2,063 research outputs found
Malware detection techniques for mobile devices
Mobile devices have become very popular nowadays, due to its portability and
high performance, a mobile device became a must device for persons using
information and communication technologies. In addition to hardware rapid
evolution, mobile applications are also increasing in their complexity and
performance to cover most needs of their users. Both software and hardware
design focused on increasing performance and the working hours of a mobile
device. Different mobile operating systems are being used today with different
platforms and different market shares. Like all information systems, mobile
systems are prone to malware attacks. Due to the personality feature of mobile
devices, malware detection is very important and is a must tool in each device
to protect private data and mitigate attacks. In this paper, analysis of
different malware detection techniques used for mobile operating systems is
provides. The focus of the analysis will be on the to two competing mobile
operating systems - Android and iOS. Finally, an assessment of each technique
and a summary of its advantages and disadvantages is provided. The aim of the
work is to establish a basis for developing a mobile malware detection tool
based on user profiling.Comment: 11 pages, 6 figure
Selecting Root Exploit Features Using Flying Animal-Inspired Decision
Malware is an application that executes malicious activities to a computer system, including mobile devices. Root exploit brings more damages among all types of malware because it is able to run in stealthy mode. It compromises the nucleus of the operating system known as kernel to bypass the Android security mechanisms. Once it attacks and resides in the kernel, it is able to install other possible types of malware to the Android devices. In order to detect root exploit, it is important to investigate its features to assist machine learning to predict it accurately. This study proposes flying animal-inspired (1) bat, 2) firefly, and 3) bee) methods to search automatically the exclusive features, then utilizes these flying animal-inspired decision features to improve the machine learning prediction. Furthermore, a boosting method (Adaboost) boosts the multilayer perceptron (MLP) potential to a stronger classification. The evaluation jotted the best result is from bee search, which recorded 91.48 percent in accuracy, 82.2 percent in true positive rate, and 0.1 percent false positive rate
Detection and Prevention of Android Malware Attempting to Root the Device
Every year, malefactors continue to target the Android operating system. Malware which root the device pose the greatest threat to users. The attacker could steal stored passwords and contact lists or gain remote control of the phone. Android users require a system to detect the operation of malware trying to root the phone. This research aims to detect the Exploid, RageAgainstTheCage, and Gingerbreak exploits on Android operating systems. Reverse-engineering 21 malware samples lead to the discovery of two critical paths in the Android Linux kernel, wherein attackers can use malware to root the system. By placing sensors inside the critical paths, the research detected all 379 malware samples trying the root the system. Moreover, the experiment tested 16,577 benign applications from the Official Android Market and third party Chinese markets which triggered zero false positive results. Unlike static signature detection at the application level, this research provides dynamic detection at the kernel level. The sensors reside in-line with the kernel\u27s source code, monitoring network sockets and process creation. Additionally, the research demonstrates the steps required to reverse engineer Android malware in order to discover future critical paths. Using the kernel resources, the two sensors demonstrate efficient asymptotic time and space real-world monitoring. Furthermore, the sensors are immune to obfuscation techniques such as repackaging
Keeping Context In Mind: Automating Mobile App Access Control with User Interface Inspection
Recent studies observe that app foreground is the most striking component
that influences the access control decisions in mobile platform, as users tend
to deny permission requests lacking visible evidence. However, none of the
existing permission models provides a systematic approach that can
automatically answer the question: Is the resource access indicated by app
foreground? In this work, we present the design, implementation, and evaluation
of COSMOS, a context-aware mediation system that bridges the semantic gap
between foreground interaction and background access, in order to protect
system integrity and user privacy. Specifically, COSMOS learns from a large set
of apps with similar functionalities and user interfaces to construct generic
models that detect the outliers at runtime. It can be further customized to
satisfy specific user privacy preference by continuously evolving with user
decisions. Experiments show that COSMOS achieves both high precision and high
recall in detecting malicious requests. We also demonstrate the effectiveness
of COSMOS in capturing specific user preferences using the decisions collected
from 24 users and illustrate that COSMOS can be easily deployed on smartphones
as a real-time guard with a very low performance overhead.Comment: Accepted for publication in IEEE INFOCOM'201
Enter Sandbox: Android Sandbox Comparison
Expecting the shipment of 1 billion Android devices in 2017, cyber criminals
have naturally extended their vicious activities towards Google's mobile
operating system. With an estimated number of 700 new Android applications
released every day, keeping control over malware is an increasingly challenging
task. In recent years, a vast number of static and dynamic code analysis
platforms for analyzing Android applications and making decision regarding
their maliciousness have been introduced in academia and in the commercial
world. These platforms differ heavily in terms of feature support and
application properties being analyzed. In this paper, we give an overview of
the state-of-the-art dynamic code analysis platforms for Android and evaluate
their effectiveness with samples from known malware corpora as well as known
Android bugs like Master Key. Our results indicate a low level of diversity in
analysis platforms resulting from code reuse that leaves the evaluated systems
vulnerable to evasion. Furthermore the Master Key bugs could be exploited by
malware to hide malicious behavior from the sandboxes.Comment: In Proceedings of the Third Workshop on Mobile Security Technologies
(MoST) 2014 (http://arxiv.org/abs/1410.6674
- …