Abstract
This paper presents a scheme to detect dangerous behaviors in Android apps. In order to identify different kinds of dangerous behaviors, we designed two analysis engines. On the one hand, taint analysis engine mainly detects privacy leak by tracking how user’s sensitive data is used by an app; On the other hand, constant analysis engine focuses on the constant information in an app to identify other dangerous behaviors such as SP services ordering, phone bill consuming, and so on. We have implemented these two engines in a system called ApkRiskAnalyzer which identifies the dangerous behaviors by simulating the running process of an Android app statically. Furthermore, we analyzed 1260 malicious apps and found out dangerous behaviors in 1246 (98.9%) apps. Then we downloaded 630 normal apps from Google Play and identified dangerous behaviors in 575(91.3%) apps. These results demonstrate the effectiveness of ApkRiskAnalyzer.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
NetQin, http://www.netqin.com
Mobile malware cases nearly triple in first half of 2012, says NetQin, http://www.computerworld.com/s/article/9229802/Mobile_malware_cases_nearly_triple_in_first_half_of_2012_says_NetQin
TrustGo, http://www.trustgo.com
Google Play, https://play.google.com/store
Android Authority: 23 of the top 500 Google Play Apps considered to be malware; malware up 580% this year (Infographic), http://www.trustgo.com/en/media-coverage
Felt, A.P., Chin, E., et al.: Android Permissions Demystified. In: The 18th ACM Conference on Computer and Communications Security (CCS 2011), Chicago, USA (October 2011)
Zhou, Y., Wang, Z., et al.: Hey, You, Get off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets. In: Proceedings of the 19th Network and Distributed System Security Symposium (NDSS 2012), San Diego, CA ( February 2012)
Enck, W., Gilbert, P., et al.: TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones. In: The 9th USENIX Symposium on Operating System Design and Implementation (OSDI 2010), Vancouver, BC, Canada (October 2010)
Android Malware Genome Project, http://www.malgenomeproject.org/
Dalvik bytecode, http://source.android.com/tech/dalvik/dalvik-bytecode.html
IDA pro, http://www.hex-rays.com/products/ida
IDAPython, http://code.google.com/p/idapython/
Cheng, S., Yang, J., et al.: LoongChecker: Practical summary-based semi-simulation to detect vulnerability in binary code. In: The 10th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2011), Changsha, China (November 2011)
Li, Z., Cheng, S., Wu, J.: Inter-procedural static analysis of Android apps, Technical report (December 2012)
FakeNetflix, http://www.pcmag.com/article2/0,2817,2394621,00.asp
Gone60, http://contagiominidump.blogspot.com/2011/09/gone-in-60-seconds-android-spyware.html
Fetion, http://www.fetion.com/
Angrybirds, http://www.angrybirds.com/
Enck, W., Octeau, D., McDaniel, P., Chaudhuri, S.: A study of Android app security. In: The 20th USENIX Security Symposium (2011)
Grace, M., Zhou, Y., Zhang, Q., et al.: RiskRanker: Scalable and Accurate Zero-day Android Malware Detection. In: Proceedings of the 10th International Conference on Mobile Systems, Apps and Services (MobiSys 2012), Lake District, UK (June 2012)
Portokalidis, G., Homburg, P., Anagnostakis, K., Bos, H.: Paranoid Android: Versatile protection for smartphones. In: The 26th Annual Computer Security Applications Conference (ACSAC 2010), Austin, Texas, USA (December 2010)
Gilbert, P., Chun, B.G., Cox, L.P., Jung, J.: Vision: Automated Security Validation of Mobile Apps at App Markets. In: Proceedings of the International Workshop on Mobile Cloud Computing and Services (MCS 2011), New York, USA (2011)
Nauman, M., Khan, S., Zhang, X.: Apex: Extending Android Permission Model and Enforcement with User-Defined Runtime Constraints. In: Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS 2010), Beijing, China (April 2010)
Beresford, A.R., Rice, A., et al.: MockDroid: Trading Privacy for Application Functionality on Smartphones. In: Proceedings of the 12th International Workshop on Mobile Computing System and Applications (HotMobile 2011), Phoenix, USA (March 2011)
Zhou, Y., Zhang, X., Jiang, X., Freeh, V.W.: Taming Information-Stealing Smartphone Applications (on Android). In: McCune, J.M., Balacheff, B., Perrig, A., Sadeghi, A.-R., Sasse, A., Beres, Y. (eds.) Trust 2011. LNCS, vol. 6740, pp. 93–107. Springer, Heidelberg (2011)
Grace, M., Zhou, Y., Wang, Z., Jiang, X.: Systematic Detection of Capability Leaks in Stock Android Smartphones. In: Proceedings of the 19th Annual Symposium on Network and Distributed System Security (NDSS 2012), San Diego, USA (February 2012)
Hornyack, P., Han, S., Jung, J., Schechter, S., Wetherall, D.: These Aren’t the Droids You’re Looking For: Retrofitting Android to Protect Data from Imperious Applications. In: Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS 2011), Chicago, USA (October 2011)
Chin, E., Felt, A.P., Greenwood, K., Wagner, D.: Analyzing Inter-Application Communication in Android. In: Proceedings of the 9th Annual Symposium on Network and Distributed System Security (MobiSys 2011), Washington, DC, USA (July 2011)
Barrera, D., Kayacik, H.G., Oorschot, P., Somayaji, A.: A methodology for empirical analysis of permission-based security models and its app to Android. In: Proceedings of the 17th ACM Conference on Computer and Communications Security (CCS 2010), Chicago, USA (October 2010)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2013 Springer International Publishing Switzerland
About this paper
Cite this paper
Cheng, S., Luo, S., Li, Z., Wang, W., Wu, Y., Jiang, F. (2013). Static Detection of Dangerous Behaviors in Android Apps. In: Wang, G., Ray, I., Feng, D., Rajarajan, M. (eds) Cyberspace Safety and Security. CSS 2013. Lecture Notes in Computer Science, vol 8300. Springer, Cham. https://doi.org/10.1007/978-3-319-03584-0_27
Download citation
DOI: https://doi.org/10.1007/978-3-319-03584-0_27
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-03583-3
Online ISBN: 978-3-319-03584-0
eBook Packages: Computer ScienceComputer Science (R0)