There are over 1.2 million applications on the Google Play store today with a large number of competing applications for any given use or function. This creates challenges for users in selecting the right application. Moreover, some of the applications being of dubious origin, there are no mechanisms for users to understand who the applications are talking to, and to what extent. In our work, we first develop a lightweight characterization methodology that can automatically extract descriptions of application network behavior, and apply this to a large selection of applications from the Google App Store. We find several instances of overly aggressive communication with tracking websites, of excessive communication with ad related sites, and of communication with sites previously associated with malware activity. Our results underscore the need for a tool to provide users more visibility into the communication of apps installed on their mobile devices. To this end, we develop an Android application to do just this; our application monitors outgoing traffic, associates it with particular applications, and then identifies destinations in particular categories that we believe suspicious or else important to reveal to the end-user.
Application profiling: Given the lack of insights associated with the Android app store, a number of studies have focused on profiling mobile apps. @cite_17 , authors describe a multi-layer profiling approach that covers both system and network aspects. While capable of obtaining detailed behavioral profiles, the methodology is difficult to scale to a large number of applications, and cannot be implemented as an Android app. In contrast, our (lightweight) approach can characterize a large number of applications. Different from @cite_17 our study focuses on many aspects of the destinations being connected to by the app. @cite_13 the authors describe techniques to fingerprint mobile apps based on their network behavior. Our work does not attempt to find application signatures, but to characterize and compare the network behavior of different apps.
@cite_13 @cite_17
2152047049 1445387515 2737578512 2050557001
Recent years have seen an explosive growth in the number of mobile devices such as smart phones and tablets. This has resulted in a growing need of the operators to understand the usage patterns of the mobile apps used on these devices. Previous studies in this area have relied on volunteers using instrumented devices or using fields in the HTTP traffic such as User-Agent to identify the apps in network traces. However, the results of the former approach are difficult to be extrapolated to real-world scenario while the latter approach is not applicable to platforms like Android where developers generally use generic strings, that can not be used to identify the apps, in the User-Agent field. In this paper, we present a novel way of identifying Android apps in network traces using mobile in-app advertisements. Our preliminary experiments with real world traces show that this technique is promising for large scale mobile app usage pattern studies. We also present an analysis of the official Android market place from an advertising perspective. An app market's vetting process is expected to be scalable and effective. However, today's vetting mechanisms are slow and less capable of catching new threats. In our research, we found that a more powerful solution can be found by exploiting the way Android malware is constructed and disseminated, which is typically through repackaging legitimate apps with similar malicious components. As a result, such attack payloads often stand out from those of the same repackaging origin and also show up in the apps not supposed to relate to each other. Based upon this observation, we developed a new technique, called MassVet, for vetting apps at a massive scale, without knowing what malware looks like and how it behaves. Unlike existing detection mechanisms, which often utilize heavyweight program analysis techniques, our approach simply compares a submitted app with all those already on a market, focusing on the difference between those sharing a similar UI structure (indicating a possible repackaging relation), and the commonality among those seemingly unrelated. Once public libraries and other legitimate code reuse are removed, such diff common program components become highly suspicious. In our research, we built this "Diff-Com" analysis on top of an efficient similarity comparison algorithm, which maps the salient features of an app's UI structure or a method's control-flow graph to a value for a fast comparison. We implemented MassVet over a stream processing engine and evaluated it nearly 1.2 million apps from 33 app markets around the world, the scale of Google Play. Our study shows that the technique can vet an app within 10 seconds at a low false detection rate. Also, it outperformed all 54 scanners in VirusTotal (NOD32, Symantec, McAfee, etc.) in terms of detection coverage, capturing over a hundred thousand malicious apps, including over 20 likely zero-day malware and those installed millions of times. A close look at these apps brings to light intriguing new observations e.g., Google's detection strategy and malware authors' countermoves that cause the mysterious disappearance and reappearance of some Google Play apps. The Android platform is becoming increasingly popular and various organizations have developed a variety of applications (App) to cater to market trends. Due to the characteristics of the Android platform, such as supporting the unofficial App stores, open source policy and the great tolerance for App verification, it is inevitable that it faces serious problems of malicious software intrusion. In order to protect the users from the serious damages caused by Android malware, we propose a low-cost and high-efficient method to extract permissions, sensitive APIs, monitoring system events and permission-rate as key features, and employ the ensemble Rotation Forest (RF) to construct a model to detect whether an Android App is malicious or not. Specifically, a dataset containing 2,130 samples is used to verify the performance of the proposed method. The experimental results show that the proposed method achieves an high accuracy of 88.26 with 88.40 sensitivity at the precision of 88.16 . To further evaluate the performance of the proposed model, we also compare it with the state-of-the-art Support Vector Machine (SVM) model under the same experimental conditions, and the comparison results demonstrate that the proposed method improves the accuracy by 3.33 compared to SVM. The experimental results show that the proposed model is extremely promising and could provide a cost-effective alternative for Android malware detection. Smartphone users do not fully know what their apps do. For example, an applications' network usage and underlying security configuration is invisible to users. In this paper we introduce Securacy, a mobile app that explores users' privacy and security concerns with Android apps. Securacy takes a reactive, personalized approach, highlighting app permission settings that the user has previously stated are concerning, and provides feedback on the use of secure and insecure network communication for each app. We began our design of Securacy by conducting a literature review and in-depth interviews with 30 participants to understand their concerns. We used this knowledge to build Securacy and evaluated its use by another set of 218 anonymous participants who installed the application from the Google Play store. Our results show that access to address book information is by far the biggest privacy concern. Over half (56.4 ) of the connections made by apps are insecure, and the destination of the majority of network traffic is North America, regardless of the location of the user. Our app provides unprecedented insight into Android applications' communications behavior globally, indicating that the majority of apps currently use insecure network connections.