This article presents Andromaly--a framework for detecting malware on Android mobile devices. The proposed framework realizes a Host-based Malware Detection System that continuously monitors various features and events obtained from the mobile device and then applies Machine Learning anomaly detectors to classify the collected data as normal (benign) or abnormal (malicious). Since no malicious applications are yet available for Android, we developed four malicious applications, and evaluated Andromaly's ability to detect new malware based on samples of known malware. We evaluated several combinations of anomaly detection algorithms, feature selection method and the number of top features in order to find the combination that yields the best performance in detecting new malware on Android. Empirical results suggest that the proposed framework is effective in detecting malware on mobile devices in general and on Android in particular.

Andromaly: a behavioral malware detection framework for android devices

If you want to get Handbook of Internet Computing pdf eBook copy write by good Handbook of Wireless Networks and Mobile Computing Google Books. Mobile Computing General. Handbook of Algorithms for Wireless Networking and Mobile Computing by Azzedine Boukerche (Editor). Call Number: TK 5103.2. CITS4419 Mobile and Wireless Computing software projects related to wireless networks, (2) write technical reports and documentation for complex computer.

Handbook of wireless networks and mobile computing

An automated analysis system identifies the presence of malicious P-code or N-code programs in a manner that limits the possibility of the malicious code infecting a target computer. The target computer system initializes an analytical virtual P-code engine (AVPE). As initialized, the AVPE comprises software simulating the functionality of a P-code or intermediate language engine as well as machine language facilities simulating the P-code library routines that allow the execution of N-code programs. The AVPE executes a target program so that the target program does not interact with the target computer. The AVPE analyzes the behavior of the target program to identify occurrence of malicious code behavior and to indicate in a behavior pattern the occurrence of malicious code behavior. The AVPE is terminated at the end of the analysis process, thereby removing from the computer system the copy of the target program that was contained within the AVPE.

Computer immune system and method for detecting unwanted code in a P-code or partially compiled native-code program executing within a virtual machine

An analytical virtual machine (AVM) analyzes computer code using a software processor including a register that stores behavior flags indicative of behaviors identified by virtually executing the code within the virtual machine. The AVM includes a sequencer that stores the sequence in which behavior flags are set in the behavior flags register. The AVM analyzes machine performance by emulating execution of the code being analyzed on a fully virtual machine and records the observed behavior. When emulation and analysis are complete, the AVM returns the behavior flags register and sequencer to the real machine and terminates.

Analytical virtual machine

With the integration of mobile devices into daily life, smartphones are privy to increasing amounts of sensitive information. Sophisticated mobile malware, particularly Android malware, acquire or utilize such data without user consent. It is therefore essential to devise effective techniques to analyze and detect these threats. This article presents a comprehensive survey on leading Android malware analysis and detection techniques, and their effectiveness against evolving malware. This article categorizes systems by methodology and date to evaluate progression and weaknesses. This article also discusses evaluations of industry solutions, malware statistics, and malware evasion techniques and concludes by supporting future research paths.

/pdf/the-evolution-of-android-malware-and-android-analysis-1887k95rid.pdf

The Evolution of Android Malware and Android Analysis Techniques

The goal of the paper is to propose a general approach for the authentication of users in remote domains while maintaining strict separation of security domains. The article begins with a discussion of security issues specific to user mobility, with identification of authentication requirements. Authentication solutions in existing mobile-user environments are summarized, the authors' solution to authentication of mobile users is presented, then some variations on the theme are introduced. >

Authentication of mobile users

User mobility is a feature that raises many new security-related issues and concerns. One of them is the disclosure of a mobile user’s reai identity during the authentication process, or other procedures specific to mobile networks. Such disclosure allows an unauthorized third-party to track the m.obile user’s movements and current whereabouts. Depending ou the context, access to auy information related to a mobile user’s location without his consent can be a serious violation of his privacy. This new issue might be seen as a conflicting requirement with respect to authentication: untraceability requires hiding the user’s identity while authentication requires the user’s identity to be revealed in order to be proved. What is needed is a single mechanism reconciling both authentication and privacy of a mobile user’s identification. The basic :solution to this problem is the use of uliases. Aliases insure untraceability by hiding the user’s real identity as well as his relationship with domain authorities. In this paper, we present a classification scheme to identify the various degrees of untraceability requirements. We then present an efficient method for the computation of aliases and apply It to a new set of inter-domain authentication protocols. We demonstrate that these protocols can be designed to meet various degrees of untraceability requirements. In designing these protocols, we try to avoid the drawbacks of authentication protoc:ols in existing mobile network architectures such as CDPD and GSM.

Untraceability in mobile networks

We present IDAMN (intrusion detection architecture for mobile networks), a distributed system whose main functionality is to track and detect mobile intruders in real time. IDAMN includes two algorithms which model the behavior of users in terms of both telephony activity and migration pattern. The main novelty of our architecture is its ability to perform intrusion detection in the visited location and within the duration of a typical call, as opposed to existing designs that require the reporting of all call data to the home location in order to perform the actual detection. The algorithms and the components of IDAMN have been designed in order to minimize the overhead incurred in the fixed part of the cellular network.

/pdf/idamn-an-intrusion-detection-architecture-for-mobile-2fgogwes8q.pdf

IDAMN: an intrusion detection architecture for mobile networks

Mobile networks need additional security functions in contrast to traditional fixed-topology static-user networks. In fact, a new problem involving mobility is that users are able to access the network at multiple points which can be separated by significant geographic distances and many different administrative boundaries. As these access points are not necessarily under the control of a single adminstrative authority, a new set of inter-domain mechanisms is needed in order to allow users to perform security operations in visited domains, providing they obtain an agreement from their home domain. Even if this requirement is obvious, the corresponding solutions should however take into account a somewhat contradictory security constraint that calls for strict partitioning of security domains in order to avoid sharing domain-specific security information among several domains. The authors suggest a generic solution for the authentication of users in visited domains that maintains the domain separation property. The advantage of the protocols described herein is they may be adapted to both wireless networks and traditional wireline networks supporting mobility. >

An authentication protocol for mobile users

Authentication of Mobile Users A new set of inter-domain security mechanisms is needed for users to venture into remote domains while inheriting privileges from their home domains.

D. Samfat

Papers

Authentication of mobile users

Untraceability in mobile networks

IDAMN: an intrusion detection architecture for mobile networks

An authentication protocol for mobile users

Authentication of Mobile Users A new set of inter-domain security mechanisms is needed for users to venture into remote domains while inheriting privileges from their home domains.