Skip to main content
Disciplines
Automotive Business IT + Informatics Construction + Real Estate Electrical Engineering + Electronics Energy + Sustainability Insurance + Risk Finance + Banking Management + Leadership Marketing + Sales Mechanical Engineering + Materials
Events
DE
EN
Books
Journals
Topic Page
Marketing
Start single access now
Access for companies
EXTENDED SEARCH
Log in
Top
Published in:
Towards Customizable CPS: Composability, Efficiency and Predictability Read chapter Read first chapter

2017 | OriginalPaper | Chapter

An Improved Android Collusion Attack Detection Method Based on Program Slicing

Authors : Yunhao Liu, Xiaohong Li, Zhiyong Feng, Jianye Hao

Published in: Formal Methods and Software Engineering

Publisher: Springer International Publishing

Log in

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

Android applications can leak sensitive information through collusion, which gives the smartphone users a great security risk. We propose an Android collusion attack detection method based on control flow and data flow analysis. This method gives analysis of data propagation between different applications firstly. And then, a multi-apps program slice model based on both data and control flow are given. Last, the privacy data leakage paths of multi-apps are computed by reaching-definition analysis. Meanwhile, the criterions of mobile device information leakage edge are redefined according to the correlation of mobile devices. Based on the above principle, we implemented an Android collusion attack sensitive information leakage detection tools called CollusionDetector. Case study is carried out for typical collusion attack scenarios and it can obtain better results than existing tools and methods. Experiments show that the analysis of control flow can more accurately find the path of privacy propagation, and more effectively to identify collusion attacks.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

inform now
previous chapter Exploring Design Alternatives for RAMP Transactions Through Statistical Model Checking
next chapter Parameterized Complexity of Resilience Decision for Database Debugging
Literature
1.
Davi, L., Dmitrienko, A., Sadeghi, A.-R., Winandy, M.: Privilege escalation attacks on android. In: Burmester, M., Tsudik, G., Magliveras, S., Ilić, I. (eds.) ISC 2010. LNCS, vol. 6531, pp. 346–360. Springer, Heidelberg (2011). doi:10.​1007/​978-3-642-18178-8_​30 CrossRef
2.
3.
Arzt, S., Rasthofer, S., Fritz, C., Bodden, E., Bartel, A., Klein, J., Traon, Y.L., Octeau, D., Mcdaniel, P.: Flowdroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps. ACM Sigplan Not. 49(6), 259–269 (2014)CrossRef
4.
Babil, G.S., Mehani, O., Boreli, R., Kaafar, M.A.: On the effectiveness of dynamic taint analysis for protecting against private information leaks on android-based devices. In: International Conference on Security and Cryptography, pp. 1–8 (2013)
5.
Cavallaro, L., Saxena, P., Sekar, R.: Anti-taint-analysis: practical evasion techniques against information flow based malware defense. Stony Brook University (2007)
6.
Cavallaro, L., Saxena, P., Sekar, R.: On the limits of information flow techniques for malware analysis and containment. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol. 5137, pp. 143–163. Springer, Heidelberg (2008). doi:10.​1007/​978-3-540-70542-0_​8 CrossRef
7.
Chin, E., Felt, A.P., Greenwood, K., Wagner, D.: Analyzing inter-application communication in android. Plant Soil 269(1–2), 309–320 (2011)
8.
Einarsson, A., Nielsen, J.D.: A survivor’s guide to java program analysis with soot. Notes from Department of Computer Science (2008)
9.
Enck, W., Ongtang, M., McDaniel, P.: On lightweight mobile phone application certification (2009)
10.
Enck, W., Gilbert, P., Chun, B.G., Cox, L.P., Jung, J., Mcdaniel, P., Sheth, A.N.: Taintdroid: an information-flow tracking system for realtime privacy monitoring on smartphones. In: USENIX Conference on Operating Systems Design and Implementation, pp. 99–106 (2010)
11.
Fuchs, A.P., Chaudhuri, A., Foster, J.S.: Scandroid: automated security certification of android applications (2009)
12.
Gibler, C., Crussell, J., Erickson, J., Chen, H.: AndroidLeaks: automatically detecting potential privacy leaks in android applications on a large scale. In: Katzenbeisser, S., Weippl, E., Camp, L.J., Volkamer, M., Reiter, M., Zhang, X. (eds.) Trust 2012. LNCS, vol. 7344, pp. 291–307. Springer, Heidelberg (2012). doi:10.​1007/​978-3-642-30921-2_​17 CrossRef
13.
Graa, M., Cuppens-Boulahia, N., Cuppens, F., Cavalli, A.: Detecting control flow in smarphones: combining static and dynamic analyses. In: Xiang, Y., Lopez, J., Kuo, C.-C.J., Zhou, W. (eds.) CSS 2012. LNCS, vol. 7672, pp. 33–47. Springer, Heidelberg (2012). doi:10.​1007/​978-3-642-35362-8_​4 CrossRef
14.
Horwitz, S., Reps, T., Binkley, D.: Interprocedural slicing using dependence graphs. In: ACM Sigplan 1988 Conference on Programming Language Design and Implementation, pp. 35–46 (1988)
15.
16.
Li, L., Bartel, A., Bissyandé, T.F., Klein, J., Traon, Y.L.: ApkCombiner: combining multiple android apps to support inter-app analysis. In: Federrath, H., Gollmann, D. (eds.) SEC 2015. IAICT, vol. 455, pp. 513–527. Springer, Cham (2015). doi:10.​1007/​978-3-319-18467-8_​34 CrossRef
17.
Li, L., Bartel, A., Klein, J., Traon, Y.L., Arzt, S., Rasthofer, S., Bodden, E., Octeau, D., Mcdaniel, P.: IccTA: detecting inter-component privacy leaks in android apps. In: IEEE/ACM IEEE International Conference on Software Engineering, pp. 280–291 (2015)
18.
Octeau, D., Mcdaniel, P., Jha, S., Bartel, A., Bodden, E., Klein, J., Traon, Y.L.: Effective inter-component communication mapping in android with epicc: an essential step towards holistic security analysis. In: USENIX Conference on Security, pp. 543–558 (2013)
19.
Rashidi, B., Fung, C.: A survey of android security threats and defenses. J. Wirel. Mob. Netw. Ubiquitous Comput. Dependable Appl. 6, 3–35 (2015)
20.
Reps, T., Horwitz, S., Sagiv, M.: Precise interprocedural dataflow analysis via graph reachability. In: POPL 1995, vol. 167(96), pp. 49–61 (1995). Lecture Notes in Computer Science
21.
Schwartz, E.J., Avgerinos, T., Brumley, D.: All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask). In: Security and Privacy, pp. 317–331 (2010)
22.
Wargo, J.M.: Phonegap Essentials: Building Cross-platform Mobile Apps. Pearson Schweiz AG, Zug (2012)
23.
Wei, F., Roy, S., Ou, X., Robby.: Amandroid: a precise and general inter-component data flow analysis framework for security vetting of android apps. In: ACM SIGSAC Conference on Computer and Communications Security, pp. 1329–1341 (2014)
24.
Weiser, M.: Program slicing. In: International Conference on Software Engineering, pp. 439–449 (1981)
25.
Wu, L., Grace, M., Zhou, Y., Wu, C., Jiang, X.: The impact of vendor customizations on android security. In: ACM SIGSAC Conference on Computer and Communications Security, pp. 623–634 (2013)
26.
Xing, L., Pan, X., Wang, R., Yuan, K., Wang, X.F.: Upgrading your android, elevating my malware: privilege escalation through mobile OS updating. In: IEEE Symposium on Security and Privacy, pp. 393–408 (2014)
Metadata
Title
An Improved Android Collusion Attack Detection Method Based on Program Slicing
Authors
Yunhao Liu
Xiaohong Li
Zhiyong Feng
Jianye Hao
Copyright Year
2017
Book
Formal Methods and Software Engineering

Print ISBN: 978-3-319-68689-9

Electronic ISBN: 978-3-319-68690-5

Copyright Year: 2017

DOI
https://doi.org/10.1007/978-3-319-68690-5_19

Premium Partner

    Image Credits