Android Security Research Articles

Light Weight Defense Mechanism Against Camera Based Attacks

A number of android security and privacy vulnerabilities have been exposed in past several years. However, the mobile malware and privacy leakage remain a big threat to mobile phone security and privacy. It has been observed that phone camera would become a traitor in such attacks by capturing photos or videos secretly. Secret photography is not only immoral but also illegal due to invasion of privacy. Phone users themselves could also become victims and if the phone camera is exploited by malicious spy camera app, it may cause serious security and privacy problems. Most of the existing mobile antivirus apps are unable to monitor such camera based attacks. Hence, we demonstrate two camera based attacks through our proposal namely, Remote controlled real time monitoring Attack like Screen unlocking Attack, SMS Attack. We also propose a light weight defense scheme as a countermeasure for the camera attacks that can protect android phones against harmful spy Camera attacks.

Towards a multilayered permission‐based access control for extending Android security

SummaryThis paper discusses security issues on the user equipment, which is the “last mile” of social networks. One of the main Achilles' heel of social networks is not the organization of networks themselves, but the user devices, typically Android ones. The existing system of privileges makes it easy to infiltrate the network via applications installed on users' devices. Conventional signature‐based and static analysis methods are vulnerable. Access to privacy‐ and security‐relevant parts of the application programming interface is controlled by the corresponding permission in a manifest file. While requesting access to permissions, it may offer opportunities to malicious codes, which will cause security issues. Few works among permission analysis, however, pay attention to the prevention of permission leakage on both hardware and software frameworks. In this paper we tackle the challenge of providing our multilayered permission‐based security extension scheme on Android platforms. We propose a usage and access control model and an effective method of preventing permission leakage based on ARM TrustZone security extension mechanism. In contrast to previous work, the proposed security architecture provides a permission‐based mandatory access control on Android middleware, Linux kernel, and hardware layers. The evaluation results demonstrate the effectiveness of the proposed scheme in mitigating permission leakage vulnerabilities.

A Taxonomy and Qualitative Comparison of Program Analysis Techniques for Security Assessment of Android Software

In parallel with the meteoric rise of mobile software, we are witnessing an alarming escalation in the number and sophistication of the security threats targeted at mobile platforms, particularly Android, as the dominant platform. While existing research has made significant progress towards detection and mitigation of Android security, gaps and challenges remain. This paper contributes a comprehensive taxonomy to classify and characterize the state-of-the-art research in this area. We have carefully followed the systematic literature review process, and analyzed the results of more than 300 research papers, resulting in the most comprehensive and elaborate investigation of the literature in this area of research. The systematic analysis of the research literature has revealed patterns, trends, and gaps in the existing literature, and underlined key challenges and opportunities that will shape the focus of future research efforts.

Android Security: A Review

Smartphones are used by billions of people that means the applications of the smartphone is increasing, it is out of control for applications marketplaces to completely validate if an application is malicious or legitimate. Therefore, it is up to users to choose for themselves whether an application is safe to use or not. It is important to say that there are differences between mobile devices and PC machines in resource management mechanism, the security solutions for computer malware are not compatible with mobile devices. Consequently, the anti-malware organizations and academic researchers have produced and proposed many security methods and mechanisms in order to recognize and classify the security threat of the Android operating system. By means of the proposed methods are different from one to another, they can be arranged into various classifications. In this review paper, the present Android security threats is discussed and present security proposed solutions and attempt to classify the proposed solutions and evaluate them.

Android Security: A Review

Android Security: A Review

An effective mobile malware detection framework for android security

Mobile malware is considered as one of the crucial security challenges due to its high volume and quick variety, especially on the Android platform. Many researches have been proposed to detect malware, but some of them suffer low detection accuracy or high time consumption. This research implements an effective mobile malware detection framework by proposing a new feature selection method, which is term frequency-sample frequency differentiation (TF-SFD), to reduce the features with little importance. In addition, a false positive rate (FPR) filter is proposed based on sample frequency differentiation (SFD) for reducing FPR. We investigate four machine learning methods and the experimental results show that the TF-SFD combining with random forest (RF) classifier performs best in terms of accuracy in detecting malware on Android, which obtains 92.54% testing accuracy.

An effective mobile malware detection framework for android security

Mobile malware is considered as one of the crucial security challenges due to its high volume and quick variety, especially on the Android platform. Many researches have been proposed to detect malware, but some of them suffer low detection accuracy or high time consumption. This research implements an effective mobile malware detection framework by proposing a new feature selection method, which is term frequency-sample frequency differentiation (TF-SFD), to reduce the features with little importance. In addition, a false positive rate (FPR) filter is proposed based on sample frequency differentiation (SFD) for reducing FPR. We investigate four machine learning methods and the experimental results show that the TF-SFD combining with random forest (RF) classifier performs best in terms of accuracy in detecting malware on Android, which obtains 92.54% testing accuracy.

Access Control Policy on Mobile Operating System Frameworks –A survey

Background: Access control is the method of granting permissions according to policies. Mobile devices, such as Smartphone, are acting as multi-purpose devices for private as well as the corporate environment. Since the applications in the Smartphone are accessing in various contexts, there would be a leakage of data and applications. Furthermore, when third party apps are downloading on Android-based platforms, it causes threats to the existing system applications. So, different access control policies have been implemented in the Android-based Smartphone to separate the own application and corporate application for providing security. Methods: This paper presents a survey of access control models in various frameworks and compares them by their performance evaluations. The performance of each framework is corresponding to the characteristics of access control policies. These access controls are categorizing according to role, discretionary, mandatory, context, and attributes. Finding: We have found that, Context-Based Access Control (CBAC) and Dynamic Role Based Access Control (DRBAC) are providing better performance. Hence, to give robust security for mobile operating systems the hybrid access policies can be considered. Applications: This hybrid approach might provide a good Android security framework with acceptable performance.

Teaching android security through examples

column Share on Teaching android security through examples: a publicly available database of vulnerable apps Authors: Daniel E. Krutz RIT - Software Engineering RIT - Software EngineeringView Profile , Samuel A. Malachowsky RIT - Software Engineering RIT - Software EngineeringView Profile Authors Info & Claims ACM InroadsVolume 7Issue 4December 2016 pp 96–98https://doi.org/10.1145/2994152Published:21 November 2016Publication History 0citation148DownloadsMetricsTotal Citations0Total Downloads148Last 12 Months5Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

A hybrid approach of mobile malware detection in Android

Android security incidents occurred frequently in recent years. This motivates us to study mobile app security, especially in Android open mobile operating system. In this paper, we propose a novel hybrid approach for mobile malware detection by adopting both dynamic analysis and static analysis. We collect execution data of sample malware and benign apps using a net_link technology to generate patterns of system calls related to file and network access. Furthermore, we build up a malicious pattern set and a normal pattern set by comparing the patterns of malware and benign apps with each other. For detecting an unknown app, we use a dynamic method to collect its system calling data. We then compare them with both the malicious and normal pattern sets offline in order to judge the unknown app. Based on the test on a set of mobile malware and benign apps, we found that our approach achieves better detection success rate than some methods using either static analysis or dynamic analysis. What is more, the proposed approach is generic, which can detect different types of malware effectively. Its detection accuracy can be further improved since the pattern sets can be automatically optimized through self-learning.

*droid

The security research community has invested significant effort in improving the security of Android applications over the past half decade. This effort has addressed a wide range of problems and resulted in the creation of many tools for application analysis. In this article, we perform the first systematization of Android security research that analyzes applications, characterizing the work published in more than 17 top venues since 2010. We categorize each paper by the types of problems they solve, highlight areas that have received the most attention, and note whether tools were ever publicly released for each effort. Of the released tools, we then evaluate a representative sample to determine how well application developers can apply the results of our community’s efforts to improve their products. We find not only that significant work remains to be done in terms of research coverage but also that the tools suffer from significant issues ranging from lack of maintenance to the inability to produce functional output for applications with known vulnerabilities. We close by offering suggestions on how the community can more successfully move forward.

A static technique for detecting input validation vulnerabilities in Android apps

Input validation vulnerabilities are common in Android apps, especially in inter-component communications. Malicious attacks can exploit this kind of vulnerability to bypass Android security mechanism and compromise the integrity, confidentiality and availability of Android devices. However, so far there is not a sound approach at the source code level for app developers aiming to detect input validation vulnerabilities in Android apps. In this paper, we propose a novel approach for detecting input validation flaws in Android apps and we implement a prototype named EasyIVD, which provides practical static analysis of Java source code. EasyIVD leverages backward program slicing to extract transaction and constraint slices from Java source code. Then EasyIVD validates these slices with predefined security rules to detect vulnerabilities in a known pattern. To detect vulnerabilities in an unknown pattern, EasyIVD extracts implicit security specifications as frequent patterns from the duplicated slices and verifies them. Then EasyIVD semi-automatically confirms the suspicious rule violations and reports the confirmed ones as vulnerabilities. We evaluate EasyIVD on four versions of original Android apps spanning from version 2.2 to 5.0. It detects 58 vulnerabilities including confused deputy attacks and denial of service attacks. Our results prove that EasyIVD can provide a practical defensive solution for app developers.

Toward Engineering a Secure Android Ecosystem

The openness and extensibility of Android have made it a popular platform for mobile devices and a strong candidate to drive the Internet-of-Things. Unfortunately, these properties also leave Android vulnerable, attracting attacks for profit or fun. To mitigate these threats, numerous issue-specific solutions have been proposed. With the increasing number and complexity of security problems and solutions, we believe this is the right moment to step back and systematically re-evaluate the Android security architecture and security practices in the ecosystem. We organize the most recent security research on the Android platform into two categories: the software stack and the ecosystem. For each category, we provide a comprehensive narrative of the problem space, highlight the limitations of the proposed solutions, and identify open problems for future research. Based on our collection of knowledge, we envision a blueprint for engineering a secure, next-generation Android ecosystem.

Framework for malware analysis in Android

Android is a open source operating system with more than a billion of users, including all kind of devices (cell phones, TV, smart watch, etc). The amount of sensitive data “using” this technologies has increased the cyber criminals interest to develop tools and techniques to acquire that information or to disrupt the device's smooth operation. Despite several solutions are able to guarantee an adequate level of security, day by day the hackers skills grows up (because of their growing experience), what means a permanent challenge for security tools developers. As a response, several members of the research community are using artificial intelligence tools for Android security, particularly machine learning techniques to classify between healthy and malicious apps; from an analytic review of those works, this paper propose a static analysis framework and machine learning to do that classification.

Android and iOS Security – An Analysis and Comparison Report

Android and iOS Security – An Analysis and Comparison Report

Android application security vulnerability analysis framework based on feature matching

Android application security vulnerability analysis framework based on feature matching

Android Security Vulnerabilities Due to User Unawareness and Frameworks for Overcoming Those Vulnerabilities

With the popularity of Android smart phones everyone finds it convenient to make transactions through these smart phones. And the users of these smart phones, in most cases unaware of different types of threats. The purpose for this survey paper is to conduct a survey on users to get the information about the security vulnerabilities they are creating unknowingly, bringing forward some security frameworks for these threats & giving a basic knowledge to the new comer to the android about android OS architecture and the threats to this architecture.

안드로이드 애플리케이션 보안 강화를 위한 강제적 접근 제어 기법

In this paper, we investigate the security issues of the Android platform which dominates the global market of smart mobile devices. The current permission model for Android security is not powerful and has two problems. One is the coarse-grained relationship between permissions and methods which require them. The other is that mobile users do not have rights to control the permissions of the application. To solve these problems, we propose MacDroid which can control the platform's resources for accessing installed applications. Users can control the application's behavior via MacDroid's policy. We have divided the permission set into method units. The results of the performance test using a pure Android platform show that our proposed scheme can improve security within a short time.

Taming transitive permission attack via bytecode rewriting on Android application

AbstractGoogle Android is popular for mobile devices in recent years. The openness and popularity of Android make it a primary target for malware. Even though Android's security mechanisms could defend most malware, its permission model is vulnerable to transitive permission attack, a type of privilege escalation attacks. Many approaches have been proposed to detect this attack by modifying the Android OS. However, the Android's fragmentation problem and requiring rooting Android device hinder those approaches large‐scale adoption. In this paper, we present an instrumentation framework, called SEAPP, for Android applications (or “apps”) to detect the transitive permission attack on unmodified Android. SEAPP automatically rewrites an app without requiring its source codes and produces a security‐harden app. At runtime, call‐chains are built among these apps and detection process is executed before a privileged API is invoked. Our experimental results show that SEAPP could work on a large number of benign apps from the official Android market and malicious apps, with a repackaged success rate of over 99.8%. We also show that our framework effectively tracks call‐chains among apps and detects known transitive permission attack with low overhead. Copyright © 2016 John Wiley & Sons, Ltd.

Automatic permission inference for hybrid mobile apps

The application permission system is one of the key components of Android security. Developers often use it incorrectly and claim more permissions than necessary, due to limitations of developers' knowledge and development tools. When application's vulnerabilities are exploited, the additional permissions give attackers more capability to carry out attacks. Hybrid mobile applications (apps) are a class of mobile apps that are built from web technologies, such as HTML, JavaScript, and CSS. In such applications, it is often easier to inject third-party code through vulnerabilities. When developers do not specify app's permissions correctly, the injected code will result in dangerous actions breaching system security. In this paper, we develop an automatic tool to assist developers to identify the permissions required by the apps based on the hybrid mobile apps' runtime permission checking.