Détection de programmes malveillants dédiée aux appareils mobiles

La conception d’une méthode efficace de détection de programmes malveillants dédiée aux appareils mobiles se place dans le contexte d’une architecture multiservices centrée sur le paiement mobile appelée ATISCOM. Cette architecture est développée par le Laboratoire de recherche en réseautique et informatique mobile de Polytechnique Montréal en collaboration avec Flexgroups et subventionnée par le CRSNG. Plusieurs enjeux dans ce projet sont dédiés à la sécurité de la plateforme qui est très sensible puisque elle doit manipuler des informations privées et financières et fonctionner en réseau et sur des appareils mobiles. La menace la plus importante pour les téléphones intelligents est celle du malware, ou logiciel malveillant, et ce mémoire propose d’y répondre. Nous avons établi une revue de littérature du domaine de la détection de malware sur Android, la plateforme choisie pour ce projet. Elle montre la présence importante des logiciels malveillants dans les environnements mobiles, la menace qu’ils représentent et leur évolution. Celle-ci décrit ensuite les domaines principaux de l’analyse statique et dynamique, sur serveur et sur appareil mobile. Elle montre de plus la présence grandissante de l’apprentissage automatique, et le meilleur équilibre entre précision et performance des systèmes hybrides. Après analyse des méthodes basées sur l’analyse dynamique (et statique) sur appareil mobile les plus prometteuses, nous distinguons leurs lacunes et décidons de bâtir une architecture client-serveur hybride utilisant l’apprentissage automatique pour pallier à ces dernières. La tâche se révèlera trop importante pour une simple maîtrise et nous concentrerons nos efforts sur une méthode d’analyse statique légère pouvant offrir une précision suffisante et rouler sur mobile. Ceci constituera la première pierre pour construire la méthode hybride de l’architecture idéale. ----------ABSTRACT: The design of an efficient malware detection method for mobile device is part of the ATISCOM architecture, which aims to be multiservices, centered on mobile payment. This architecture is developed by LARIM at Polytechnique Montreal, with its industrial partner Flexgroups and with the financial help of CRSNG. There are multiple goals in this project dedicated to improve the security of the platform, which is supposed to handle private and financial information on mobile devices and networks, and thus is very sensitive. The main threat for mobile security is mobile malware, and this work tries to answer it. We start this paper with a literature review on malware detection for Android, which will be the chosen platform for this project. It first shows the high and increasing number of malware for smartphones in the news. We then describe the sub-domains, such as static and dynamic analysis, server-side and on-device detection. This also shows that machine learning takes a big chunk of the recent papers in the domain, and that the best compromise between precision and performance is often attained by hybrid systems. We review the latest and most interesting papers in the dynamic analysis sub-domain and a few static analysis papers, all for on-device detection. We list their weaknesses (and also the numbers on performance and precision for future comparison) and decide to make our own machine learning clientserver hybrid method. But it would be too huge a work for a simple master so we’ll focus on a lightweight static analysis on-device detection method for starters

Regulating and Securing the Interfaces Across Mobile Apps, OS and Users

Over the past decade, we have seen a swift move towards a mobile-centered world. This thriving mobile ecosystem builds upon the interplay of three important parties: the mobile user, OS, and app. These parties interact via designated interfaces many of which are newly invented for, or introduced to the mobile platform. Nevertheless, as these new ways of interactions arise in the mobile ecosystem, what is enabled by these communication interfaces often violates the expectations of the communicating parties. This makes the foundation of the mobile ecosystem untrustworthy, causing significant security and privacy hazards. This dissertation aims to fill this gap by: 1) securing the conversations between trusted parties, 2) regulating the interactions between partially trusted parties, and 3) protecting the communications between untrusted parties. We first deal with the case of mobile OS and app, and analyze the Inter-Process Communication (IPC) protocol (Android Binder in particular) between these two untrusted parties. We found that the Android OS is frequently making unrealistic assumptions on the validity (sanity) of transactions from apps, thus creating significant security hazards. We analyzed the root cause of this emerging attack surface and protected this interface by developing an effective, precautionary testing framework and a runtime diagnostic tool. Then, we study the deficiency of how a mobile user interacts with an app that he can only partially trust. In the current mobile ecosystem, information about the same user in different apps can be easily shared and aggregated, which clearly violates the conditional trust mobile user has on each app. This issue is addressed by providing two complementary options: an OS-level extension that allows the user to track and control, during runtime, the potential flow of his information across apps; and a user-level solution that allows the users to maintain multiple isolated profiles for each app. Finally, we elaborate on how to secure the voice interaction channel between two trusted parties, mobile user and OS. The open nature of the voice channel makes applications that depend on voice interactions, such as voice assistants, difficult to secure and exposed to various attacks. We solve this problem by proposing the first system, called VAuth, that provides continuous and usable authentication for voice commands, designed as a wearable security token. It collects the body-surface vibrations of a user via an accelerometer and continuously matches them to the voice commands received by the voice assistant. This way, VAuth guarantees that the voice assistant executes only the commands that originate from the voice of the owner. Overall, this thesis examined the privacy and security issues across various interfaces in the mobile ecosystem, analyzed the trust relationship between different parties and proposed practical solutions. It also documented the experience learned from tackling these problems, and can serve as a reference in dealing with similar issues in other domains.PHDComputer Science & EngineeringUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttps://deepblue.lib.umich.edu/bitstream/2027.42/137033/1/huanfeng_1.pd