Journal
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
Volume 9, Issue 11, Pages 1869-1882Publisher
IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC
DOI: 10.1109/TIFS.2014.2353996
Keywords
Android system; Android security; permission usage analysis; malware detection; intrusion detection
Funding
- Ph.D. Programs Foundation, Ministry of Education of China [20120009120010]
- Fundamental Research Funds through the Central Universities of China [2012RC031, 2012JBZ010, 2013JBM025]
- Scientific Research Foundation through the Returned Overseas Chinese Scholars, Ministry of Education of China [K14C300020]
- Program for New Century Excellent Talents in University [NCET-11-0565]
- Program for Changjiang Scholars and Innovative Research Team in University [IRT 201206]
- 111 Project [B14005]
Ask authors/readers for more resources
Android has been a major target of malicious applications (malapps). How to detect and keep the malapps out of the app markets is an ongoing challenge. One of the central design points of Android security mechanism is permission control that restricts the access of apps to core facilities of devices. However, it imparts a significant responsibility to the app developers with regard to accurately specifying the requested permissions and to the users with regard to fully understanding the risk of granting certain combinations of permissions. Android permissions requested by an app depict the app's behavioral patterns. In order to help understanding Android permissions, in this paper, we explore the permission-induced risk in Android apps on three levels in a systematic manner. First, we thoroughly analyze the risk of an individual permission and the risk of a group of collaborative permissions. We employ three feature ranking methods, namely, mutual information, correlation coefficient, and T-test to rank Android individual permissions with respect to their risk. We then use sequential forward selection as well as principal component analysis to identify risky permission subsets. Second, we evaluate the usefulness of risky permissions for malapp detection with support vector machine, decision trees, as well as random forest. Third, we in depth analyze the detection results and discuss the feasibility as well as the limitations of malapp detection based on permission requests. We evaluate our methods on a very large official app set consisting of 310 926 benign apps and 4868 real-world malapps and on a third-party app sets. The empirical results show that our malapp detectors built on risky permissions give satisfied performance (a detection rate as 94.62% with a false positive rate as 0.6%), catch the malapps' essential patterns on violating permission access regulations, and are universally applicable to unknown malapps (detection rate as 74.03%).
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available