Skip to main content
Erschienen in: Mobile Networks and Applications 1/2009

01.02.2009

Monitoring Smartphones for Anomaly Detection

verfasst von: Aubrey-Derrick Schmidt, Frank Peters, Florian Lamour, Christian Scheel, Seyit Ahmet Çamtepe, Şahin Albayrak

Erschienen in: Mobile Networks and Applications | Ausgabe 1/2009

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

In this paper we demonstrate how to monitor a smartphone running Symbian operating system and Windows Mobile in order to extract features for anomaly detection. These features are sent to a remote server because running a complex intrusion detection system on this kind of mobile device still is not feasible due to capability and hardware limitations. We give examples on how to compute relevant features and introduce the top ten applications used by mobile phone users based on a study in 2005. The usage of these applications is recorded by a monitoring client and visualized. Additionally, monitoring results of public and self-written malwares are shown. For improving monitoring client performance, Principal Component Analysis was applied which lead to a decrease of about 80% of the amount of monitored features.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Weitere Produktempfehlungen anzeigen
Anhänge
Nur mit Berechtigung zugänglich
Fußnoten
1
In the sense of this work, we will use the expressions smartphone, mobile phone and mobile device equivalently.
 
2
Global Positioning System.
 
3
Global System for Mobile Communications.
 
4
Short Message Service.
 
5
General Packet Radio Service.
 
6
Wideband Code Division Multiple Access.
 
7
Freedom of Mobile Multimedia Access.
 
8
Universal Mobile Telecommunications System.
 
9
Infrared Data Association.
 
10
Formerly: Simple Object Access Protocol.
 
11
Tested on Version 9.1 S60 3rd.
 
12
International Mobile Equipment Identity.
 
13
International Mobile Subscriber Identity.
 
15
Will be substituted with MP3 (19%) due to UMTS usage and increasing interest for MP3 capabilities on devices.
 
16
This class was removed since all values are already represented.
 
Literatur
1.
Zurück zum Zitat Abowd GD, Iftode L, Mitchel H (2005) The Smart phone: a first platform for pervasive computing. IEEE Perv Comput 4:18–19CrossRef Abowd GD, Iftode L, Mitchel H (2005) The Smart phone: a first platform for pervasive computing. IEEE Perv Comput 4:18–19CrossRef
2.
Zurück zum Zitat Albayrak S, Scheel C, Milosevic D, Müller A (2005) Combining self-organizing map algorithms for robust and scalable intrusion detection. In: Mohammadian M (ed) Proceedings of international conference on computational intelligence for modelling control and automation (CIMCA 2005). IEEE Computer Society, Los Alamitos, pp 123–130CrossRef Albayrak S, Scheel C, Milosevic D, Müller A (2005) Combining self-organizing map algorithms for robust and scalable intrusion detection. In: Mohammadian M (ed) Proceedings of international conference on computational intelligence for modelling control and automation (CIMCA 2005). IEEE Computer Society, Los Alamitos, pp 123–130CrossRef
3.
Zurück zum Zitat Allen J, Christie A, Fithen W, McHugh J, Pickel J, Stoner E (2000) State of the practice of intrusion detection technologies. Technical Report, CMU/SEI-99-TR-028. Carnegie Mellon Software Engeneering Institue, Pittsburgh, PA, pp 15213–3890 Allen J, Christie A, Fithen W, McHugh J, Pickel J, Stoner E (2000) State of the practice of intrusion detection technologies. Technical Report, CMU/SEI-99-TR-028. Carnegie Mellon Software Engeneering Institue, Pittsburgh, PA, pp 15213–3890
4.
Zurück zum Zitat Axelsson S (2000) Intrusion detection systems: a survey and taxonomy. Technical Report 99-15. Department of Computer Engineering Chalmers University of Technology Göteborg, Sweden Axelsson S (2000) Intrusion detection systems: a survey and taxonomy. Technical Report 99-15. Department of Computer Engineering Chalmers University of Technology Göteborg, Sweden
5.
Zurück zum Zitat Buennemeyer TK, Nelson TM, Clagett LM, Dunning JP, Marchany RC, Tront JG (2008) Mobile device profiling and intrusion detection using smart batteries. In: HICSS ’08: Proceedings of the proceedings of the 41st annual Hawaii international conference on system sciences, p 296. IEEE Computer Society, Washington, DC. doi:10.1109/HICSS.2008.319 CrossRef Buennemeyer TK, Nelson TM, Clagett LM, Dunning JP, Marchany RC, Tront JG (2008) Mobile device profiling and intrusion detection using smart batteries. In: HICSS ’08: Proceedings of the proceedings of the 41st annual Hawaii international conference on system sciences, p 296. IEEE Computer Society, Washington, DC. doi:10.​1109/​HICSS.​2008.​319 CrossRef
7.
Zurück zum Zitat Bulygin Y (2007) Epidemics of mobile worms. In: Proceedings of the 26th IEEE international performance computing and communications conference, IPCCC 2007, New Orleans, 11–13 April 2007. IEEE Computer Society, Los Alamitos, pp 475–478 Bulygin Y (2007) Epidemics of mobile worms. In: Proceedings of the 26th IEEE international performance computing and communications conference, IPCCC 2007, New Orleans, 11–13 April 2007. IEEE Computer Society, Los Alamitos, pp 475–478
9.
Zurück zum Zitat Cheng J, Wong SHY, Yang H, Lu S (2007) Smartsiren: virus detection and alert for smartphones. In: International conference on mobile systems, applications, and services (Mobisys 2007), Puerto Rico, 11–14 June 2007, pp. 258–271 Cheng J, Wong SHY, Yang H, Lu S (2007) Smartsiren: virus detection and alert for smartphones. In: International conference on mobile systems, applications, and services (Mobisys 2007), Puerto Rico, 11–14 June 2007, pp. 258–271
10.
Zurück zum Zitat Davis G, Davis N (2004) Battery-based intrusion detection. In: Global telecommunications conference, 2004. GLOBECOM ’04, vol 4. IEEE, Piscataway, pp 2250–2255. doi:10.1109/GLOCOM.2004.1378409 Davis G, Davis N (2004) Battery-based intrusion detection. In: Global telecommunications conference, 2004. GLOBECOM ’04, vol 4. IEEE, Piscataway, pp 2250–2255. doi:10.​1109/​GLOCOM.​2004.​1378409
11.
Zurück zum Zitat Deegalla S, Bostrom H (2006) Reducing high-dimensional data by principal component analysis vs. random projection for nearest neighbor classification. In: ICMLA ’06: Proceedings of the 5th international conference on machine learning and applications. IEEE Computer Society, Washington, DC, pp 245–250. doi:10.1109/ICMLA.2006.43 CrossRef Deegalla S, Bostrom H (2006) Reducing high-dimensional data by principal component analysis vs. random projection for nearest neighbor classification. In: ICMLA ’06: Proceedings of the 5th international conference on machine learning and applications. IEEE Computer Society, Washington, DC, pp 245–250. doi:10.​1109/​ICMLA.​2006.​43 CrossRef
12.
Zurück zum Zitat Forrest S, Perelson AS, Allen L, Cherukuri R (1994) Self-nonself discrimination in a computer. In: Proceedings of the IEEE symposium on research in security and privacy. IEEE Computer Society, Silver Spring, pp 202–212 Forrest S, Perelson AS, Allen L, Cherukuri R (1994) Self-nonself discrimination in a computer. In: Proceedings of the IEEE symposium on research in security and privacy. IEEE Computer Society, Silver Spring, pp 202–212
17.
Zurück zum Zitat Jamaluddin J, Zotou N, Edwards R, Coulton P (2004) Mobile phone vulnerabilities: a new generation of malware. In: Proceedings of the 2004 IEEE international symposium on consumer Electronics. IEEE, Piscataway, pp 199–202CrossRef Jamaluddin J, Zotou N, Edwards R, Coulton P (2004) Mobile phone vulnerabilities: a new generation of malware. In: Proceedings of the 2004 IEEE international symposium on consumer Electronics. IEEE, Piscataway, pp 199–202CrossRef
18.
Zurück zum Zitat Kohonen T (2001) Self-organizing maps. Springer series in information sciences, vol 30, 3rd edn. Springer, Heidelberg. ISBN 3–540–67921–9, ISSN 0720–678X Kohonen T (2001) Self-organizing maps. Springer series in information sciences, vol 30, 3rd edn. Springer, Heidelberg. ISBN 3–540–67921–9, ISSN 0720–678X
20.
Zurück zum Zitat Luther K, Bye R, Alpcan T, Albayrak S, Müller A (2007) A cooperative AIS framework for intrusion detection. In: Proceedings of the IEEE international conference on communications (ICC 2007), Glasgow, 24–28 June 2007 Luther K, Bye R, Alpcan T, Albayrak S, Müller A (2007) A cooperative AIS framework for intrusion detection. In: Proceedings of the IEEE international conference on communications (ICC 2007), Glasgow, 24–28 June 2007
22.
Zurück zum Zitat Miettinen M, Halonen P, Hätönen K (2006) Host-based intrusion detection for advanced mobile devices. In: AINA ’06: proceedings of the 20th international conference on advanced information networking and applications, vol 2 (AINA’06). IEEE Computer Society, Washington, DC, pp. 72–76. doi:http://dx.doi.org/10.1109/AINA.2006.192 CrossRef Miettinen M, Halonen P, Hätönen K (2006) Host-based intrusion detection for advanced mobile devices. In: AINA ’06: proceedings of the 20th international conference on advanced information networking and applications, vol 2 (AINA’06). IEEE Computer Society, Washington, DC, pp. 72–76. doi:http://​dx.​doi.​org/​10.​1109/​AINA.​2006.​192 CrossRef
24.
Zurück zum Zitat Oberheide J, Cooke E, Jahanian F (2008) Cloudav: N-version antivirus in the network cloud. In: Proceedings of the 17th USENIX security symposium (Security’08), San Jose, 28 July–1 August 2008 Oberheide J, Cooke E, Jahanian F (2008) Cloudav: N-version antivirus in the network cloud. In: Proceedings of the 17th USENIX security symposium (Security’08), San Jose, 28 July–1 August 2008
26.
Zurück zum Zitat Roussos G, March AJ, Maglavera S (2005) Enabling pervasive computing with Smart phones. IEEE Perv Comput 4:20–27CrossRef Roussos G, March AJ, Maglavera S (2005) Enabling pervasive computing with Smart phones. IEEE Perv Comput 4:20–27CrossRef
27.
Zurück zum Zitat Spafford E, Zamboni D (2000) Data collection mechanisms for intrusion detection systems. CERIAS Technical Report 2000-08. CERIAS, Purdue University, 1315 Recitation Building, West Lafayette, IN Spafford E, Zamboni D (2000) Data collection mechanisms for intrusion detection systems. CERIAS Technical Report 2000-08. CERIAS, Purdue University, 1315 Recitation Building, West Lafayette, IN
Metadaten
Titel
Monitoring Smartphones for Anomaly Detection
verfasst von
Aubrey-Derrick Schmidt
Frank Peters
Florian Lamour
Christian Scheel
Seyit Ahmet Çamtepe
Şahin Albayrak
Publikationsdatum
01.02.2009
Verlag
Springer US
Erschienen in
Mobile Networks and Applications / Ausgabe 1/2009
Print ISSN: 1383-469X
Elektronische ISSN: 1572-8153
DOI
https://doi.org/10.1007/s11036-008-0113-x

Weitere Artikel der Ausgabe 1/2009

Mobile Networks and Applications 1/2009 Zur Ausgabe

Neuer Inhalt