Recent years have seen a global adoption of smart mobile devices, particularly those based on Android. However, Android’s widespread adoption is marred with increasingly rampant malware threats. This article gives a survey and taxonomy of existing works that secure Android devices. Based on Android app deployment stages, the taxonomy enables us to analyze schemes that share similar objective and approach and to inspect their key differences. Additionally, this article highlights the limitations of existing works and current challenges. It thus distills the state of the art in Android security research and identifies potential research directions for safeguarding billions (and keep counting) of Android-run devices.

No abstract

The need to accurately specify and detect malicious behavior is widely known. This paper presents a novel and convenient way of accurately specifying malicious behavior in mobile environments by taking Android as a representative platform of analysis and implementation. Our specification takes a sequence-based approach in declaratively formulating a malicious action, whereby any two consecutive securitysensitive operations are connected by either a control or taint flow. It also captures the invocation context of an operation within an app's component type and lifecycle/callback method. Additionally, exclusion of operations that are invoked from UI-related callback methods can be specified to indicate an action's stealthy execution portions. We show how the specification is sufficiently expressive to describe malicious patterns that are commonly exhibited by mobile malware. To show the usefulness of the specification, and to demonstrate that it can derive stable and distinctive patterns of existing Android malware, we develop a static analyzer that can automatically check an app for numerous securitysensitive actions written using the specification. Given a target app's uncovered behavior, the analyzer associates it with a collection of known malware families. Experiments show that our obfuscation-resistant analyzer can associate malware samples with their correct family with an accuracy of 97.2 %, while retaining the ability to differentiate benign apps from the profiled malware families with an accuracy of 97.6 %. These results positively show how the specification can lend to robust mobile malware detection.

No abstract