Machine-learning Based Detection of Malicious Code and Viruses for Handheld Devices

The pervasiveness of handheld devices makes computational power available in diverse settings where computers were once impractical. The power of handheld devices could be improved even further if executable applications were downloaded on demand from the Internet, instead of being stored full-time in the limited memory of the handheld. However, downloading new software on demand leads to greatly increased security risks. Viruses and other malicious executables pose an even greater threat to handheld devices than to desktop machines, since a handheld has limited storage and computation power with which to enforce security. Existing handhelds have virtually no protection from software that contains hidden, malicious functionality. We will investigate a new technique for detecting malicious executables on handheld devices. Our proposed approach is based on algorithms that learn what features distinguish malicious executables from benign ones. There is reason to believe that such a system can be built not only with a smaller footprint than traditional virus detection systems, but with some ability to detect novel attacks, so that the detection software needs to be updated less often. The purpose of the Phase-I feasibility study will be to evaluate these two hypotheses.