Enhancing Mobile Malware Detection with Social Collaboration

Resource-constrained mobile devices pose a challenge to the design of security mechanisms. Existing host-based malware detection solutions are often resource-intensive. We present a decentralized and resource-aware malware detection architecture for mobile devices. Our approach leverages two key ideas: social collaboration and the concept of a hot set. The hot set concept states that not all malware signatures are equally important. At any given time, some signatures (the hot set) are more likely to be matched than the others. We leverage this concept by only keeping the hot set of signatures in the main memory of a mobile device, and distributing the whole signature database among devices belonging to the social group of the device owner. We demonstrate the feasibility of our approach by implementing a proof-of-concept (Social-AV) based on an open source anti-malware software, Clam AV. Experiments show that Social-AV reduces the memory consumption to about 55% of the amount consumed by Clam AV, while retaining the same detection capability.