A Specification Based Intrusion Detection Framework for Mobile Phones

Abstract

Abstract. With the fast growth of mobile market, we are now seeing more and more malware on mobile phones. One common pattern of many commonly found malware on mobile phones is that: the malware always attempts to access sensitive system services on the mobile phone in an unobtrusive and stealthy fashion. For example, the malware may send messages automatically or stealthily interface with the audio peripherals on the device without the user's awareness and authorization. To detect the unauthorized malicious behavior, we present SBIDF, a Specification Based Intrusion Detection Framework, which utilizes the keypad or touchscreen interrupts to differentiate between malware and human activity. Specifically, in the proposed framework, we use an application independent specification, written in Temporal Logic of Causal Knowledge (TLCK ), to describe the normal behavior pattern, and enforce this specification to all third party applications on the mobile phone during runtime by monitoring the inter-component communication pattern among critical components. Our evaluation of simulated behavior of real world malware shows that we are able to detect all forms of malware that attempts to access sensitive services without possessing user's permission. Furthermore, the SBIDF incurs a negligible overhead (20 secs) which makes it very feasible for real world deployment.

Tap-Wave-Rub: Lightweight Human Interaction Approach to Curb Emerging Smartphone Malware

“…The most closely related work to ours is the one proposed in [11]. It shares similar philosophy as ours.…”

“…This is because the pickpocket malware gets activated by user's playing the tictac-toe game, which already involves touch screen activity that can generate hardware interrupts. The difference between [11] and our work can be summarized as follows. [11] attempts to check whether there is (any) user activity whereas our goal is to check whether there is a special user-aware activity.…”

“…The difference between [11] and our work can be summarized as follows. [11] attempts to check whether there is (any) user activity whereas our goal is to check whether there is a special user-aware activity. So our approach provides more fine-grained access control to sensitive services and thus can detect even sophisticated malware.…”

“…It shares similar philosophy as ours. It utilizes whether there are hardware interruptions to differentiate pure software initiated action and human initiated action [11]. It aims at detecting malware specifically targeting SMS and audio services.…”

Intrusion detection in networked control systems : from system knowledge to network security

“…Furthermore, specification-based IDSs were developed for specific use cases both for network-based (e.g., VoIP technologies [100], carrier Ethernet [101]) and host-based security (e.g., kernel dynamic data structures [102], mobile operating systems [103]). …”