Skip to main content

2017 | OriginalPaper | Buchkapitel

NeSeDroid—Android Malware Detection Based on Network Traffic and Sensitive Resource Accessing

verfasst von : Nguyen Tan Cam, Nguyen Cam Hong Phuoc

Erschienen in: Proceedings of the International Conference on Data Engineering and Communication Technology

Verlag: Springer Singapore

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

The Android operating system has a large market share. The number of new malware on Android is increasing much recently. Android malware analysis includes static analysis and dynamic analysis. Limitations of static analysis are the difficulty in analyzing the malware using encryption techniques, to confuse the source, and to change behavior itself. In this paper, we proposed a hybrid analysis method, named NeSeDroid. This method used static analysis to detect the sensitive resource accessing. It also used dynamic analysis to detect sensitive resource leakage, through Internet connection. The method is tested on the list of applications which are downloaded from Android Apps Market, Genome Malware Project dataset and our additional samples in DroidBench dataset. The evaluation results show that the NeSeDroid has the high accuracy and it reduces the rate of fail positive detection.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
3.
Zurück zum Zitat Sanz, B., et al., MAMA: Manifest Analysis For Malware Detection In Android. Cybern. Syst., pp. 469–488 (2013). Sanz, B., et al., MAMA: Manifest Analysis For Malware Detection In Android. Cybern. Syst., pp. 469–488 (2013).
4.
Zurück zum Zitat Moonsamy, V., et al., Contrasting Permission Patterns between Clean and Malicious Android Applications, in Security and Privacy in Communication Networks, T. Zia, et al., Springer International Publishing. pp. 69–85 (2013). Moonsamy, V., et al., Contrasting Permission Patterns between Clean and Malicious Android Applications, in Security and Privacy in Communication Networks, T. Zia, et al., Springer International Publishing. pp. 69–85 (2013).
5.
Zurück zum Zitat Gascon, H., et al., Structural detection of android malware using embedded call graphs, in Proceedings of the 2013 ACM workshop on Artificial intelligence and security. ACM: Berlin, Germany. pp. 45–54 (2013). Gascon, H., et al., Structural detection of android malware using embedded call graphs, in Proceedings of the 2013 ACM workshop on Artificial intelligence and security. ACM: Berlin, Germany. pp. 45–54 (2013).
6.
Zurück zum Zitat Li, L., et al., IccTA: Detecting Inter-Component Privacy Leaks in Android Apps, in The 37th International Conference on Software Engineering (ICSE). Firenze, Italy (2015). Li, L., et al., IccTA: Detecting Inter-Component Privacy Leaks in Android Apps, in The 37th International Conference on Software Engineering (ICSE). Firenze, Italy (2015).
7.
Zurück zum Zitat Li, L., et al. Automatically Exploiting Potential Component Leaks in Android Applications. in Trust, Security and Privacy in Computing and Communications (TrustCom), 2014 IEEE 13th International Conference on. (2014). Li, L., et al. Automatically Exploiting Potential Component Leaks in Android Applications. in Trust, Security and Privacy in Computing and Communications (TrustCom), 2014 IEEE 13th International Conference on. (2014).
8.
Zurück zum Zitat Aafer, Y., W. Du, and H. Yin, DroidAPIMiner: Mining API-Level Features for Robust Malware Detection in Android, in Security and Privacy in Communication Networks, T. Zia, et al., Springer International Publishing. pp. 86–103 (2013). Aafer, Y., W. Du, and H. Yin, DroidAPIMiner: Mining API-Level Features for Robust Malware Detection in Android, in Security and Privacy in Communication Networks, T. Zia, et al., Springer International Publishing. pp. 86–103 (2013).
9.
Zurück zum Zitat Arzt, S., et al., FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps, in Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation. ACM: Edinburgh, United Kingdom. pp. 259–269 (2014). Arzt, S., et al., FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps, in Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation. ACM: Edinburgh, United Kingdom. pp. 259–269 (2014).
10.
Zurück zum Zitat Bagheri, H., et al., COVERT: Compositional Analysis of Android Inter-App Permission Leakage. Software Engineering, IEEE Transactions on, pp. 1–1 (2015). Bagheri, H., et al., COVERT: Compositional Analysis of Android Inter-App Permission Leakage. Software Engineering, IEEE Transactions on, pp. 1–1 (2015).
11.
Zurück zum Zitat Dini, G., et al., MADAM: a multi-level anomaly detector for android malware, in Proceedings of the 6th international conference on Mathematical Methods, Models and Architectures for Computer Network Security: computer network security. Springer-Verlag: St. Petersburg, Russia. pp. 240–253 (2012). Dini, G., et al., MADAM: a multi-level anomaly detector for android malware, in Proceedings of the 6th international conference on Mathematical Methods, Models and Architectures for Computer Network Security: computer network security. Springer-Verlag: St. Petersburg, Russia. pp. 240–253 (2012).
12.
Zurück zum Zitat Shabtai, A., et al., “Andromaly”: a behavioral malware detection framework for android devices. J. Intell. Inf. Syst., pp. 161–190 (2012). Shabtai, A., et al., “Andromaly”: a behavioral malware detection framework for android devices. J. Intell. Inf. Syst., pp. 161–190 (2012).
13.
Zurück zum Zitat Zheng, C., et al., SmartDroid: an automatic system for revealing UI-based trigger conditions in android applications, in Proceedings of the second ACM workshop on Security and privacy in smartphones and mobile devices. ACM: Raleigh, North Carolina, USA. pp. 93–104 (2012). Zheng, C., et al., SmartDroid: an automatic system for revealing UI-based trigger conditions in android applications, in Proceedings of the second ACM workshop on Security and privacy in smartphones and mobile devices. ACM: Raleigh, North Carolina, USA. pp. 93–104 (2012).
14.
Zurück zum Zitat Enck, W., et al., TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones, in Proceedings of the 9th USENIX conference on Operating systems design and implementation. USENIX Association: Vancouver, BC, Canada. pp. 1–6 (2010). Enck, W., et al., TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones, in Proceedings of the 9th USENIX conference on Operating systems design and implementation. USENIX Association: Vancouver, BC, Canada. pp. 1–6 (2010).
15.
Zurück zum Zitat Zaman, M., et al. Malware detection in Android by network traffic analysis. in Networking Systems and Security (NSysS) (2015). Zaman, M., et al. Malware detection in Android by network traffic analysis. in Networking Systems and Security (NSysS) (2015).
16.
Zurück zum Zitat Wu, X., et al., Detect repackaged Android application based on HTTP traffic similarity. Security and Communication Networks, (2015). Wu, X., et al., Detect repackaged Android application based on HTTP traffic similarity. Security and Communication Networks, (2015).
17.
Zurück zum Zitat Zheng, M., M. Sun, and J.C.S. Lui, DroidRay: a security evaluation system for customized android firmwares, in Proceedings of the 9th ACM symposium on Information, computer and communications security. ACM: Kyoto, Japan. pp. 471–482 (2014). Zheng, M., M. Sun, and J.C.S. Lui, DroidRay: a security evaluation system for customized android firmwares, in Proceedings of the 9th ACM symposium on Information, computer and communications security. ACM: Kyoto, Japan. pp. 471–482 (2014).
18.
Zurück zum Zitat Feldman, S., D. Stadther, and W. Bing. Manilyzer: Automated Android Malware Detection through Manifest Analysis. in Mobile Ad Hoc and Sensor Systems (MASS), IEEE 11th International Conference on. (2014). Feldman, S., D. Stadther, and W. Bing. Manilyzer: Automated Android Malware Detection through Manifest Analysis. in Mobile Ad Hoc and Sensor Systems (MASS), IEEE 11th International Conference on. (2014).
20.
Zurück zum Zitat Feizollah, A., et al. Comparative study of k-means and mini batch k-means clustering algorithms in android malware detection using network traffic analysis. in Biometrics and Security Technologies (ISBAST), 2014 International Symposium on. (2014). Feizollah, A., et al. Comparative study of k-means and mini batch k-means clustering algorithms in android malware detection using network traffic analysis. in Biometrics and Security Technologies (ISBAST), 2014 International Symposium on. (2014).
21.
Zurück zum Zitat Jun, L., et al. Research of android malware detection based on network traffic monitoring. in Industrial Electronics and Applications (ICIEA), 2014 IEEE 9th Conference on. (2014). Jun, L., et al. Research of android malware detection based on network traffic monitoring. in Industrial Electronics and Applications (ICIEA), 2014 IEEE 9th Conference on. (2014).
22.
Zurück zum Zitat Shabtai, A., et al., Mobile malware detection through analysis of deviations in application network behavior. Computers & Security, pp. 1–18 (2014). Shabtai, A., et al., Mobile malware detection through analysis of deviations in application network behavior. Computers & Security, pp. 1–18 (2014).
25.
Zurück zum Zitat Rasthofer, S., S. Arzt, and E. Bodden, A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks. (2014). Rasthofer, S., S. Arzt, and E. Bodden, A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks. (2014).
Metadaten
Titel
NeSeDroid—Android Malware Detection Based on Network Traffic and Sensitive Resource Accessing
verfasst von
Nguyen Tan Cam
Nguyen Cam Hong Phuoc
Copyright-Jahr
2017
Verlag
Springer Singapore
DOI
https://doi.org/10.1007/978-981-10-1678-3_3