TY - GEN
T1 - Screening smartphone applications using behavioral signatures
AU - Lee, Suyeon
AU - Lee, Jehyun
AU - Lee, Heejo
N1 - Publisher Copyright:
© IFIP International Federation for Information Processing 2013.
PY - 2013
Y1 - 2013
N2 - The sharp increase of smartphone malwares has become one of the most serious security problems. The most significant part of the growth is the variants of existing malwares. A legacy approach for malware, the signature matching, is efficient in temporal dimension, but it is not practical because of its lack of robustness against the variants. A counter approach, the behavior analysis to handle the variant issue, takes too much time and resources. We propose a variant detection mechanism using runtime semantic signature. Our key idea is to reduce the control and data flow analysis overhead by using binary patterns for the control and data flow of critical actions as a signature. The flow information is a significant part of behavior analysis but takes high analysis overhead. In contrast to the previous behavioral signatures, the runtime semantic signature has higher family classification accuracy without the flow analysis overhead, because the binary patterns of flow parts is hardly shared by the out of family members. Using the proposed signature, we detect the new variants of known malwares by static matching efficiently and accurately. We evaluated our mechanism with 1,759 randomly collected real-world Android applications including 79 variants of 4 malware families. As the experimental result, our mechanism showed 99.89% of accuracy on variant detection. We also showed that the mechanism has a linear time complexity as the number of target applications. It is fully practical and advanced performance than the previous works in both of accuracy and efficiency.
AB - The sharp increase of smartphone malwares has become one of the most serious security problems. The most significant part of the growth is the variants of existing malwares. A legacy approach for malware, the signature matching, is efficient in temporal dimension, but it is not practical because of its lack of robustness against the variants. A counter approach, the behavior analysis to handle the variant issue, takes too much time and resources. We propose a variant detection mechanism using runtime semantic signature. Our key idea is to reduce the control and data flow analysis overhead by using binary patterns for the control and data flow of critical actions as a signature. The flow information is a significant part of behavior analysis but takes high analysis overhead. In contrast to the previous behavioral signatures, the runtime semantic signature has higher family classification accuracy without the flow analysis overhead, because the binary patterns of flow parts is hardly shared by the out of family members. Using the proposed signature, we detect the new variants of known malwares by static matching efficiently and accurately. We evaluated our mechanism with 1,759 randomly collected real-world Android applications including 79 variants of 4 malware families. As the experimental result, our mechanism showed 99.89% of accuracy on variant detection. We also showed that the mechanism has a linear time complexity as the number of target applications. It is fully practical and advanced performance than the previous works in both of accuracy and efficiency.
KW - Android
KW - Malware
KW - Runtime semantic signature
KW - Smartphone security
UR - http://www.scopus.com/inward/record.url?scp=84920923406&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-39218-4_2
DO - 10.1007/978-3-642-39218-4_2
M3 - Conference contribution
AN - SCOPUS:84920923406
T3 - IFIP Advances in Information and Communication Technology
SP - 14
EP - 27
BT - Security and Privacy Protection in Information Processing Systems - 28th IFIP TC 11 International Conference, SEC 2013, Proceedings
A2 - Janczewski, Lech J.
A2 - Wolfe, Henry B.
A2 - Shenoi, Sujeet
PB - Springer New York LLC
T2 - 28th IFIP TC 11 International Conference, SEC 2013
Y2 - 8 July 2013 through 12 July 2013
ER -