Sensitive APIs Research Articles

GHGDroid: Global heterogeneous graph-based android malware detection

As the most popular mobile platform, Android has become the major attack target of malware, and thus there is an urgent need to effectively thwart them. Recently, the graph-based technique has been a promising solution for malware detection, which highly depends on graph structures to capture behaviors separating the malware from the benign apps. However, existing graph-based malware detection approaches still suffer from high computation cost in constructing or updating a graph for APK under detection, high false negative and false positive. To cope with these issues, we propose a novel global heterogeneous graph-based Android malware detection approach, named GHGDroid. A global heterogeneous graph (GHG) with a good updatability is first built on large-scale Android applications to characterize complex relationships among APKs and sensitive APIs. And then, using the GHG, a multi-layer graph convolutional network based embedding method is proposed to learn APK embeddings for well capturing behaviors that can separate malware from benign. Finally, using APK embeddings as well their labels, a malware classifier is trained. Experiments on real-world Android applications show that GHGDroid achieves 99.17 % F1-score, which outperforms the state-of-the-art approaches. Moreover, GHGDroid spends about 8 s on detecting an APK, which shows that it has a good potential as a practical tool for the Android malware detection task.

SHFuzz: Service handler-aware fuzzing for detecting multi-type vulnerabilities in embedded devices

Embedded devices in IoT are of great convenience to our daily lives and industries, but they also introduce multi-type vulnerabilities. Most vulnerabilities reside in various handlers of service program. However, existing fuzzing methods existing fuzzing methods can neither efficiently nor effectively to discover these vulnerabilities: they can not extract the service handler alone and properly pool resources for testing them.In this study, we propose a novel service handlers aware fuzzing method to efficiently discover multi-type vulnerabilities in embedded devices. Our key observation is that service program dispatches the service handlers (the code snippet which implements the desired work of user request) in two general ways. Meanwhile, multi-type vulnerabilities usually happen at sensitive APIs during the execution of service handler. So in our method, we first design a static analysis method to extract the info of service handlers and sensitive APIs. Then during fuzzing, the service handler coverage strategy guides the fuzzer to cover more service handlers; after the sensitive APIs are reached, the sensitive APIs exploitation strategy is proposed to strengthen the ability and efficiency of discovering vulnerabilities. Based on our method, we implement a prototype system, named SHFuzz. Experiments on 19 target programs from popular brand devices show that, SHFuzz outperforms the state-of-art tool FIRM-AFL in the coverage of sensitive APIs, the diversity of detected vulnerabilities and efficiency. Furthermore, SHFuzz discovers 16 zero-day vulnerabilities and reports them to vendors.

SeGDroid: An Android malware detection method based on sensitive function call graph learning

Malware is still a challenging security problem in the Android ecosystem, as malware is often obfuscated to evade detection. In such case, semantic behavior feature extraction is crucial for training a robust malware detection model. In this paper, we propose a novel Android malware detection method (named SeGDroid) that focuses on learning the semantic knowledge from sensitive function call graphs (FCGs). Specifically, we devise a graph pruning method to build a sensitive FCG on the base of an original FCG. The method preserves the sensitive API (security-related API) call context and removes the irrelevant nodes of FCGs. We propose a node representation method based on word2vec and social-network-based centrality to extract attributes for graph nodes. Our representation aims at extracting the semantic knowledge of the function calls and the structure of graphs. Using this representation, we induce graph embeddings of the sensitive FCGs associated with node attributes using a graph convolutional neural network algorithm. To provide a model explanation, we further propose a method that calculates node importance. This creates a mechanism for understanding malicious behavior. The experimental results show that SeGDroid achieves an F-score of 98% in the case of malware detection on the CICMal2020 dataset and an F-score of 96% in the case of malware family classification on the MalRadar dataset. In addition, the provided model explanation is able to trace the malicious behavior of the Android malware.

MsDroid: Identifying Malicious Snippets for Android Malware Detection

Machine learning has shown promise for improving the accuracy of Android malware detection in the literature. However, it is challenging to (1) stay robust towards real-world scenarios and (2) provide interpretable explanations for experts to analyse. In this paper, we propose MsDroid, an Android malware detection system that makes decisions by identifying malicious snippets with interpretable explanations. We mimic a common practice of security analysts, i.e., filtering APIs before looking through each method, to focus on local snippets around sensitive APIs instead of the whole program. Each snippet is represented with a graph encoding both code attributes and domain knowledge and then classified by GNN. To identify malicious snippets, we present a semi-supervised learning approach that only requires app labeling. To make malicious snippets less opaque, we design an explanation mechanism to show the importance of control flows and to retrieve similarly implemented snippets from known malwares. A comprehensive comparison with 5 baseline methods is conducted on a dataset of more than 81K apps in 3 real-world scenarios. The experimental results show that MsDroid is more robust than state-of-the-art systems in all cases, with 5.37% to 49.52% advantage in F1-score. Besides, we demonstrate how the explanations facilitate malware analysis

IOS and Android Platform Development of Korean Professional Application-Oriented Talent Training Platform Based on Multi-Dimensional Information Transmission Algorithm

iOS and Android platform development of Korean professional application-oriented talent training platform based on multi-dimensional information transmission algorithm. Firstly, we consider the data security of the system. When the application executes the sensitive operation, the policy executor will request the security policy from the security decision center. If the security policy contains restriction rules for the sensitive operation, the security decision center instructs the policy executor to carry out corresponding permission control and security operation. It is necessary to first perform static analysis on the Android application specified by the user to obtain all sensitive API calls and dangerous permission requests involved in the application; then convert the obtained information into policy points, and decide whether to agree or not by operating the policy points. Dangerous requests from applications and more fine-grained API calls. With these technologies, the professional application-oriented talent training platform is implemented. Through the verification, the efficiency of the platform is tested.

Android malware detection based on sensitive patterns

In recent years, the rapid increase in the number and type of Android malware has brought great challenges and pressure to malware detection systems. As a widely used method in android malware detection, static detecting has been a hot topic in academia and industry. However, in order to improve the accuracy of detection, the existing static detecting methods sacrifice the excessively high analysis complexity and time cost. Moreover, the correlation between static features leads to redundancy of a large amount of data. Therefore, this paper proposes a static detecting method of Android malware based on sensitive pattern. It uses an improved FP-growth algorithm to mine frequent combinations of sensitive permissions and API calls in malicious apps and benign apps, which avoids the generation of redundant information. In addition, this paper adopts multi-layered gradient boosting decision trees algorithm to train the detection model. And a dual similarity combination method is proposed to measure the similarity between different sensitive patterns. The experimental results show that our proposed detection method has high accuracy and great generalization ability.

MapperDroid: Verifying app capabilities from description to permissions and API calls

Android Applications (Apps) are usually accompanied by a text description and a permissions manifest which are expected to describe the app behaviour. However, an app may request or use more permissions than what has been described. Therefore, the permissions declared in the application manifest alone can not be interpreted as the ground truth. Recent literature reported that malicious apps under-report permissions. Such a scenario is a security and privacy risk. In this work, to discover such instances, we establish a correspondence from the application description to the permissions manifest leading to the Android API calls of the app. After experimentation on more than 25,000 random apps from Google Play Store over 19 different Android permissions, we show that a vast majority of apps understate at least one permission. This phenomenon raises data privacy and security concerns due to over-privileged application binaries. The correspondence is of significance because each additional permission corresponds to one or more sensitive or protected API calls made by the app which is not explicitly known to the user. We created a data set for our work which contains app metadata from where different permission sets are obtained. Our approach to detect under-reporting of permissions is scalable with respect to the number of apps.

Exploring the use of static and dynamic analysis to improve the performance of the mining sandbox approach for android malware identification

The popularization of the Android platform and the growing number of Android applications (apps) that manage sensitive data turned the Android ecosystem into an attractive target for malicious software. For this reason, researchers and practitioners have investigated new approaches to address Android’s security issues, including techniques that leverage dynamic analysis to mine Android sandboxes. The mining sandbox approach consists in running dynamic analysis tools on a benign version of an Android app. This exploratory phase records all calls to sensitive APIs. Later, we can use this information to (a) prevent calls to other sensitive APIs (those not recorded in the exploratory phase) or (b) run the dynamic analysis tools again in a different version of the app. During this second execution of the fuzzing tools, a warning of possible malicious behavior is raised whenever the new version of the app calls a sensitive API not recorded in the exploratory phase.The use of a mining sandbox approach is an effective technique for Android malware analysis, as previous research works revealed. Particularly, existing reports present an accuracy of almost 70% in the identification of malicious behavior using dynamic analysis tools to mine android sandboxes. However, although the use of dynamic analysis for mining Android sandboxes has been investigated before, little is known about the potential benefits of combining static analysis with a mining sandbox approach for identifying malicious behavior. Accordingly, in this paper we present the results of two studies that investigate the impact of using static analysis to complement the performance of existing dynamic analysis tools tailored for mining Android sandboxes, in the task of identifying malicious behavior.In the first study we conduct a non-exact replication of a previous study (hereafter BLL-Study) that compares the performance of test case generation tools for mining Android sandboxes. Differently from the original work, here we isolate the effect of an independent static analysis component (DroidFax) they used to instrument the Android apps in their experiments. This decision was motivated by the fact that DroidFax could have influenced the efficacy of the dynamic analyses tools positively—through the execution of specific static analysis algorithms DroidFax also implements. In our second study, we carried out a new experiment to investigate the efficacy of taint analysis algorithms to complement the mining sandbox approach previously used to identify malicious behavior. To this end, we executed the FlowDroid tool to mine the source–sink flows from benign/malign pairs of Android apps used in a previous research work.Our study brings several findings. For instance, the first study reveals that DroidFax alone (static analysis) can detect 43.75% of the malwares in the BLL-Study dataset, contributing substantially in the performance of the dynamic analysis tools in the BLL-Study. The results of the second study show that taint analysis is also practical to complement the mining sandboxes approach, with a performance similar to that reached by dynamic analysis tools.

KRDroid: Ransomware-Oriented Detector for Mobile Devices Based on Behaviors

Ransomware has become a serious threat on Android and new cases of ransomware are continuously growing. Most existing ransomware detectors use sensitive text or APIs to detect ransomware. Some goodware applications with the functionalities of locking screen and encrypting files have similar behaviors with ransomware. It is difficult for ransomware detectors to identity them. In this paper, we made detailed analyses of three kinds of active ransomware. We proposed a behavior-based ransomware detector on Android, called KRDroid. KRDroid deploys on servers or PCs, that is, ransomware cannot be activated and cause any loss during testing. Experiments showed that our ransomware-oriented detector can find 1809 of 1862 unseen ransomware. It can also distinguish goodware with similar ransom behaviors to ransomware with an accuracy of 97.5%.

IntDroid

Android, the most popular mobile operating system, has attracted millions of users around the world. Meanwhile, the number of new Android malware instances has grown exponentially in recent years. On the one hand, existing Android malware detection systems have shown that distilling the program semantics into a graph representation and detecting malicious programs by conducting graph matching are able to achieve high accuracy on detecting Android malware. However, these traditional graph-based approaches always perform expensive program analysis and suffer from low scalability on malware detection. On the other hand, because of the high scalability of social network analysis, it has been applied to complete large-scale malware detection. However, the social-network-analysis-based method only considers simple semantic information (i.e., centrality) for achieving market-wide mobile malware scanning, which may limit the detection effectiveness when benign apps show some similar behaviors as malware. In this article, we aim to combine the high accuracy of traditional graph-based method with the high scalability of social-network-analysis--based method for Android malware detection. Instead of using traditional heavyweight static analysis, we treat function call graphs of apps as complex social networks and apply social-network--based centrality analysis to unearth the central nodes within call graphs. After obtaining the central nodes, the average intimacies between sensitive API calls and central nodes are computed to represent the semantic features of the graphs. We implement our approach in a tool called IntDroid and evaluate it on a dataset of 3,988 benign samples and 4,265 malicious samples. Experimental results show that IntDroid is capable of detecting Android malware with an F-measure of 97.1% while maintaining a True-positive Rate of 99.1%. Although the scalability is not as fast as a social-network-analysis--based method (i.e., MalScan ), compared to a traditional graph-based method, IntDroid is more than six times faster than MaMaDroid . Moreover, in a corpus of apps collected from GooglePlay market, IntDroid is able to identify 28 zero-day malware that can evade detection of existing tools, one of which has been downloaded and installed by more than ten million users. This app has also been flagged as malware by six anti-virus scanners in VirusTotal, one of which is Symantec Mobile Insight .

Visual Detection for Android Malware using Deep Learning

The most serious threats to the current mobile internet are Android Malware. In this paper, we proposed a static analysis model that does not need to understand the source code of the android applications. The main idea is as most of the malware variants are created using automatic tools. Also, there are special fingerprint features for each malware family. According to decompiling the android APK, we mapped the Opcodes, sensitive API packages, and high-level risky API functions into three channels of an RGB image respectively. Then we used the deep learning technique convolutional neural network to identify Android application as benign or as malware. Finally, the proposed model succeeds to detect the entire 200 android applications (100 benign applications and 100 malware applications) with an accuracy of over 99% as shown in experimental results.

SEAPP: A secure application management framework based on REST API access control in SDN-enabled cloud environment

Cloud computing provides scalable network services and makes network management more flexible by combining Software-Defined Networking (SDN). Through the northbound interface (e.g., REST API) offered by the SDN controller, users can easily deploy diversified applications to access the network resources. However, exploiting the openness of the northbound interface, malicious applications abuse APIs to launch hostile attacks, which poses serious threats to the network. In this paper, we propose SEAPP, a secure application management framework based on REST API access control. Our main idea is to granularly manage application permissions and encrypt REST API calls to defend against malicious attacks. SEAPP includes two components: 1) permissions detection engine identifies the facticity of application permissions by analyzing permission manifests and byte codes and further identifies the legality of permissions with constructed sensitive API list; 2) registration authorization engine executes encrypted registration between applications and controller by virtue of NTRU algorithm and authorizes applications to call the requested REST APIs based on their risk levels after securely authenticating them. Besides, SEAPP is a lightweight logic architecture between application plane and control plane and supports quick deployment and reconfiguration in runtime. Both theoretical analysis and evaluation results show the security and effectiveness of SEAPP. Besides, SEAPP introduces negligible CPU and memory overheads.

Recommending Security Requirements for the Development of Android Applications Based on Sensitive APIs

App stores allow anyone to sell his products to millions of potential users. However, limited by the resources and time, some developers often focus on the functionalities of their Apps without well-rounded considering security problems, which are more and more important for a successful product. In this paper, we propose an approach to help developers elicit security requirements by recommending related information gained from existing Apps in the marketplace. Firstly, we construct a feature framework to summarize functionalities of Apps by mining their descriptions with the method proposed in our previous work. Then, the sensitive APIs used in these Apps are extracted from their APK files and mapped with App features. Finally, we establish relationships between permissions and functionalities by taking sensitive APIs as a bridge, and design a recommendation framework to show information according to developers' demands from two aspects: the security requirements for the whole App and the ones for the given functionality. We evaluate our approach with 580 Apps from 5 categories on Google Play. The results confirm the usefulness of our approach, especially it can help new developers without experience initialize the security requirements and give mature developers supplementary information to elicit security requirements completely.

SEDMDroid: An Enhanced Stacking Ensemble Framework for Android Malware Detection

The popularity of the Android platform in smartphones and other Internet-of-Things devices has resulted in the explosive of malware attacks against it. Malware presents a serious threat to the security of devices and the services they provided, e.g. stealing the privacy sensitive data stored in mobile devices. This work raises a stacking ensemble framework SEDMDroid to identify Android malware. Specifically, to ensure individual's diversity, it adopts random feature subspaces and bootstrapping samples techniques to generate subset, and runs Principal Component Analysis (PCA) on each subset. The accuracy is probed by keeping all the principal components and using the whole dataset to train each base learner Multi-Layer Perception (MLP). Then, Support Vector Machine (SVM) is employed as the fusion classifier to learn the implicit supplementary information from the output of the ensemble members and yield the final prediction result. We show experimental results on two separate datasets collected by static analysis way to prove the effectiveness of the SEDMDroid. The first one extracts permission, sensitive API, monitoring system event and so on that are widely used in Android malwares as the features, and SEDMDroid achieves 89.07% accuracy in term of these multi-level static features. The second one, a public big dataset, extracts the sensitive data flow information as the features, and the average accuracy is 94.92%. Promising experiment results reveal that the proposed method is an effective way to identify Android malware.

The Best of Both Worlds: Mitigating Trade-offs Between Accuracy and User Burden in Capturing Mobile App Privacy Preferences

Abstract In today’s data-centric economy, data flows are increasingly diverse and complex. This is best exemplified by mobile apps, which are given access to an increasing number of sensitive APIs. Mobile operating systems have attempted to balance the introduction of sensitive APIs with a growing collection of permission settings, which users can grant or deny. The challenge is that the number of settings has become unmanageable. Yet research also shows that existing settings continue to fall short when it comes to accurately capturing people’s privacy preferences. An example is the inability to control mobile app permissions based on the purpose for which an app is requesting access to sensitive data. In short, while users are already overwhelmed, accurately capturing their privacy preferences would require the introduction of an even greater number of settings. A promising approach to mitigating this trade-off lies in using machine learning to generate setting recommendations or bundle some settings. This article is the first of its kind to offer a quantitative assessment of how machine learning can help mitigate this trade-off, focusing on mobile app permissions. Results suggest that it is indeed possible to more accurately capture people’s privacy preferences while also reducing user burden.

An Empirical Study on Android malware behavior signature extraction

Malicious applications, especially in mobile devices, constitute a serious threats to user data. Dueto the openness, Android have become the most popular smart phone operating system in mobilemarket. Although fast and straightforward, Static analysis approach has many difficulties to detectstealthy malware. In this paper, we propose a behavior signature-based to classify whether malwareor not. To achieve this, we first hook a number of sensitive APIs to collect all possible invocationsof the app. We then extract the behaviors of malicious applications by comparing their flows and thevalue of parameters and results of each called APIs. In our study, we extracted behavior signaturesfrom malware in each family. Our works help to improve the quality of analysis compared with staticanalysis-only approaches.

System Call Dependence Graph Based Behavior Decomposition of Android Applications

Millions of developers and third-party organizations have flooded into the Android ecosystem due to Android’s open-source feature and low barriers to entry for developers. .However, that also attracts many attackers. Over 90 percent of mobile malware is found targeted on Android. Though Android provides multiple security features and layers to protect user data and system resources, there are still some overprivileged applications in Google Play Store or third-party Android app stores at wild. In this paper, we proposed an approach to map system level behavior and Android APIs, based on the observation that system level behaviors cannot be avoidedbut sensitive Android APIs could be evaded.To the best of our knowledge, our approach provides the first work to decompose Android application behaviors based on system-level behaviors. We then map system level behaviors and Android APIs through System Call Dependence Graphs. The study also shows that our approach can effectively identify potential permission abusing, with an almost negligible performance impact.

A scalable, flow-and-context-sensitive taint analysis of android applications

This paper focuses on scalable static analysis techniques for finding information leaks in Android apps. Finding such leaks scalably is challenging because Android apps have on average over 100 invocations of sensitive APIs, yielding a massive multi-source taint analysis problem.We present the design of STAR, a context-sensitive and flow-sensitive multi-source taint analysis aimed at tackling this problem. STAR incorporates two main ideas to achieve high performance and scalability. The first is a novel summarization technique we refer to as symbolic summarization, which is crucial for the analysis to scale well with the number of source APIs. The second is a combination of techniques aimed at efficient propagation of abstract states both within and across method boundaries. Our experiments over a dataset composed of 400,000 apps show that the proposed techniques improve performance over an IFDS-style analysis by a factor of 30 on average, and by up to four orders of magnitude on large apps.

SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICATIONS

Millions of developers and third-party organizations have flooded into the Android ecosystem due to Android’s open-source feature and low barriers to entry for developers. .However, that also attracts many attackers. Over 90 percent of mobile malware is found targeted on Android. Though Android provides multiple security features and layers to protect user data and system resources, there are still some overprivileged applications in Google Play Store or third-party Android app stores at wild. In this paper, we proposed an approach to map system level behavior and Android APIs, based on the observation that system level behaviors cannot be avoided but sensitive Android APIs could be evaded. To the best of our knowledge, our approach provides the first work to decompose Android application behaviors based on system-level behaviors. We then map system level behaviors and Android APIs through System Call Dependence Graphs. The study also shows that our approach can effectively identify potential permission abusing, with an almost negligible performance impact.

Compaction characteristics of a micro-structured fillerbinder “Microcrystarcellactose B3” for direct compression tableting

A research was conducted to develop and evaluate a highly compressible micro-structured filler- binder for direct compression tableting. Tapioca starch (TS) was annealed, hydrolyzed and coprocessed with α -lactose monohydrate (α-LMH) and microcrystalline cellulose (MCC) to yield a novel microcrystarcellactose (MSCL B3). The powder suspensions were prepared at a concentration of 40 %w/w in five separate conical flasks. The TS granules were annealed for 1 h and subsequently hydrolyzed with α-amylase at 58 o and pH 7 for 1, 2, 3, 4, and 5 h respectively. The reaction was terminated and neutralized with 0.1 N HCL and 0.1 N NaOH respectively. The enzyme hydrolyzed starch (EHS) at 3 h, sieved fraction >75-250 μm was coprocessed with α-LMH and MCC and compressed with load ranging from 2.5 to 12.5 KN. MSCL B3 (component ratio of EHS, α-LMH, and MCC ‘35: 35:30’) possessed improved functionality over direct physical mixture of the excipients. The Py (yield values) are: Cellactose (24.2 MNm -2 ) > MCC (25 MNm -2 ) > MSCL B3 (50.0 MNm -2 ) > Starlac (143 MNm -2 ). The degree of plastic deformation occurring “Pk” are in the following order: MSCL B3 (17.0 MNm -2 ) = Cellactose ® (17.0 MNm -2 ) > MCC (18.6 MNm -2 ) > Starlac ® (19.1 MNm -2 ). MSCL B3 is as good as Cellactose ® and more superior in functionality than Starlac ® and MCC. The dilution potential for MSCL B3 in PCM and AA tablets were: 45% and 50 % respectively. MSCL B3 can be used to formulate softer tablet of both poorly compressible API and moisture sensitive API Keywords: Microcrystarcellactose; Coprocessed excipient; Directly compressible excipient; Highly functional fillerbinder; Tapioca starch