Randomizing smartphone malware profiles against statistical mining techniques

Authors:
Abhijith Shastry;Murat Kantarcioglu;Yan Zhou;Bhavani Thuraisingham
Affiliations:
Computer Science Department, University of Texas at Dallas, Richardson, TX;Computer Science Department, University of Texas at Dallas, Richardson, TX;Computer Science Department, University of Texas at Dallas, Richardson, TX;Computer Science Department, University of Texas at Dallas, Richardson, TX
Venue:
DBSec'12 Proceedings of the 26th Annual IFIP WG 11.3 conference on Data and Applications Security and Privacy
Year:
2012

Citing 19
Cited 0

A training algorithm for optimal margin classifiers

COLT '92 Proceedings of the fifth annual workshop on Computational learning theory
C4.5: programs for machine learning

C4.5: programs for machine learning
Machine Learning

Machine Learning
Attacking Malicious Code: A Report to the Infosec Research Council

IEEE Software
A New Intrusion Detection Method based on Process Profiling

SAINT '02 Proceedings of the 2002 Symposium on Applications and the Internet
Detection of injected, dynamically generated, and obfuscated malicious code

Proceedings of the 2003 ACM workshop on Rapid malcode
Testing malware detectors

ISSTA '04 Proceedings of the 2004 ACM SIGSOFT international symposium on Software testing and analysis
SmartSiren: virus detection and alert for smartphones

Proceedings of the 5th international conference on Mobile systems, applications and services
Data mining approaches for intrusion detection

SSYM'98 Proceedings of the 7th conference on USENIX Security Symposium - Volume 7
Intrusion detection using sequences of system calls

Journal of Computer Security
Behavioral detection of malware on mobile handsets

Proceedings of the 6th international conference on Mobile systems, applications, and services
Detecting energy-greedy anomalies and mobile malware variants

Proceedings of the 6th international conference on Mobile systems, applications, and services
Learning and Classification of Malware Behavior

DIMVA '08 Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
The WEKA data mining software: an update

ACM SIGKDD Explorations Newsletter
On rootkit and malware detection in smartphones

DSNW '10 Proceedings of the 2010 International Conference on Dependable Systems and Networks Workshops (DSN-W)
Malware Behavior Analysis: Learning and Understanding Current Malware Threats

NETAPPS '10 Proceedings of the 2010 Second International Conference on Network Applications, Protocols and Services
Classifier evaluation and attribute selection against active adversaries

Data Mining and Knowledge Discovery
"Andromaly": a behavioral malware detection framework for android devices

Journal of Intelligent Information Systems
A mobile phone malicious software detection model with behavior checker

HSI'05 Proceedings of the 3rd international conference on Human Society@Internet: web and Communication Technologies and Internet-Related Social Issues

Quantified Score

Hi-index	0.00

Visualization

Abstract

The growing use of smartphones opens up new opportunities for malware activities such as eavesdropping on phone calls, reading e-mail and call-logs, and tracking callers' locations. Statistical data mining techniques have been shown to be applicable to detect smartphone malware. In this paper, we demonstrate that statistical mining techniques are prone to attacks that lead to random smartphone malware behavior. We show that with randomized profiles, statistical mining techniques can be easily foiled. Six in-house proof-of-concept malware programs are developed on the Android platform for this study. The malware programs are designed to perform privacy intrusion, information theft, and denial of service attacks. By simulating and tuning the frequency and interval of attacks, we aim to answer the following questions: 1) Can statistical mining algorithms detect smartphone malware by monitoring the statistics of smartphone usage? 2) Are data mining algorithms robust against malware with random profiles? 3) Can simple consolidation of random profiles over a fixed time frame prepare a higher quality data source for existing algorithms?