Advertisement

MeadDroid: Detecting Monetary Theft Attacks in Android by DVM Monitoring

  • Lingguang Lei
  • Yuewu Wang
  • Jiwu Jing
  • Zhongwen Zhang
  • Xingjie Yu
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7839)

Abstract

Monetary theft attacks are one of the most popular attack forms towards Android system in recent years. In this paper, we present MeadDroid, a lightweight real-time detection system atop Android, to hold back this type of attacks. An FSM of monetary theft attacks is constructed, based on the analysis of real-world attacks. Employing an FSM-based detection approach, with the information obtained from dynamically monitoring the API calls and tracking the processing flow of UI (User Interface) inputs, MeadDroid can detect monetary theft attacks effectively and incurs only a small performance overhead. In addition, realized as an extension of Dalvik VM, MeadDroid is transparent to the user, and thus can provide a good user experience. Based on a prototype system, experiments are conducted with 195 popular Android applications. 11 applications with monetary theft attacks are found and the detection accuracy is almost 100% through comparing the results with the charge bill of the phone number used in the experiments. The performance overhead on a CPU-bound micro-benchmark is 8.97%. Experimental results demonstrate that MeadDroid has good performance in terms of effectiveness and efficiency.

Keywords

Monetary Theft Attack DVM Android API Calls Monitoring FSM 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
  2. 2.
  3. 3.
    Porter Felt, A., Finifter, M., Chin, E., Hanna, S., Wagner, D.: A Survey of Mobile Malware In The Wild. In: Proceedings of the 1st Workshop on Security and Privacy in Smartphones and Mobile Devices, CCS-SPSM 2011 (2011)Google Scholar
  4. 4.
  5. 5.
    Chin, E., Felt, A.P., Greenwood, K., Wagner, D.: Analyzing Inter-Application Communication in Android. In: Proceedings of the 9th Annual Symposium on Network and Distributed System Security, MobiSys 2011 (2011)Google Scholar
  6. 6.
    Fuchs, A., Chaudhuri, A., Foster, J.: SCanDroid: Automated Security Certification of Android Applications., http://www.cs.umd.edu/avik/projects/scAndroidascaa
  7. 7.
    Enck, W., Octeau, D., McDaniel, P., Chaudhuri, S.: A Study of Android Application Security. In: Proceedings of the 20th USENIX Security Symposium, USENIX Security 2011 (2011)Google Scholar
  8. 8.
    Felt, A.P., Chin, E., Hanna, S., Song, D., Wagner, D.: Android Permissions Demystified. In: Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS 2011 (October 2011)Google Scholar
  9. 9.
    Shin, W., Kiyomoto, S., Fukushima, K., Tanaka, T.: Towards formal analysis of the permission-based security model for Android. In: Proceedings of the 2009 Fifth International Conferenceon Wireless and Mobile Communications, ICWMC 2009, pp. 87–92. IEEE Computer Society, Washington, DC (2009)CrossRefGoogle Scholar
  10. 10.
    Shin, W., Kiyomoto, S., Fukushima, K., Tanaka, T.: A formal model to analyze the permission authorization and enforcement in the Android framework. In: Proceedings of the 2010 IEEE Second International Conference on Social Computing, SOCIALCOM 2010, pp. 944–951. IEEE Computer Society, Washington, DC (2010)CrossRefGoogle Scholar
  11. 11.
    Shin, W., Kwak, S., Kiyomoto, S., Fukushima, K., Tanaka, T.: A small but non-negligible aw in the Android permission scheme. In: Proceedings of the 2010 IEEE International Symposium on Policies for Distributed Systems and Networks, POLICY 2010, pp. 107–110. IEEE Computer Society, Washington, DC (2010)CrossRefGoogle Scholar
  12. 12.
    Hornyack, P., Han, S., Jung, J., Schechter, S., Wetherall, D.: These Aren’t the Droids You’re Looking For: Retrofitting Android to Protect Data from Imperious Applications. In: Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS 2011 (2011)Google Scholar
  13. 13.
    Enck, W., Gilbert, P., Chun, B.-G., Cox, L.P., Jung, J., Mc- Daniel, P., Sheth, A.N.: TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones. In: Proceedings of the 9th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2010 (February 2010)Google Scholar
  14. 14.
    Android Permissions, http://Android-permissions.org/
  15. 15.
  16. 16.
  17. 17.
  18. 18.
  19. 19.
    Burguera, I., Zurutuza, U., Nadjm-Tehrani, S.: Crowdroid: Behavior-Based Malware Detection System for Android. Proceedings of the 1st Workshop on Security and Privacy in Smartphones and Mobile Devices, CCS SPSM 2011 (2011)Google Scholar
  20. 20.
    Enck, W., Ongtang, M., McDaniel, P.: On Lightweight Mobile Phone Application Certification. In: Proceedings of the 16th ACM Conference on Computer and Communications Security, CCS 2009 (2009)Google Scholar
  21. 21.
    Schmidt, A.-D., Schmidt, H.-G., Clausen, J., Yuksel, K.A., Kiraz, O., Camtepe, A., Albayrak, S.: Enhancing security of linux-based Android devices. In: Proceedings of 15th International Linux Kongress, Lehmann (October 2008)Google Scholar
  22. 22.
    Schmidt, A.-D., Bye, R., Schmidt, H.-G., Clausen, J., Kiraz, O., Yxksel, K., Camtepe, S., Sahin, A.: Static analysis of executables for collaborative malware detection on Android. In: ICC 2009 Communication and Information Systems Security Symposium, Dresden, Germany (June 2009)Google Scholar
  23. 23.
    Blasing, T., Schmidt, A.-D., Batyuk, L., Camtepe, S.A., Albayrak, S.: An Android application sandbox system for suspicious software detection. In: 5th International Conference on Malicious and Unwanted Software, MALWARE 2010, Nancy, France (2010)Google Scholar
  24. 24.
    Zhou, Y., Wang, Z., Zhou, W., Jiang, X.: Hey, You, Get Off My Market: Detecting Malicious Apps in Alternative Android Markets. In: Proceedings of the 16th Network and Distributed System Security Symposium, NDSS 2012 (February 2012)Google Scholar
  25. 25.
  26. 26.
    Pendragon Software Corporation. CaffeineMark 3.0Google Scholar
  27. 27.
  28. 28.
    Di Cerbo, F., Girardello, A., Michahelles, F., Voronkova, S.: Detection of malicious applications on Android os. In: Sako, H., Franke, K.Y., Saitoh, S. (eds.) IWCF 2010. LNCS, vol. 6540, pp. 138–149. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  29. 29.

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Lingguang Lei
    • 1
    • 2
  • Yuewu Wang
    • 1
  • Jiwu Jing
    • 1
  • Zhongwen Zhang
    • 1
    • 2
  • Xingjie Yu
    • 1
    • 2
  1. 1.State Key Laboratory of Information Security, Institute of Information EngineeringCASBeijingChina
  2. 2.University of Chinese Academy of SciencesBeijingChina

Personalised recommendations