TCADS: Trustworthy, Context-Related Anomaly Detection for Smartphones

Abstract

In this paper we propose a novel, network-based, distributed anomaly detection framework for smartphones. Our approach is based upon the distributed collection of arbitrary, static and dynamic smartphone features. Our approach is not limited to features that can be obtained directly on a device, but also includes features that are provided by other services running in the respective, corporate IT infrastructure (e.g. an IDS). Furthermore, we tag each collected feature with two kinds of information: (1) context-information and (2) trust-information. This way, anomaly detection methods are not limited to work on the actual feature values, but can also consider the context and the trustworthiness of collected features.

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

“…• System applications: The architecture of Android contains system applications at the top which offers the basic functionality such as email management, calendar etc. Generally, Android features is collected via rooted [229], [230] or unrooted [231] devices that can be passed as an input to ML models to learn the characteristics to distinguish between the benign and malicious apps. Android uses Google play as an official market store that hosts the apps and there are more than hundred third-party app stores that also host the Android applications.…”