Android malware detection boosted by university research

Researchers from North Carolina State University have found a way to monitor for Android malware with very low overhead

By , IDG News Service |  Security

With smartphones and tablets increasingly at risk from malware, researchers from North Carolina State University have devised a new and potentially better way to detect it on Android devices.

The tool they have developed, called Practical Root Exploit Containment (PREC), is trained to uncover aberrant code written in the C programming language, the language in which they say most malicious Android code is written.

PREC looks for root exploits, in which a program gains system administration access rights to the entire device, which a malicious hacker can use with ill intent.

The researchers detailed their work, captured in the paper "PREC: Practical Root Exploit Containment for Android Devices," at the Association for Computing Machinery's Conference on Data and Application Security and Privacy, which was held this week in San Antonio, Texas.

PREC uses a well-known technique for identifying malicious code, called anomaly detection. Anomaly detection compares the expected behavior of an application with how it actually behaves when it is running on a device, in terms of the system calls it makes.

PREC is unique in that it can identify calls made to native C code from a Java program, and check to see if such actions fit into the application's profile for typical usage. The bulk of software programs for Android are written in Java, which other experimental anomaly detectors have focused on.

"We've observed that most all of the existing exploits are coming from C code," said Helen Gu, an associate professor of computer science at NCSU who was involved in the work. "It's hard, if not impossible, to launch exploits in Java code, because it has to go through the virtual machine."

With this approach, PREC has been able to reduce the number of false identifications by an order of magnitude, compared to other anomaly detectors. Focusing on native C code gives PREC a more accurate model of how attacks would differ from standard operations.

The researchers tested a prototype against 150 Android apps, of which 140 were benign and 10 contained root exploits. The experiments were run on a Google Galaxy Nexus and on an emulator. PREC was able to identify all of the root exploits with a minimum number of false alarms.

What the researchers hope to do is convince app stores, such as the Google Play Store, to create a database describing the typical performance characteristics of all their apps. They could use PREC to build these assessments. Then when a user downloads a new app, the Android device can also download the PREC execution profile for that application, and use that profile to monitor for any unusual activity coming from the app.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

SecurityWhite Papers & Webcasts

See more White Papers | Webcasts

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

Ask a Question
randomness