PREC: practical root exploit containment for android devices

Authors:
Tsung-Hsuan Ho;Daniel Dean;Xiaohui Gu;William Enck
Affiliations:
North Carolina State University, Raleigh, NC, USA;North Carolina State University, Raleigh, NC, USA;North Carolina State University, Raleigh, NC, USA;North Carolina State University, Raleigh, NC, USA
Venue:
Proceedings of the 4th ACM conference on Data and application security and privacy
Year:
2014

Citing 28
Cited 0

Neural Networks for Pattern Recognition

Neural Networks for Pattern Recognition
Self-Organizing Maps

Self-Organizing Maps
Using Finite Automata to Mine Execution Data for Intrusion Detection: A Preliminary Report

RAID '00 Proceedings of the Third International Workshop on Recent Advances in Intrusion Detection
Gray-box extraction of execution graphs for anomaly detection

Proceedings of the 11th ACM conference on Computer and communications security
A Visual Approach for Monitoring Logs

LISA '98 Proceedings of the 12th USENIX conference on System administration
SmartSiren: virus detection and alert for smartphones

Proceedings of the 5th international conference on Mobile systems, applications and services
Automated response using system-call delays

SSYM'00 Proceedings of the 9th conference on USENIX Security Symposium - Volume 9
Exploring Multiple Execution Paths for Malware Analysis

SP '07 Proceedings of the 2007 IEEE Symposium on Security and Privacy
CloudAV: N-version antivirus in the network cloud

SS'08 Proceedings of the 17th conference on Security symposium
Native Client: A Sandbox for Portable, Untrusted x86 Native Code

SP '09 Proceedings of the 2009 30th IEEE Symposium on Security and Privacy
pBMDS: a behavior-based malware detection system for cellphone devices

Proceedings of the third ACM conference on Wireless network security
Effective and efficient malware detection at the end host

SSYM'09 Proceedings of the 18th conference on USENIX security symposium
Paranoid Android: versatile protection for smartphones

Proceedings of the 26th Annual Computer Security Applications Conference
A sense of self for Unix processes

SP'96 Proceedings of the 1996 IEEE conference on Security and privacy
Crowdroid: behavior-based malware detection system for Android

Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices
A survey on automated dynamic malware-analysis techniques and tools

ACM Computing Surveys (CSUR)
Kernel-based Behavior Analysis for Android Malware Detection

CIS '11 Proceedings of the 2011 Seventh International Conference on Computational Intelligence and Security
Behavioral distance for intrusion detection

RAID'05 Proceedings of the 8th international conference on Recent Advances in Intrusion Detection
Android permissions: a perspective combining risks and benefits

Proceedings of the 17th ACM symposium on Access Control Models and Technologies
RiskRanker: scalable and accurate zero-day android malware detection

Proceedings of the 10th international conference on Mobile systems, applications, and services
Dissecting Android Malware: Characterization and Evolution

SP '12 Proceedings of the 2012 IEEE Symposium on Security and Privacy
A quantitative study of accuracy in system call-based malware detection

Proceedings of the 2012 International Symposium on Software Testing and Analysis
UBL: unsupervised behavior learning for predicting performance anomalies in virtualized cloud systems

Proceedings of the 9th international conference on Autonomic computing
SmartDroid: an automatic system for revealing UI-based trigger conditions in android applications

Proceedings of the second ACM workshop on Security and privacy in smartphones and mobile devices
Mobile data charging: new attacks and countermeasures

Proceedings of the 2012 ACM conference on Computer and communications security
AppsPlayground: automatic security analysis of smartphone applications

Proceedings of the third ACM conference on Data and application security and privacy
A grey-box approach for automated GUI-model generation of mobile applications

FASE'13 Proceedings of the 16th international conference on Fundamental Approaches to Software Engineering
MAST: triage for market-scale mobile malware analysis

Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

Application markets such as the Google Play Store and the Apple App Store have become the de facto method of distributing software to mobile devices. While official markets dedicate significant resources to detecting malware, state-of-the-art malware detection can be easily circumvented using logic bombs or checks for an emulated environment. We present a Practical Root Exploit Containment (PREC) framework that protects users from such conditional malicious behavior. PREC can dynamically identify system calls from high-risk components (e.g., third-party native libraries) and execute those system calls within isolated threads. Hence, PREC can detect and stop root exploits with high accuracy while imposing low interference to benign applications. We have implemented PREC and evaluated our methodology on 140 most popular benign applications and 10 root exploit malicious applications. Our results show that PREC can successfully detect and stop all the tested malware while reducing the false alarm rates by more than one order of magnitude over traditional malware detection algorithms. PREC is light-weight, which makes it practical for runtime on-device root exploit detection and containment.