Malicious Mobile Applications Research Articles

CallDetect: Detection of Call Log Exploitation Inspired by Apoptosis

Currently, we saw the increment trend of mobile application(app) exploitation that leads to loss of confidential information and money. Many malware camouflages itself as a genuine mobile app or exploits vulnerabilities inside mobile apps. Hence, this paper presents a mobile app called CallDetect that detects Android Application Interface (API) exploitation for call logs inspired by apoptosis. Apoptosis is known as cell-programmed death, and it is part of the human immunology system. Once it suspects any danger that might cause any harm to the human body, it will kill the suspected danger and itself. In the case of CallDetect, it will scan and uninstall the potentially malicious mobile application on a mobile phone. CallDetect consists of 13 new classifications of API call log, which are used as the database for CallDetect. These classifications were built by using static analysis and open source tools in a controlled lab environment. There were 5560 training datasets from Drebin and 550 anonymous testing dataset from Google Playstore. Our finding showed that 39 mobile apps, or 7%, were identified with possible call log exploitation. This paper can be used as a reference for call log API exploitation and can be further enhanced by integrating it with permission and system call exploitation.

A Power-Efficient Approach to Detect Mobile Threats on the Emergent Network Environment

Mobile and IoT devices are blooming, and their applications are prevailing worldwide. In the meantime, the Industry 4.0 trend converges industrial control systems with the internet environment, which makes it vulnerable. Mobile and IoT applications provide seamless connectivity to the emergent network environment for daily work. As mobile phones contain privacy information, malicious mobile applications could compromise mobile devices and cause financial losses. Moreover, attackers could launch DDoS attacks to exhaust a resource of mobile or IoT devices in the emergent network environment. Static malware analysis consumes less computing resources and power than dynamic analysis. This study proposes a power-efficient solution to identify mobile threats, which applies taint analysis to protect the emergent network environment. The experimental results show that the proposed approach could detect mobile malware efficiently.

Detection malicious Android application based on simple-Dalvik intermediate language

In recent years, mobile malware has become one of the most important threats to the development of mobile Internet. Effective prevention and control of malicious applications concern the healthy development of the mobile Internet industry and the vital interests of the vast number of mobile terminal users. However, due to many new characteristics of mobile intelligent terminals, such as storing personal privacy data, the traditional software security technology cannot be applied to mobile applications directly. Therefore, the security detection for mobile applications is of great significance. In this paper, we proposed a simple-Dalvik intermediate language-based method to detect the malicious mobile applications. In this method, we first reduce the 218 instructions in the Dalvik instruction set to a simpler set, SDIL, through simplification and optimization. By using SDIL, we can effectively refine the instruction features and maintain the control relationships of the source program. After that, we use an improved MOSS algorithm to detect malicious mobile applications. Our experimental results show that the method proposed in this paper greatly improves the detection efficiency of malicious mobile applications and maintains good accuracy.

Mepelyzer : 서버 기반 다형상 모바일 앱에 대한 메소드 및 퍼미션 유사도 기반 악성앱 판별

안드로이드 플랫폼에서 다양한 모바일 애플리케이션이 개발/배포되면서 편리함과 유용성이 더욱 증가하고 있으나 지속적으로 악성 모바일 애플리케이션(Malicious Mobile Application) 또한 급증하고 있어 스마트폰 사용자도 모르게 단말 내 중요 정보 등이 외부로 유출되고 있다. 악성앱 검출을 위해 안드로이드 플랫폼을 대상으로 다양한 모바일 백신이 개발되었지만 최근에 발견된 서버 기반 다형상 모바일 악성앱인 경우 은닉 우회 기법을 포함하고 있으며, C&C 서버 기반 다형상 생성기에 의해서 각 사용자 단말에 매번 조금씩 다른 형태의 악성앱이 생성 및 설치되기 때문에 기존 모바일 백신에 손쉽게 검출되지 않는다는 문제점이 있다. 이에 본 논문에서는 서버 기반 다형상 모바일 악성앱에 대한 APK 역컴파일 과정을 통해 핵심 악성 코드를 구성하는 DEX 파일내 메소드에 대한 유사도와 접근권한 유사도 측정을 통해 상관관계를 분석하여 SSP 악성앱을 판별하는 기법을 제시하였다. DEX 메소드 유사도와 퍼미션 유사도 분석 결과 SSP 악성앱에 대한 동작 방식의 특징을 추출할 수 있었으며 정상앱과 구별 가능한 차이점을 발견할 수 있었다. Recently, convenience and usability are increasing with the development and deployment of various mobile applications on the Android platform. However, important information stored in the smartphone is leaked to the outside without knowing the user since the malicious mobile application is continuously increasing. A variety of mobile vaccines have been developed for the Android platform to detect malicious apps. Recently discovered server-based polymorphic(SSP) malicious mobile apps include obfuscation techniques. Therefore, it is not easy to detect existing mobile vaccines because some other form of malicious app is newly created by using SSP mechanism. In this paper, we analyze the correlation between the similarity of the method in the DEX file constituting the core malicious code and the permission similarity measure through APK de-compiling process for the SSP malicious app. According to the analysis results of DEX method similarity and permission similarity, we could extract the characteristics of SSP malicious apps and found the difference that can be distinguished from the normal app.

DyHAP: Dynamic Hybrid ANFIS-PSO Approach for Predicting Mobile Malware.

To deal with the large number of malicious mobile applications (e.g. mobile malware), a number of malware detection systems have been proposed in the literature. In this paper, we propose a hybrid method to find the optimum parameters that can be used to facilitate mobile malware identification. We also present a multi agent system architecture comprising three system agents (i.e. sniffer, extraction and selection agent) to capture and manage the pcap file for data preparation phase. In our hybrid approach, we combine an adaptive neuro fuzzy inference system (ANFIS) and particle swarm optimization (PSO). Evaluations using data captured on a real-world Android device and the MalGenome dataset demonstrate the effectiveness of our approach, in comparison to two hybrid optimization methods which are differential evolution (ANFIS-DE) and ant colony optimization (ANFIS-ACO).

Real-time and intelligent private data protection for the Android platform

As the number of smart mobile devices and applications continue to grow dramatically, private data stored and handled by such mobile devices have become the primary targets of hackers and malicious software. Today, many malicious mobile applications steal user information, make premium calls, and send advertisement messages without the user’s permission. Unfortunately, the Android system, currently the most popular smart mobile platform, only provides the users with a simple permission granting mechanism during the installation of applications, which are often ignored since most of the users do not pay attention to the potential hidden risks. Even though some vendors have integrated mechanisms to let the users grant or revoke the permissions associated with any applications at any time, such mechanisms are rarely used because the users do not know when, how and what sensitive information have been leaked.In this paper, we proposed mechanisms to track the use of sensitive information by Android applications. We extended TaintDroid to build a real-time security framework, called PasDroid, with mechanisms to trace dubious data flow, map user–application interactions and alert the users about potential privacy leakage on the fly. The information provided by PasDroid enables the users to determine if a transmission should be allowed or blocked with intelligent security policies. Our experimental results show that PasDroid can be deployed with an affordable runtime overhead to help protect users against malicious applications. The design of security policies is key to eliminate false alarms and improve the user experience.

Research on Smartphone Application Malicious Behavior Evaluation Using Fuzzy Analytical Hierarchy Process

Due to the highly developed modern technology,Smart phones and other mobile devices are become more and more universal. Most of those devices are used to process or store sensitive and confidential data.Consequently,it may cause many problems,such as privacy disclosure,mobile phone virus,spyware,etc. In order to solve those issues,We need a smart phone security evaluation system to evaluate malicious applications.In this paper we starting from classifying the effects of attack caused by all kinds of malicious mobile applications and analyzed malicious code database.according to the consequence those applications have made, we pointed that a smartphone application`s malicious behaviour can be divided into five classifications.and based on this classification,we proposed a smartphone application security evaluation system and by using Fuzzy Analytical Hierarchy Process to determine the security target weight.

Reducing the window of opportunity for Android malware Gotta catch ’em all

Spotting malicious samples in the wild has always been difficult, and Android malware is no exception. Actually, the fact Android applications are (usually) not directly accessible from market places hardens the task even more. For instance, Google enforces its own communication protocol to browse and download applications from its market. Thus, an efficient market crawler must reverse and implement this protocol, issue appropriate search requests and take necessary steps so as not to be banned. From end-users' side, having difficulties spotting malicious mobile applications results in most Android malware remaining unnoticed up to 3 months before a security researcher finally stumbles on it. To reduce this window of opportunity, this paper presents a heuristics engine that statically pre-processes and prioritizes samples. The engine uses 39 different flags of different nature such as Java API calls, presence of embedded executables, code size, URLs? Each flag is assigned a different weight, based on statistics we computed from the techniques mobile malware authors most commonly use in their code. The engine outputs a risk score which highlights samples which are the most likely to be malicious. The engine has been tested over a set of clean applications and malicious ones. The results show a strong difference in the average risk score for both sets and in its distribution, proving its use to spot malware.