The company you keep

Abstract

There is little information from independent sources in the public domain about mobile malware infection rates. The only previous independent estimate (0.0009%) [12], was based on indirect measurements obtained from domain-name resolution traces. In this paper, we present the first independent study of malware infection rates and associated risk factors using data collected directly from over 55,000 Android devices. We find that the malware infection rates in Android devices estimated using two malware datasets (0.28% and 0.26%), though small, are significantly higher than the previous independent estimate. Using our datasets, we investigate how indicators extracted inexpensively from the devices correlate with malware infection.Based on the hypothesis that some application stores have a greater density of malicious applications and that advertising within applications and cross-promotional deals may act as infection vectors, we investigate whether the set of applications used on a device can serve as an indicator for infection of that device. Our analysis indicates that, while not an accurate indicator of infection by itself, the application set does serve as an inexpensive method for identifying the pool of devices on which more expensive monitoring and analysis mechanisms should be deployed. Using our two malware datasets we show that this indicator performs up to about five times better at identifying infected devices than the baseline of random checks. Such indicators can be used, for example, in the search for new or previously undetected malware. It is therefore a technique that can complement standard malware scanning. Our analysis also demonstrates a marginally significant difference in battery use between infected and clean devices.

Assessing factors influencing consumers' non-adoption intention: exploring the dark sides of mobile payment

“…M-device threats: The serious threats to m-devices that run m-payment applications are unauthorised access to an m-device that has been lost or stolen (Muslukhov et al, 2013) and malware infection on the mobile (Truong et al, 2014). Direct attacks rely on the notion that the attacker is in charge of the m-device that has been lost or stolen and is now in their possession.…”

“…M-device threats : The serious threats to m-devices that run m-payment applications are unauthorised access to an m-device that has been lost or stolen (Muslukhov et al. , 2013) and malware infection on the mobile (Truong et al. , 2014).…”

Android Security: A Survey of Issues, Malware Penetration, and Defenses

“…Lever et al [53], used the Domain Name Resolution (DNS) traffic of smartphones in United States and found 0.0009% infection rate. Very recently, Truong et al [54] instrumented a well-known Carat app [55] to estimate infection-rate for three malware datasets. They found infection-rate 0.26% and 0.28% for McAfee and MobileSandbox dataset respectively.…”