Enabling Automatic Protocol Behavior Analysis for Android Applications

Kim, Jeongmin; Choi, Hyunwoo; Namkung, Hun; Choi, W. Jason; Choi, Byron; Hong, Hyunwook; Kim, Yong‐Dae; Lee, Jong-Hyup; Han, Dongsu

doi:10.1145/2999572.2999596

Cited by 13 publications

(8 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The SVM classifier used for static analysis achieved 93.33 to 99.28 percent accuracy, while the Naive Bayes used for dynamic analysis achieved accuracy up to 90 percent. Furthermore, Kim et al [13], used the J48 machine learning classier, the features are selected from static (permission ) and dynamic (APICal l). A. Saracino el al.…”

Section: Hybrid Analysismentioning

confidence: 99%

“…The client uses the strace mechanism of the Linux system for monitoring android system calls. Kim et al [13], proposed CopperDroid framework, which detects the behaviour of Java code and local code execution. Although, these reported methods are very effective, yet, these methods can not be directly applied to mobile and IoT devices, because of their limited resources such as memory and power consumption.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Research on Data Mining of Permission-Induced Risk for Android IoT Devices

et al. 2019

View full text Add to dashboard Cite

With the growing era of the Internet of Things (IoT), more and more devices are connecting with the Internet using android applications to provide various services. The IoT devices are used for sensing, controlling and monitoring of different processes. Most of IoT devices use Android applications for communication and data exchange. Therefore, a secure Android permission privileged mechanism is required to increase the security of apps. According to a recent study, a malicious Android application is developed almost every 10 s. To resist this serious malware campaign, we need effective malware detection approaches to identify malware applications effectively and efficiently. Most of the studies focused on detecting malware based on static and dynamic analysis of the applications. However, to analyse the risky permission at runtime is a challenging task. In this study, first, we proposed a novel approach to distinguish between malware and benign applications based on permission ranking, similarity-based permission feature selection, and association rule for permission mining. Secondly, the proposed methodology also includes the enhancement of the random forest algorithm to improve the accuracy for malware detection. The experimental outcomes demonstrate high proficiency of the accuracy for malware detection, which is pivotal for android apps aiming for secure data exchange between IoT devices.

show abstract

Section: Hybrid Analysismentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Research on Data Mining of Permission-Induced Risk for Android IoT Devices

et al. 2019

View full text Add to dashboard Cite

show abstract

“…In order to extract the Jimple slices, we implement a forward and backward slicing algorithm (see Appendix A), which are based on the networkaware program slicing approach proposed by Choi et al [29,30]. The slicing algorithm works bidirectionally based on the ICFG constructed in the previous step.…”

Section: Program Slicermentioning

confidence: 99%

“…In this case, a dependency exists between responseA and requestB. To identify this, we leverage the taint-based approach proposed by Choi et al [29,30], in which the dependency is determined by identifying the data flow from the source (line (1) in responseA) to the sink (line (1) in requestB). Finally, the program slicer records Jimple slices consisting of HTTP request/response and its dependencies for the next step, in which code snippets meeting the three conditions for vulnerability to remote code injection attacks are identified.…”

Section: Fileoutputstreamwrite()mentioning

confidence: 99%

Large-Scale Analysis of Remote Code Injection Attacks in Android Apps

Choi

Kim

2018

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

It is pretty well known that insecure code updating procedures for Android allow remote code injection attack. However, other than codes, there are many resources in Android that have to be updated, such as temporary files, images, databases, and configurations (XML and JSON). Security of update procedures for these resources is largely unknown. This paper investigates general conditions for remote code injection attacks on these resources. Using this, we design and implement a static detection tool that automatically identifies apps that meet these conditions. We apply the detection tool to a large dataset comprising 9,054 apps, from three different types of datasets: official market, third-party market, and preinstalled apps. As a result, 97 apps were found to be potentially vulnerable, with 53 confirmed as vulnerable to remote code injection attacks.

show abstract

“…Mariconti et al detect malware by building Markov models of the applications, but this approach requires downloading and executing the byte code of the application [13]. Kim et al mine the network protocols of an application from its executable, but the deployment of this approach is intractable in SDN networks [14]. Finally, Xia et al audit Android applications at runtime [15], and Ren et al propose an approach for discovering personal data in the network traffic of an application [16]; however, these approaches do not include automatic adjustments or the verification of network policies.…”

Section: Related Workmentioning

confidence: 99%

Generation of SDN policies for protecting android environments based on automata learning

Schnepf

Badonnel

Lahmadi

et al. 2018

NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

Software-defined networking offers new opportunities for protecting end users and their applications. In that context, dedicated chains can be built to combine different security functions, such as firewalls, intrusion detection systems and services for preventing data leakage. To configure these security chains, it is important to have an adequate model of the patterns that end user applications exhibit when accessing the network. We propose an automated strategy for learning the networking behavior of end applications using algorithms for generating finite state models. These models can be exploited for inferring SDN policies ensuring that applications respect the observed behavior: such policies can be formally verified and deployed on SDN infrastructures in a dynamic and flexible manner. Our solution is prototypically implemented as a collection of Python scripts that extend our Synaptic verification package. The performance of our strategy is evaluated through extensive experimentations and is compared to the Synoptic and Invarimint automata learning algorithms.

show abstract

Enabling Automatic Protocol Behavior Analysis for Android Applications

Cited by 13 publications

References 39 publications

Research on Data Mining of Permission-Induced Risk for Android IoT Devices

Research on Data Mining of Permission-Induced Risk for Android IoT Devices

Large-Scale Analysis of Remote Code Injection Attacks in Android Apps

Generation of SDN policies for protecting android environments based on automata learning

Contact Info

Product

Resources

About