

Abstract

A computer-implemented method for identifying malware is described. Event data is received from a mobile device. The event data including events performed on the mobile device and a list of one or more applications. The list of the one or more applications is compared with at least one additional list of applications received from at least one additional mobile device. An application in common across the lists of applications is identified. The identification of the application in common to is transmitted to the mobile device.

First claim

What is claimed is:

1. A computer-implemented method for identifying malware, comprising:
receiving event data from a first mobile device, the event data from the first mobile device comprising events performed on the first mobile device and a list of one or more applications executing when the events on the first mobile device are performed, wherein the events performed on the first mobile device comprise a deletion of a first record indicating a transmission or receipt of a first short message service (SMS) message at the first mobile device, and wherein the list of applications comprise applications that initiated an installation process within a predetermined time period before the events are performed on the first mobile device;
receiving event data from a second mobile device, the event data from the second mobile device comprising events performed on the second mobile device and a list of one or more applications executing when the events on the second mobile device are performed, wherein the events performed on the second mobile device comprise a deletion of a second record indicating a transmission or receipt of a SMS message at the second mobile device;
comparing the list of the one or more applications received from the first mobile device with the list of the one or more applications received from the second mobile device;
determining whether deletion of the first record and the second record occurs upon transmission or receipt of each respective SMS message;
upon determining deletion of the first record and the second record occurs upon transmission or receipt of each respective SMS message, identifying an application in common across the lists of applications; and
transmitting the identification of the application in common to the first mobile device.

2. The method of claim 1 , wherein the events performed on the first mobile device comprise a transmission or reception of a SMS message.

3. The method of claim 1 , wherein the events performed on the mobile device comprise an alteration to a log of activities performed on the first mobile device.

4. The method of claim 1 , wherein the list of applications comprises applications that are installed within a predetermined time period before the events are performed on the first mobile device.

5. The method of claim 1 , further comprising assigning a confidence score to the identified application based in part on a number of additional mobile devices that transmitted event data.

6. The method of claim 1 , further comprising assigning a confidence score to the identified application based in part on a past history of behavior of the first mobile device.

7. A computing device configured to identify malware, comprising:
a processor;
memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable by a processor to:
receive event data from a first mobile device, the event data from the first mobile device comprising events performed on the first mobile device and a list of one or more applications executing when the events on the first mobile device are performed, wherein the events performed on the first mobile device comprise a deletion of a first record indicating a transmission or receipt of a first short message service (SMS) message at the first mobile device, and wherein the list of applications comprise applications that initiated an installation process within a predetermined time period before the events are performed on the first mobile device;
receive event data from a second mobile device, the event data from the second mobile device comprising events performed on the second mobile device and a list of one or more applications executing when the events on the second mobile device are performed, wherein the events performed on the second mobile device comprise a deletion of a second record indicating a transmission or receipt of a SMS message at the second mobile device;
compare the list of the one or more applications received from the first mobile device with the list of the one or more applications received from the second mobile device;
determine whether deletion of the first record and the second record occurs upon transmission or receipt of each respective SMS message;
upon determining deletion of the first record and the second record occurs upon transmission or receipt of each respective SMS message, identify an application in common across the lists of applications; and
transmit the identification of the application in common to the first mobile device.

8. The computing device of claim 7 , wherein the events performed on the first mobile device comprise a transmission or reception of a message.

9. The computing device of claim 7 , wherein the events performed on the first mobile device comprise an alteration to a log of activities performed on the mobile device.

10. The computing device of claim 7 , wherein the list of applications comprises applications that are installed within a predetermined time period before the events are performed on the first mobile device.

11. The computing device of claim 7 , wherein the instructions are further executable by the processor to assign a confidence score to the identified application based in part on a number of additional mobile devices that transmitted event data.

12. The computing device of claim 7 , wherein the instructions are further executable by the processor to assign a confidence score to the identified application based in part on a past history of behavior of the first mobile device.

13. A computer-program product for identifying malware, the computer-program product comprising a non-transitory computer-readable medium having instructions thereon, the instructions being executable by a processor to:
receive event data from a first mobile device, the event data from the first mobile device comprising events performed on the first mobile device and a list of one or more applications executing when the events on the first mobile device are performed, wherein the events performed on the first mobile device comprise a deletion of a first record indicating a transmission or receipt of a first short message service (SMS) message at the first mobile device, and wherein the list of applications comprise applications that initiated an installation process within a predetermined time period before the events are performed on the first mobile device;
receive event data from a second mobile device, the event data from the second mobile device comprising events performed on the second mobile device and a list of one or more applications executing when the events on the second mobile device are performed, wherein the events performed on the second mobile device comprise a deletion of a second record indicating a transmission or receipt of a SMS message at the second mobile device;
compare the list of the one or more applications received from the first mobile device with the list of the one or more applications received from the second mobile device;
determine whether deletion of the first record and the second record occurs upon transmission or receipt of each respective SMS message;
upon determining deletion of the first record and the second record occurs upon transmission or receipt of each respective SMS message, identify an application in common across the lists of applications; and
transmit the identification of the application in common to the first mobile device.

14. The computer-program product of claim 13 , wherein the events performed on the first mobile device comprise a transmission or reception of a SMS message.

Assignees

• Laffoon Barry
• Wawda Abubakar
• Mao Jun
• Mccorkendale Bruce
• Symantec Corp

Inventors

• Laffoon Barry
• Wawda Abubakar
• Mao Jun
• Mccorkendale Bruce

Classifications

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• H04W4/14 Primary

  Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD] · CPC title

• H04W12/128

  Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title