An efficient signature representation and matching method for mobile devices

The increase in functionality and service offerings of mobile devices and mobile networks has prompted the need to offer better security for these devices. The number of malware on mobile devices has been increasing steadily over the last couple of years. As this trend looks to continue, protection for mobile devices against malware is becoming increasingly important. In this paper, we describe a virus scanning system on mobile devices using a signature based detection method. Specifically, we aim to optimize scanning speed and memory usage which are both very important considerations for the low memory and low power mobile devices. We present a method where we store virus signature hash values in a hash table for fast matching. Additionally, we also speed up the scanning by first matching signature cuts which represent portions of signatures least likely to occur in normal files before matching the entire signature. We evaluate the scanning performance on a Symbian OS mobile device and obtain good results.