Database of expected application behaviours distributed to mobile devices and used for malware detection

摘要

Mobile telecommunications devices (e.g. mobile phones) typically run only a limited number of applications. This makes it feasible to profile the behaviour of each individual application, particularly with respect to communications traffic. This profiling may be performed at a central server and then distributed to each mobile device. At each mobile device activity is monitored and compared with the profiles of applications that are running. In the event that monitored behaviour deviates from the normal behaviour profile, it is further analysed against a set of rules. These rules determine whether the anomalous behaviour indicates the presence of malware (e.g. viruses, trojans, worms, spyware etc).