Android Malware Detection Using Inter Component Communication Detector

Computer Engineering

Our system detects Android malware by identifying suspicious inter component communication activities through real-time traffic analysis, which only requires connection establishment packets. Specifically, our detection algorithms are implemented as modules inside the Open Flow controller, and the security rules can be imposed in real time. We present a new behavior-based anomaly detection system for detecting meaningful deviations in a mobile application’s network behavior. More specifically, we attempt to detect a new type of android malware with self-updating capabilities that were recently found on the official Google Android marketplace. Malware of this type cannot be detected using the standard signatures approach or by applying regular static or dynamic analysis methods. The detection is performed based on the application’s network traffic patterns only. For each application, a model representing its specific traffic pattern is learned locally (i.e., on the device). Semi-supervised machine-learning methods are used for learning the normal behavioral patterns and for detecting deviations from the application’s expected behavior. These methods were implemented and evaluated on Android devices. The evaluation experiments demonstrate that: (1)various applications have specific network traffic patterns and certain application categories can be distinguished by their network patterns; (2) different levels of deviation from normal behavior can be detected accurately; (3)in the case of self-updating malware, original (benign) and infected versions of an application have different and distinguishable network traffic patterns that in most cases, can be detected within a few minutes after the malware is executed while presenting very low false alarms rate; and local learning is feasible and has a low performance overhead on mobile devices.

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.