NYIT research on malware detection in android devices

description

1. Permission-based Malware Detection in Android Devices Fellow: Nadeen Saleh Mentor: Dr.Wenjia Li NYIT REU Summer 2015 ‹#›

2. ‹#›

3. ‹#›

4. what is malware? Any software that intends to damage or disable an operating system’s functionality. Examples: SMS spam for commercial advertising and spread of phishing links. Search Engine Optimization Sends web requests to search engine for desired search term. Denial of Service (DDoS) ‹#›

5. Google Play reviews all applications for potential security issues prior to making them available to users. No review process is perfect, and with over 1 million applications in Google Play, there are a small number of Potentially Harmful Applications that do still manage to be published in Google Play. ‹#›

6. 1.2 billion smartphones using Android 1.5 billion expected by 2019 More popular = more exploitation efforts Bouncer Responsible for 40% drop in malicious applications making way into Google Play. 1/1,000 applications in Google Play is malware. Does not solve the problem for third party markets. why is this an issue? ‹#›

7. objective To develop an accurate, light-weight means of detecting malware in Android devices through a solely static program analysis. *Static program analysis is the analysis of computer software that is performed without actually executing programs. ‹#› large overhead? do-it-yourself?

8. permissions Used to allow an application access to restricted APIs. Developer specifies permission requirements in AndroidManifest.xml. ‹#›

9. permissions Used to allow and application access to restricted APIs. Developer specifies permission requirements in AndroidManifest.xml. ‹#›

10. ‹#›

11. Write and send text messages. ‹#›

12. Write and send text messages. Read phone state, access the IMEI. ‹#›

13. Write and send text messages. Read phone state, access the IMEI. Access your location. ‹#›

14. ‹#›

15. ‹#›

16. ‹#›

17. methodology 1. Manual detection for outliers Collected data from 100 applications (50 malicious, 50 benign) and detected for distinguishable features involving the permission sets. 2. Feature selection total permissions per application occurrence of duplicate permissions permissions that are highly prevalent in our malware training set 3. Distribute features into categories and weight them Percent increase between malware and benign permission requests. 4. Run point system of testing set Preliminary results on 133 applications. Threshold value of 5 resulted in the best accuracy. 5. Machine learning To cross-validate our method, we use the Support Vector Machine machine learning algorithm on our training set. 6. Conclusion ‹#›

18. The feature classification run-down → ‹#›

19. ‹#›

20. point system -- static ‹#›

21. ‹#›

22. malware benign ‹#›

23. results Testing set: 60 malicious applications, 74 benign applications ‹#›

24. ‹#›

25. false positive false negative ‹#›

26. conclusion Advantage: convenience . ‹#›

27. future work ‹#› In regards to feature selection, identifying more distinguishable features in a small training set (such as this one) can be challenging. Future works have the ability to test the performance of different parameters, more importantly, a wider and relevant feature selection. For comparison purposes, we tested the performance of fewer parameters to establish a correlation with accuracy, and as anticipated, saw a qualified decrease in accuracy.

28. references ‹#› [1] Henry, Alan. "Why Does This Android App Need So Many Permissions?" Lifehacker . N.p., n.d. Web. 27 July 2015. [2] Petrovan, Bogdan. "F-Secure Report Shows Once Again Why You Should Stick to the Play Store for App Downloads." Android Authority . N.p., 05 Mar. 2014. Web. 27 July 2015. [3] Hou, Olivia. "TrendLabs Malware Blog." TrendLabs Security Intelligence Blog RSS . N.p., n.d. Web. 27 July 2015. [4] "Threat Encyclopedia." 12 Most Abused Android App Permissions . N.p., n.d. Web. 27 July 2015. [5] Plafke, James. "Android Malware Mimics Play, Performs DDoS Attacks, Sends Text Spam | Mobile | Geek.com." Geekcom . N.p., n.d. Web. 27 July 2015. [6] Olenick, Doug. "Apple IOS And Google Android Smartphone Market Share Flattening: IDC." Forbes . Forbes Magazine, n.d. Web. 27 July 2015. [7] Kovach, Steve. "How Google's Android Platform Grew More Popular than Apple's IPhone." Financial Post How Googles Android Platform Grew More Popular than ApplesiPhone Comments . N.p., n.d. Web. 27 July 2015.

29. THANKS! Any questions? ‹#›