RU2818877C1 - System and method for antivirus scanning of objects on a mobile device - Google Patents

Abstract

FIELD: information security.

SUBSTANCE: technical result is achieved through steps of: receiving, using a security module from a third-party application protection module, a command for performing antivirus scanning of an object; using a security module, the presence of a mobile security application on a mobile device is checked, wherein: when a mobile security application is installed or pre-installed, checking whether the mobile security application is activated, wherein if the application is not activated, then performing the application activation; in the absence of a mobile security application, performing the installation and activation of the mobile security application; transmitting, using the security module, an object for performing antivirus scanning to the mobile security application; performing antivirus scanning of the object to determine whether the object is malicious; transmitting the antivirus scan results by the security module to the third-party application protection module; using the protection module, selecting response measures and transmitting a command to execute the selected response measures; safety module is used to apply response measures according to the received command.

EFFECT: high security of information of third-party applications on a mobile device.

17 cl, 4 dwg, 1 tbl

Description

Field of technology

The invention relates to the field of information security, and more specifically to systems and methods for ensuring the security of applications on mobile devices.

State of the art

Today, a mobile computing device (hereinafter referred to as a mobile device) has become an integral part of a person’s (user’s) life. As a rule, most mobile devices contain various user data necessary for a person’s daily life. Such data may be personal data such as last name, first name, patronymic, year of birth, telephone numbers, photographs and videos and/or confidential data such as login and password for your personal account on the bank’s website, credit card number.

One of the most popular mobile platforms used on mobile devices is the Google Android operating system (hereinafter referred to as Android OS). First of all, Android OS gained popularity due to its openness and freeness, which led to its distribution on various hardware platforms and, as a result, the creation of a huge number of different applications for this OS. To date, several million applications have already been created for the Android OS, which have been installed on more than two billion mobile devices around the world. At the same time, malware for mobile devices using the Android OS has become more and more active. Malware for mobile devices means any software (hereinafter referred to as software) containing malicious code and/or intended to gain unauthorized access to the computing resources of mobile devices or information stored on them, with the aim of unauthorized use of resources or causing damage to mobile device owners. devices by copying, distorting, deleting or substituting information. Information, in particular, means personal and confidential data of the owner of the mobile device. An example of unauthorized use of mobile device resources are actions aimed at making unauthorized payments, sending messages containing spam, and calling paid numbers. Thus, since installed applications on mobile devices have access to sensitive user data in one form or another, it has become important to protect mobile devices and their applications from malware.

One solution to ensure security on mobile devices is to use a special application, namely a mobile security application. A mobile security application is an application designed to detect malware, and depending on the implementation, it has different approaches to anti-virus scanning of mobile device objects. According to the prior art, mobile security applications typically place a high load on the resources of a mobile device while performing their intended purpose. In particular, there is a need to use a large amount of both permanent memory for installing the application itself and local databases, and RAM during operation. As a result, the operation of both other applications on the mobile device and the mobile device itself as a whole becomes difficult.

Another disadvantage of mobile security applications is the limitations associated with the OS architecture for mobile devices - Android and iOS. In this OS, each application runs in an isolated environment, having access only to its virtual storage.

There are solutions aimed at eliminating this deficiency in one form or another. Thus, the patent US11106476B2 presents an approach that discloses the operation of a software development kit (SDK) integrated into a web application. The supporting SDK can perform simple security functions such as fingerprint or facial biometric verification. The helper SDK can also access the hardware of a specific mobile device, such as the camera. However, the disadvantage of this approach is the limited capabilities for conducting anti-virus scanning of mobile device objects.

An analysis of the prior art allows us to conclude that the use of current technologies is insufficient in ensuring the security of mobile applications, in particular in the implementation of anti-virus scanning of objects on a mobile device with an acceptable level of load on the resources of the mobile device. Therefore, a solution is needed to both ensure the security of mobile applications and reduce the load on the resources of the mobile device.

Disclosure of the invention

The present invention relates to solutions to ensure the security of applications on mobile devices, while reducing the load on the resources of the mobile device. The security of mobile device applications is carried out by conducting an anti-virus scan of objects.

The technical result is to increase information security third-party applications on a mobile device. This technical result is achieved through the present invention, intended to ensure the security of an application on a mobile device.

In one of the embodiments of the invention, a method for anti-virus scanning on a mobile device is proposed, wherein this method includes the steps of: receiving a command to perform an anti-virus scan of the object using a security module from the protection module of a third-party application; using the security module, checking the presence of a mobile security application on the mobile device, and: if the mobile security application is installed or pre-installed, checking whether the mobile security application is activated, and if the application is not activated, then activating the application; in the absence of a mobile security application, install and activate the mobile security application; using the security module, transmitting an object to perform an anti-virus scan to the mobile security application; perform an anti-virus scan of the object to determine whether the object is malicious; transmit the results of the anti-virus scan via a security module to the protection module of a third-party application; using the protection module, response measures are selected and a command is transmitted to execute the selected response measures; using the security module, they apply response measures according to the received command.

According to one embodiment of the method, a command to perform an anti-virus scan of an object is received after identifying suspicious activity and at least one object associated with this activity.

According to another embodiment of the method, suspicious activity is detected using a protection module using behavioral blockers or patterns of dangerous application behavior.

According to another embodiment of the method, the command for performing an anti-virus scan of an object contains at least the following information: the location of the object and the name of the object.

According to another embodiment of the method, the object for performing anti-virus scanning is, in particular, understood as: a file; link; Message text; spam email; network package.

According to another embodiment of the method, activation and installation of a mobile security application is performed in one of the following ways: by providing a request to the user of the mobile device; in accordance with the group policy of the mobile device; automatically when installing a third-party application.

According to another embodiment of the method, an anti-virus scan of an object is carried out using at least one of: interaction with a cloud security service; using the database located in the mobile security application.

According to another embodiment of the method, response measures are aimed at ensuring the security of a third-party application of a mobile device and include at least one of the following actions: deleting a malicious object; changing access rights to a malicious object; placing a malicious object in the spam category; warning the user about the presence of a malicious object on the mobile device; placing a malicious object in quarantine; blocking incoming traffic by IP address; disconnecting the mobile device from the Internet; information support for the user of a mobile device when a malicious object is detected; changing the mobile security app settings on your device; blocking clicking on a phishing link; updating the operating system or rolling back the mobile device to factory settings; updating the application to the latest version.

In another embodiment of the invention, a system for anti-virus scanning of objects is proposed, implemented on at least one mobile device, wherein said system contains at least one third-party application that includes a security module designed to transmit a command to the security module to perform anti-virus scanning of the object ; selecting response measures aimed at ensuring the security of a third-party application; transmitting a command to the security module to execute the selected response measures; a security module designed to check the presence of a mobile security application on a mobile device; installing a mobile security application if the application is not installed; activating a mobile security application if the application is not activated; transmitting an object to perform an anti-virus scan to the mobile security application in the case where the mobile security application is installed and activated, and receiving the results of the anti-virus scan; conducting an anti-virus scan of an object in the event that the mobile security application is not installed or activated; transferring the results of an anti-virus scan of an object to the protection module; applying response measures aimed at ensuring the security of a third-party application.

According to another embodiment of the system, the command to perform an anti-virus scan of an object is associated with detected suspicious activity.

According to another embodiment of the system, suspicious activity is detected using behavioral blockers or patterns of dangerous application behavior.

According to another embodiment of the system, a command for performing an anti-virus scan of an object contains at least the following information: the location of the object and the name of the object.

According to another embodiment of the system, the object for performing anti-virus scanning, in particular, is a file; link; Message text; spam email; network package.

According to another implementation of the system, the selection of response measures aimed at ensuring the security of a third-party application is based on the results of an anti-virus scan.

According to another embodiment of the system, installation and activation of a mobile security application is performed in one of the following ways:

through interaction with the user of a mobile device;

in accordance with the group policy of the mobile device;

c) in automatic mode when installing a third-party application.

According to another variant of the system implementation, an anti-virus scan of the received object is performed using at least one of the approaches:

interaction with a cloud security service;

using the database located in the mobile security application.

According to another embodiment of the system, response measures aimed at ensuring the security of a third-party application include at least one of the following actions: deleting a malicious object; changing access rights to a malicious object; placing a malicious object in the spam category; warning the user about the presence of a malicious object on the mobile device; placing a malicious object in quarantine; blocking incoming traffic by IP address; disconnecting the mobile device from the Internet; information support for the user of a mobile device when a malicious object is detected; changing the mobile security app settings on your device; blocking clicking on a phishing link; updating the operating system or rolling back the mobile device to factory settings; updating the application to the latest version.

Brief description of drawings

Additional objects, features and advantages of the present invention will become apparent from a reading of the following description of the invention with reference to the accompanying drawings, in which:

In FIG. 1 schematically shows an example of the implementation of an application security system.

In FIG. 2 is a flowchart illustrating a method for securing an application.

FIG. 3 is a flowchart illustrating an embodiment of a method for providing security to an application.

In FIG. 4 shows an example of a computer system with which the present invention is implemented.

Carrying out the invention

Objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to other embodiments disclosed below, but may be embodied in various forms. The spirit set forth in the specification is nothing more than specific details provided to assist one skilled in the art in fully understanding the invention, and the present invention is defined within the scope of the appended claims.

The present invention is a technical solution that makes it possible to ensure the security of mobile applications and the mobile device as a whole through the use of a security module in a third-party application. Moreover, the present invention makes it possible to reduce the load on the resources of a mobile device while ensuring the security of the mobile device.

In FIG. Figure 1 shows an example of an application security system.

In a preferred embodiment , the application security system 105 is implemented on the mobile device 102 and includes at least one third-party application 110 and a mobile security application 140 containing a database 145. The third-party application 110 in turn includes a security module 115 and a security module 120 . wherein the security module 120 consists of a scanning tool 125 , an analysis tool 130 , an enforcement tool 135 and a database 150 . It is worth noting that the security module 120 is an embeddable component within the third-party application 110 and is designed to provide protection against malicious activity of the third-party application 110 . Depending on the implementation, the security module 120 may be either an integral part of the third-party application 110 or an independent module embedded within the third-party application 110 .

Mobile device 102 refers to at least a computing device such as a smartphone, tablet, smart watch, handheld game console, personal navigation device, and data terminal. Another example of a computing device is the computer system shown in FIG. 4 .

Third-party application 110 means third-party software designed to work on smartphones, tablets and other mobile devices, developed for a specific platform (Android, Windows Phone, iOS, etc.), but not intended for anti-virus scanning of objects.

Protection module115, located in a third-party application110, designed to control the activity of a third-party application110in order to identify suspicious activity and objects associated with this activity.

The specified object, in particular, means such objects as:

file;

link;

Message text;

spam email;

network package.

Examples of activity are activities such as: downloading a file, opening a file, following a link.

In one embodiment, security module 115 monitors the activity of third-party application 110 using behavioral blockers or patterns of dangerous application behavior. Thus, if the activity of a third-party application 110 matches one of the patterns of dangerous behavior or suspicious actions are detected, using a behavioral blocker, the protection module 115 records such activity as suspicious, identifies at least one object associated with the specified activity, and prohibits further actions with the detected activity. object by applying a lock. It is worth noting that when implementing third-party application 110, security module 115 may use other approaches known in the art to monitor the activity of third-party application 110 . Next, the security module 115 transmits a command to perform an anti-virus scan of the identified object associated with suspicious activity to the security module 120 . The command for performing an object check contains at least the following information: the location of the object (for example, the path to a file) and the name of the object.

Below are examples of security modules 115 when implemented in various third party applications 110 .

In one of the implementation options in a third-party application110, for example, a banking application provided by financial institutions for remote interaction, a security module115 is responsible for monitoring transactions for unauthorized access to client data, for example, bank card data on a mobile device102by identifying the program that initiates the transaction, the transaction receiving URL, and applying filters (for example, validator filters, stoplist filters, authorization limit filters). Unauthorized access to bank card data may occur due to the operation of the Trojan-Banker.AndroidOS.Faketoken program. This Trojan program displays fake forms for collecting bank card data on top of a banking (third-party) application110, thereby stealing bank card data (card number, PIN code, CVV). Among other things, “Trojan-Banker.AndroidOS.Faketoken” intercepts all incoming SMS passwords on a mobile device102 and transfers them to the attackers’ servers. If data is suspected of being intercepted by a Trojan program, the protection module115 on a mobile device102intercepts suspicious activity and transmits at least one command for performing an anti-virus scan of the “program file whose window is currently active” object associated with the suspicious activity to the security module120. Security module120 requests from a third party application110 permission (English permission) to perform its functionality in a third-party application110.

In another implementation in a third-party application110, for example, a messenger designed for instant messaging, a security module115 is responsible for monitoring incoming messages for spam, and monitoring embedded links for phishing, and analyzes downloaded files for maliciousness. If spam, phishing or a malicious object (file) is detected, the protection module115intercepts suspicious activity and transmits at least one command to perform an anti-virus scan of the “spam email, phishing link or file” object associated with the suspicious activity to the security module120. Security module120 requests from a third party application110 permissions to perform your functionality in a third-party application110. Before performing an anti-virus scan of an object with the security module120protection module115 may remove all personal information from a message, such as mentions of names, email addresses and other personal information.

Security module120, which is a component of a third-party application110, is designed to perform an anti-virus scan of an object corresponding to the command received from the protection module115, in order to identify a malicious object. Security module120 has limited functionality and capabilities for conducting anti-virus scanning of objects compared to a mobile security application140. For example, security module120 has only one of the following types of verification, and each type of verification may have a limited implementation option: there is no possibility of emulating files or running in a limited environment (English sandbox); the size of databases for checking the hash amount of a file or digital signature is limited; security module functionality120 limited only to working with executable files compiled without the use of packers. An executable file packer is a program for reducing the size of executable files. The compressed file contains a compressed copy of the original file and a program for decompressing. As a result of limited functionality and capabilities, the security module120 produces less CPU load and requires less RAM compared to a mobile security app140. In yet another embodiment, the security module120 has only the ability to search and/or install on a mobile device102an application designed to perform anti-virus security checks, such as a mobile security application140.

After receiving an object associated with suspicious activity to perform an anti-virus scan, the security module 120, using the scanning tool 125 , checks for the presence of the mobile security application 140 . The scanning engine 125 checks whether the mobile security application 140 is installed on the mobile device 102 by calling a set of API (Application Programming Interface) functions, wherein:

when a mobile application (English Pre-installed software) is installed or pre-installed, security 140 checks whether the mobile security application 140 is activated; if the application is not activated, then the application is activated;

in the absence of a mobile security application 140, the mobile security application 140 is installed and activated.

The scanning tool 125, upon detecting an installed or pre-installed but not activated mobile security application 140, informs the security module 120 about the need to activate the detected mobile security application 140 . The security module 120 activates the mobile security application 140 through interaction with the user of the mobile device 102 or automatically if the security module 120 has the appropriate permissions on the mobile device 102 . Thus, the security module 120 sends a request to the user, the request containing information about the presence of an installed mobile security application 140 on the mobile device 102 and the need for its activation, and awaits a response about activation. The request is sent using data input/output tools. Once the mobile security application 140 is activated, the security module 120 interacts with it. In another implementation, the security module 120 starts the activation process of the security application 140 , making the security application window 140 active so that the user can perform all the necessary actions for activation (for example, enter an activation code, read the license agreement).

The scanning tool 125, in the absence of a mobile security application 140, informs the security module 120 about the need to install and activate the mobile security application 140 . In one embodiment, installation of the mobile security application 140 occurs by providing a request to the user of the mobile device 102 . The scanning engine 125 , through the network 103, detects an available application store 155 and sends a request to install the mobile security application 140 to the user of the mobile device 102 . The application store depends on the type of OS of the mobile device 102 , on Android - Google Play, RuStore, Samsung Galaxy Store, Xiaomi Mi GetApps, etc., on iOS - App Store, etc. In one embodiment, the request to install the mobile security application 140 may be implemented using the mailbox and SMS messages on the mobile device 102 . The security module 120 sends an email or SMS message containing a link to the mobile security application storefront 140 or an attached file of the mobile security application 140 . If there is no mobile security application 140 in the application store 155 or there is no application store 155 on the mobile device 102, the request contains permission to install the mobile security application 140 from the Internet (for example, for the Android OS this will be a link to the APK file). After installing the mobile security application 140, activation is performed using one of the previously listed methods.

In one embodiment, installation and activation of the mobile security application 140 is performed in accordance with the group policy of the mobile device 102 . Mobile device group policy should be understood as a single set of parameters for managing mobile devices that are part of an administration group, as well as mobile applications installed on devices. For example, in a corporate or local network, a list of mobile applications is installed and activated on device 102 according to group policy. This installation and activation is performed after turning on, rebooting or updating the mobile device.

In another embodiment of the invention, the installation and activation of the mobile security application 140 can be performed automatically. For example, when installing a third-party application 110, a mobile security application 140 is additionally installed on the mobile device 102 by default.

If the mobile security application 140 on the mobile device 102 is not installed or is installed but not activated, and there is no possibility of activation, the security module 120 checks the object independently using the analysis tool 130 .

Thus, the security module 120 passes the object to perform the check:

to the mobile security application 140 if the mobile security application 140 is installed and activated on the device 102 ;

to the analysis tool 130 in the event that the mobile security application 140 is not installed or is installed but not activated, and there is no possibility of activation on the device 102 .

In a preferred embodiment, the security module120transfers the scanned object to the mobile security application140. Mobile security app140 performs an anti-virus scan of an object to determine whether it corresponds to a malicious object. A malicious object should be understood as an object created using malicious code, intended to provide unauthorized access to information or resources of the user’s device, in particular a mobile device102. Example of a mobile security application140 is the product “Kaspersky Total Security” of the company “Kaspersky Lab” JSC, in particular for mobile devices.

Mobile security app140,compared to safety module120, has no restrictions on its functionality for conducting anti-virus scanning of objects, and also has access to a cloud security service160. Depending on the implementation options, checking the object as a mobile security application itself140, so using a cloud security service160 Maybe include signature or heuristic scanning information about object code fragments, the use of behavioral analyzers, as well as the use of online services that analyze suspicious files and a sandbox. In a preferred embodiment, a mobile security application140 performs an anti-virus scan of an object using a cloud security service160(for example, Kaspersky Security Network) via the network103.

In another embodiment of the invention, a mobile security application140 checks an object using a database145.Database145 stores at least signatures, heuristics, file hashes. Checking an object using a mobile security application140 using a database145 includes signature and heuristic scanning (analysis) object code, use of behavioral analyzers. Object scan results mobile security application140 transmits to the protection module115 via security module120.

As previously discussed, in the case where the mobile security application 140 is not installed or is installed but not activated on the device 102, the security module 120 performs an object check using the analysis tool 130 and the database 150 . The analysis tool 130 checks the object using signatures from the database 150 . The analysis tool 130 transmits the results of checking the object to the protection module 115 .

In a particular case of implementation of the invention, the security module 120 additionally checks for the presence of permissions in the third-party application 110 to perform an independent verification of the object. For example, the security module 120 is embedded in a third-party mobile game application 110 and does not have sufficient permissions. The security module 120 may not have permissions to access components such as: speaker, contacts, calendar, device location, device messages, Wi-Fi connection information. Thus, performing a check on the object of the third-party application 110 by the analysis tool 130 located in the security module 120 is incomplete or impossible due to insufficient permissions. In another example, the security module 120 is located in a third-party System Settings application 110 on the mobile device 102 and has sufficient permissions because the system application has unrestricted access to the entire mobile device. The analysis tool 130 independently checks the object of the third-party application 110 . The analysis tool 130 transmits the results of checking the object to the protection module 115 .

The security module 115 , based on the received test results from the security module 120, selects response measures if necessary. The list of measures is given below.

The security response to the third party application 110 of the mobile device 102 selected by the security module 115 includes at least one of:

removal of a malicious object;

changing access rights to a malicious object;

placing a malicious object in the spam category;

warning the user about the presence of a malicious object on the mobile device 102 ;

placing a malicious object in quarantine;

blocking incoming traffic by IP address;

disconnecting the mobile device 102 from the Internet;

information support for the user of the mobile device 102 when a malicious object is detected;

changing the settings of the mobile security application on the device 102;

blocking clicking on a phishing link;

updating the operating system or rolling back the mobile device 102 to factory settings;

updating application 110 to the latest version.

The security module 115 transmits a command to the security module 120 to execute the selected response measures. The security module 120, using the enforcement tool 135, executes the response measures selected by the security module 115 . For example, based on the results of the scan, a malicious object was identified - a phishing link in an SMS message, the protection module 115 selects the following response measures: warning the user of the mobile device 102 about the presence of a phishing link and blocking the transition to the phishing link.

In the particular case of implementation, based on the results of checking the object by the analysis tool 130, the measure application tool 135 immediately applies response measures.

Table 1 presents examples of response measures stored in the database 150 that are used when a corresponding malicious object is identified during an anti-virus scan.

Table 1. Malicious objects Response measures File Delete a file; changing file access rights; placing the file in quarantine. Link Removing a link; warning the user of the mobile device 102 about the presence of a phishing link; information support for the user about prohibiting following the link or marking the sender of the link as an “untrusted user”; blocking clicking on a phishing link. Text Placing the text in the spam category. Network package Blocking incoming traffic by IP address; blocking network packets using firewall rules.

In FIG. 2 presents a method for ensuring application security. The presented method is implemented using the application security system 105 presented in the description of FIG. 1.

At step 205, using the security module 115, the activity of the third-party application 110 is monitored in order to identify suspicious activity and objects associated with this activity. Examples of suspicious activity are downloading a file from an unknown IP address, receiving a message from an unknown recipient.

At step 210, using the security module 115, a command is sent to the security module 120 to perform an anti-virus scan of the identified object associated with suspicious activity. The command for performing an anti-virus scan of an object contains at least the following information: the location of the object (for example, the path to a file) and the name of the object.

At step 220 , after the security module 120 receives a command to perform an anti-virus scan of an identified object associated with suspicious activity, the scanning tool 125 checks for the presence of the mobile security application 140 . The scanning tool 125 checks whether the mobile security application 140 is installed on the mobile device by calling the necessary API functions. If the scanning tool 125 detects an installed or pre-installed but not activated mobile security application 140 , proceed to step 230 . If the mobile security application 140 is not present on the mobile device 102 , then proceed to step 240 .

At step 230 , the scanning tool 125 checks whether the installed or pre-installed mobile security application 140 is activated. If the mobile security application 140 is not activated, then proceed to step 250 . If the mobile security application 140 is activated, then proceed to step 260 .

At step 240 , the scanning tool 125 informs the security module 120 about the need to install the mobile security application 140 . In one embodiment, installation of the mobile security application 140 is accomplished by presenting a request to the user of the mobile device 102. The scanning engine 125 detects an available application store 155 through the network 103 and sends a request to install the mobile security application 140 to the user of the mobile device 102 . The request to install the mobile security application 140 is implemented using the mailbox and SMS messages on the mobile device 102 . Using the security module 120, a letter is sent to a mailbox or an SMS message containing a link to the mobile security application showcase 140 or an attached file of the mobile security application 140 . If there is no mobile security application 140 in the application store 155 or there is no application store 155 on the mobile device 102, the request contains permission to install the mobile security application 140 from the Internet (for example, for the Android OS this will be a link to the APK file). At step 250 , the security module 120 activates the mobile security application 140 through interaction with the user of the mobile device 102 or automatically if the security module 120 has the appropriate permissions on the mobile device 102 . Thus, using the security module 120, a request is sent to the user, and the request contains information about the presence of an installed mobile security application 140 on the mobile device 102 and the need to activate it and wait for a response about activation. In another embodiment, the security module 120 initiates the activation process of the security application 140 , making the window of the security application 140 active so that the user can perform all the necessary actions for activation.

In one embodiment, the installation and activation of the mobile security application 140 is performed in accordance with the group policy of the mobile device 102 . For example, in a corporate or local network, a list of mobile applications is installed and activated on device 102 in accordance with group policy.

In another embodiment of the invention, the installation and activation of the mobile security application 140 is performed automatically. For example, when installing a third-party application 110, a mobile security application 140 is additionally installed on the default mobile device 102 .

At step 260 , using the security module 120, the object is transferred to the mobile security application 140 for anti-virus scanning. Using the mobile security application 140, an anti-virus scanning of the object is performed for compliance with a malicious object. A malicious object should be understood as an object created using malicious code, aimed at providing unauthorized access to information or resources of the user’s device, in particular a mobile device 102 .

At step 270, using the mobile security application 140, an anti-virus scan of the object is performed. In a preferred embodiment of the invention, this verification is carried out by interacting with a cloud security service 160 (for example, Kaspersky Security Network) via a network 103 . Scanning an object using cloud security service 160 includes signature and heuristic scanning of information about object code fragments, the use of behavioral analyzers, as well as the use of online services that analyze suspicious files and a sandbox.

In another embodiment, when performing an object scan, the mobile security application140 uses a database145. Checking an object using a mobile security application140 using a database145 includes, in particular, signature and heuristic scanning information about object code fragments, the use of behavioral analyzers.

At step 280 , the mobile security application 140 transmits the scan results to the security module 115 via the security module 120. Using the security module 115 , based on the anti-virus scan results received from the security module 120, response measures are selected if necessary.

At step 290 , the security module 115 transmits a command to the security module 120 to execute the selected response measures. The security module 120, using the response tool 135 , executes the response measures selected by the security module 115 . In a particular case of implementation, response measures are immediately taken based on the results of the inspection of the object.

OnFig. 3A private implementation of a method for ensuring application security is presented. The presented method is implemented using the application security system.105presented in the descriptionFig. 1,And complements the method presented in the descriptionFig. 2. Stages205,210,220,230,240,250,260, 290 method are the same steps given earlier in the descriptionFig. 2.

At step 310 , the scanning tool 125 checks whether the mobile security application is installed at step 240 . If the mobile security application 140 is installed, then proceed to step 320. If the mobile security application 140 is not installed on the mobile device 102 , then proceed to step 330 .

At step 320 , the scanning tool 125 checks to see if the mobile security application 140 was activated at step 250 . If the mobile security application 140 is not activated, then proceed to step 330 . If the mobile security application 140 is activated, proceed to step 260.

At step 330, if the mobile security application 140 is not installed, or is installed but not activated and cannot be activated, the device 102 is scanned for viruses by the analyzer 130 using signatures from the database 150 . If the mobile security application 140 is successfully activated, see the description of step 270 presented in the description of FIG. 2

At step 340 , using the component that performs the anti-virus check at step 330 (mobile security application 140 or analysis tool 130 ), the scan results are transmitted through the security module 120 to the security module 115. Using the protection module 115 , based on the received anti-virus scan results from the security module 120 , if necessary, select response measures.

In FIG. 4 illustrates a computer system on which various embodiments of the systems and methods disclosed herein may be implemented. The computer system 20 may be a system configured to implement the present invention and may be in the form of a single computing device or multiple computing devices, such as a mobile computing device, a smartphone, a tablet computer, and other forms of computing devices.

As shown in FIG. 4 , computer system 20 includes: a central processing unit 21 , system memory 22 , and a system bus 23 that communicates various system components, including memory, coupled to the central processing unit 21 . System bus 23 is implemented like any bus structure known in the art, which in turn includes a bus memory or bus memory controller, a peripheral bus, and a local bus capable of interfacing with any other bus architecture. Examples of buses include: PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I2C and other suitable connections between computer system components 20 . The central processing unit 21 contains one or more processors having one or more cores. The central processing unit 21 executes one or more sets of computer-readable instructions implementing the methods presented herein. System memory 22 may be any memory for storing data and/or computer programs executable by the central processing unit 21 . System memory can contain both read-only memory (ROM) 24 and random access memory (RAM) 25 . The basic input/output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between elements of the computer system 20 , for example, when the operating system is loaded using ROM 24 .

Computer system 20 includes one or more data storage devices, such as one or more removable storage devices 27 , one or more non-removable storage devices 28 , or combinations of removable and non-removable devices. One or more removable storage devices 27 and/or non-removable storage devices 28 are connected to the system bus 23 via an interface 32 . In one embodiment, removable storage devices 27 and associated computer-readable storage media are nonvolatile modules for storing computer instructions, data structures, program modules, and other computer system 20 data. System memory 22 , removable storage devices 27 , and non-removable storage devices 28 may use various computer readable media. Examples of computer-readable storage media include computer memory such as cache memory, SRAM, DRAM, capacitorless RAM (Z-RAM), thyristor memory (T-RAM), eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other memory technologies such as solid-state drives (SSDs) or flash drives; and any other media that can be used to store the desired data and that can be accessed by the computer system 20 .

System memory 22 , removable storage devices 27 , and non-removable storage devices 28 contained in the computer system 20 are used to store the operating system 35 , applications 37 , other program modules 38 , and program data 39 . Computer system 20 includes a peripheral interface 46 for transmitting data from input devices 40 such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices such as a printer or scanner through one or more input/output ports, such as a serial port, parallel port, universal serial bus (USB), or other peripheral interface. A display device 47 , such as one or more monitors, projectors, or embedded displays, is also connected to the system bus 23 through an output interface 48 , such as a video adapter. In addition to the display devices 47 , the computer system 20 is equipped with other peripheral output devices (not shown in FIG. 4 ), such as speakers and other audiovisual devices.

The computer system 20 may operate in a networked environment using a network connection to one or more remote computers 49 . The remote computer(s) 49 is a working personal computer or server that contains most or all of the components noted previously in describing the nature of the computer system 20 shown in FIG. 4 . There may also be other devices in the network environment, such as routers, network stations or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with remote computers 49 over one or more networks, such as a local area network (LAN) 50 , a wide area network (WAN), an intranet, and the Internet. Examples of network interface 51 are an Ethernet interface, a Frame Relay interface, a SONET interface, and wireless interfaces.

Embodiments of the present invention may be a system, a method, or a computer-readable medium (or storage medium).

A computer-readable storage medium is a tangible device that stores and stores program code in the form of machine-readable instructions or data structures that are accessible by the central processing unit 21 of a computer system 20 . A computer-readable medium may be an electronic, magnetic, optical, electromagnetic, semiconductor storage device, or any suitable combination thereof. By way of example, such a computer-readable storage medium may include random access memory (RAM), read-only memory (ROM), EEPROM, portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD) ), flash memory, hard drive, portable computer floppy disk, memory card, floppy disk, or even a mechanically encoded device such as punch cards or embossed structures with instructions written on them.

The system and method of the present invention can be thought of in terms of means. The term "device" as used herein refers to an actual device, component, or group of components implemented in hardware, such as an application-specific integrated circuit (ASIC) or FPGA, or a combination of hardware and software. providing, for example, using a microprocessor system and a set of machine-readable instructions to implement the functionality of a tool that (in the process of execution) turns the microprocessor system into a special-purpose device. The tool may also be implemented as a combination of these two components, with some functions being implemented by hardware alone and other functions being implemented by a combination of hardware and software. In some embodiments, at least a portion, and in some cases all, of the means may be executed on the central processing unit 21 of the computer system 20 . Accordingly, each means may be implemented in various suitable configurations and should not be limited to any particular embodiment set forth herein.

In conclusion, it should be noted that the information given in the description are examples that do not limit the scope of the present invention as defined by the formula. One skilled in the art will appreciate that in developing any actual embodiment of the present invention, many decisions specific to the particular implementation must be made to achieve specific objectives, and these specific objectives will differ from one embodiment to another. It is understood that such development efforts can be complex and time consuming, but will nevertheless be a routine engineering task for those of ordinary skill in the art using the present disclosure.

Claims (83)

1. A system for anti-virus scanning of objects, implemented on at least one mobile device, wherein said system contains at least one third-party application, which includes: protection module designed for: monitoring the activity of a third-party application in order to identify suspicious activity and objects associated with this activity; sending a command to the security module to perform an anti-virus scan of the identified object; selecting response measures aimed at ensuring the security of a third-party application; transmitting a command to the security module to execute the selected response measures; a security module configured to perform an anti-virus scan of an object in accordance with a command received from the protection module in order to identify a malicious object, and intended for: checking for the presence of a mobile security application on a mobile device; installing a mobile security application if the application is not installed; activating a mobile security application if the application is not activated; transmitting an object to perform an anti-virus scan to the mobile security application in the case where the mobile security application is installed and activated, and receiving the results of the anti-virus scan; carrying out an anti-virus scan of an object in the event that the mobile security application is not installed or activated; transferring the results of an anti-virus scan of an object to the protection module; applying response measures aimed at ensuring the security of a third-party application. 2. The system according to claim 1, in which the command for performing an anti-virus scan of an object is associated with detected suspicious activity. 3. The system according to claim 2, in which suspicious activity is detected using behavioral blockers or patterns of dangerous application behavior. 4. The system according to claim 1, in which the command for performing an anti-virus scan of an object contains at least the following information: the location of the object and the name of the object. 5. The system according to claim 1, in which the object for performing anti-virus scanning, in particular, is: file; link; Message text; spam email; network package. 6. The system according to claim 1, in which the choice of response measures aimed at ensuring the security of a third-party application is based on the results of an anti-virus scan. 7. The system according to claim 1, in which the installation and activation of the mobile security application is performed in one of the following ways: through interaction with the user of a mobile device; in accordance with the group policy of the mobile device; automatically when installing a third-party application. 8. The system according to claim 1, in which an anti-virus scan of the received object is performed using at least one of the approaches: interaction with a cloud security service; using the database located in the mobile security application. 9. The system according to claim 1, in which the response measures aimed at ensuring the security of the third-party application include at least one of the actions: removal of a malicious object; changing access rights to a malicious object; placing a malicious object in the spam category; warning the user about the presence of a malicious object on the mobile device; placing a malicious object in quarantine; blocking incoming traffic by IP address; disconnecting the mobile device from the Internet; information support for the user of a mobile device when a malicious object is detected; changing the settings of the mobile security application on the device; blocking clicking on a phishing link; updating the operating system or rolling back the mobile device to factory settings; updating the application to the latest version. 10. A method implemented on a mobile device for anti-virus scanning of objects, in which: using a security module located in a third-party application, a command is received from the protection module of a third-party application to perform an anti-virus scan of an object , where the protection module is configured to monitor the activity of a third-party application in order to identify suspicious activity and objects associated with this activity, and the security module is configured with the ability to scan an object for anti-virus in accordance with the command received from the protection module in order to identify a malicious object; using the security module, check the presence of a mobile security application on the mobile device, and: when a mobile security application is installed or preinstalled, they check whether the mobile security application is activated, and if the application is not activated, then the application is activated; in the absence of a mobile security application, install and activate the mobile security application; using the security module, transmitting an object to perform an anti-virus scan to a mobile security application; perform an anti-virus scan of the object to determine whether the object is malicious; transmit the results of the anti-virus scan via a security module to the protection module of a third-party application; using the protection module, response measures are selected and a command is transmitted to execute the selected response measures; using the security module, they apply response measures according to the received command. 11. The method according to claim 10, in which the command to perform an anti-virus scan of an object is received after identifying suspicious activity and at least one object associated with this activity. 12. The method according to claim 11, in which suspicious activity is detected using a protection module using behavioral blockers or patterns of dangerous application behavior. 13. The method according to claim 10, in which the command for performing an anti-virus scan of an object contains at least the following information: the location of the object and the name of the object. 14. The method according to claim 10, in which the object for performing anti-virus scanning, in particular, is understood as: file; link; Message text; spam email; network package. 15. The method according to claim 10, in which activation and installation of the mobile security application is performed in one of the following ways: by providing a request to the user of a mobile device; in accordance with the group policy of the mobile device; automatically when installing a third-party application. 16. The method according to claim 10, in which the anti-virus scan of the object is carried out using at least one of: interaction with a cloud security service; using the database located in the mobile security application. 17. The method according to claim 10, in which the response measures are aimed at ensuring the security of a third-party application of a mobile device and include at least one of the actions: removal of a malicious object; changing access rights to a malicious object; placing a malicious object in the spam category; warning the user about the presence of a malicious object on the mobile device; placing a malicious object in quarantine; blocking incoming traffic by IP address; disconnecting the mobile device from the Internet; information support for the user of a mobile device when a malicious object is detected; changing the settings of the mobile security application on the device; blocking clicking on a phishing link; updating the operating system or rolling back the mobile device to factory settings; updating the application to the latest version.