DroidBet：事件驱动的Android应用网络行为的自动检测系统

doi:10.11959/j.issn.1000-436x.2017103

Abstract

Abstract:

The most Android applications connect to Internet to communicate with the outside world.Applications’ network-related activities were reflected and described with network traffic.By analyzing and modeling network traffic of Android applications,network behaviors of Android applications could be subsequently characterized.Therefore,DroidBet:an event-driven network behavior automatic detection system was presented,to test and evaluate Android applications automatically.Firstly,a scenario simulation event library was built to simulate the events that applications may be executed in the process,so as to trigger the network behavior of the application as much as possible.Then,the test sequence based on the state transition analysis method was automatically generated,and the network behavior was dynamically collected during the application testing process.Finally,the machine learning method was used to learn and train the collected network behavior,and the network behavior model based on BP neural network was generated to detect the behavior of the unknown Android application.The experimental results show that DroidBet can effectively trigger and extract the network behavior of the application,which has the advantages of high accuracy and low resource cost.

Key words: Android, scenario simulation, network behavior, auto-detection

CLC Number:

TP393

Song-jie WEI,Gao-xiang WU,Na LUO,Zhao-wei SHI,Zi-yang ZHOU. DroidBet:event-driven automatic detection of network behaviors for Android applications[J]. Journal on Communications, 2017, 38(5): 84-95.

Figures/Tables 14

References 22

[1]	SORONCHO M F M , CHERUIYOT W , KIMANI S . Framework for vetting and identifying emulated Android mobile apps[J]. International Journal of Computer (IJC), 2016,23(1): 35-41.
[2]	陈宏伟, 熊焰, 黄文超 ,等. 基于关联分析的 Android 权限滥用攻击检测系统[J]. 计算机系统应用, 2016,25(4): 36-42.
	CHEN H W , XIONG Y , HUANG W C ,et al. Association analysis based detection system for Android permission abuse attacks[J]. Computer Systems ＆ Applications, 2016,25(4): 36-42.
[3]	BOWMAN-AMUAH M K . System,method and article of manufacture for security management in a development architecture framework:U.S.Patent 6,324,647[P]. 2001-11-27
[4]	TAYLOR V F , MARTINOVIC I . To update or not to update:insights from a two-year study of Android app evolution[C]// The 2017 ACM on Asia Conference on Computer and Communications Security. ACM, 2017: 45-57.
[5]	杨欢, 张玉清, 胡予濮 ,等. 基于多类特征的Android应用恶意行为检测系统[J]. 计算机学报, 2014,37(01): 15-27.
	YANG H , ZHANG Y Q , HU Y P ,et al. A malware behavior detection system of android application based on multi-class features[J]. Chinese Journal of Computers, 2014,37(01): 15-27.
[6]	SUI A F , GUO D F , GUO T ,et al. Network behavior based mobile virus detection[C]// IEEE,International Conference on Communication Technology. 2012: 872-876.
[7]	KIM J , YI K ,et al. SCANDal:static analyzer for detecting privacy leaks in Android applications[J]. Mobile Security Technologies, 2012,12.
[8]	LU L , LI Z , WU Z ,et al. CHEX:statically vetting Android apps for component hijacking vulnerabilities[C]// The 2012 ACM Conference on Computer and Communications Security. ACM, 2012: 229-240.
[9]	FUCHS A P , CHAUDHURI A , FOSTER J S . Scandroid:automated security certification of Android[R]. 2009.
[10]	SHABTAI A , KANONOV U , ELOVICI Y ,et al. “Andromaly”:a behavioral malware detection framework for Android devices[J]. Journal of Intelligent Information Systems, 2012,38(1): 161-190.
[11]	BURGUERA I , ZURUTUZA U , NADJM-TEHRANI S . Crowdroid:behavior based malware detection system for Android[C]// The 1st ACM Workshop on Security and Privacy in Smartphones and Mobile Devices. ACM, 2011: 15-26.
[12]	DINI G , MARTINELLI F , SARACINO A ,et al. MADAM:a multi-level anomaly detector for Android malware[C]// International Conference on Mathematical Methods,Models,and Architectures for Computer Network Security. Springer Berlin Heidelberg, 2012: 240-253.
[13]	MAO C H , JENG A B , Lee H M ,et al. Android malware detection via a latent network behavior analysis[C]// IEEE,International Conference on Trust,Security and Privacy in Computing and Communications. IEEE, 2012: 1251-1258.
[14]	卿斯汉, 蒋建春, 马恒太 ,等. 入侵检测技术研究综述[J]. 通信学报, 2004,25(7): 19-29.
	QING S H , JIANG J C , MA H T ,et al. Research on intrusion detection techniques：a survey[J]. Journal on Communications, 2004,25(7): 19-29.
[15]	KRüGEL C , TOTH T , KIRDA E . Service specific anomaly detection for network intrusion detection[C]// The 2002 ACM Symposium on Applied Computing. ACM, 2002: 201-208
[16]	ZHOU Y , JIANG X . Dissecting Android malware:characterization and evolution[C]// Security and Privacy (SP),2012 IEEE Symposium on. IEEE, 2012: 95-109.
[17]	ALAZAB M , MOONSAMY V , BATTEN L ,et al. Analysis of malicious and benign Android applications[C]// Distributed Computing Systems Workshops (ICDCSW),32nd International Conference on IEEE, 2012: 608-616.
[18]	CHIN E , FELT A P , GREENWOOD K ,et al. Analyzing inter-application communication in Android[C]// International Conference on Mobile Systems,Applications,and Services. ACM, 2011: 239-252.
[19]	BURGUERA I , ZURUTUZA U,NADJM-TEHRANI S . Crowdroid:behavior-based malware detection system for Android[C]// ACM Workshop on Security and Privacy in Smartphones and Mobile Devices. ACM, 2011: 15-26.
[20]	李舟军, 吴春明, 王啸 . 基于沙盒的 Android 应用风险行为的分析与评估[J]. 清华大学学报, 2016,56(5): 453-460.
	LI Z J , WU C M , WANG X . Assessment of Android application's risk behavior based on a sandbox system[J]. Journal of Tsinghua University (Science and Technology), 2016,56(5): 453-460.
[21]	BL?SING T , BATYUK L , SCHMIDT A D ,et al. An Android application sandbox system for suspicious software detection[C]// International Conference on Malicious and Unwanted Software. IEEE, 2010: 55-62.
[22]	JANG J , YUN J , MOHAISEN A ,et al. Detecting and classifying method based on similarity matching of Android malware behavior with profile[J]. SpringerPlus, 2016,5(1).

Metrics

Recommended 0

No Suggested Reading articles found!

事件编号	事件名称	事件描述	事件类型
E ₁	启动	启动应用程序	应用改变
E ₂	点击	单击应用程序主界面	人机交互
E ₃	休眠	应用程序处于休眠状态	人机交互
E₄	解锁	解锁Android设备	人机交互
E ₅	电池	Android设备电池状态改变	环境改变
E ₆	网络	Android设备网络状态改变	环境改变
E ₇	位置	Android设备位置信息改变	环境改变
E ₈	SIM卡	Android设备更换SIM卡	环境改变
E ₉	时间	Android设备系统时间改变	环境改变
E ₁₀	相册	Android设备相册内容改变	环境改变
E ₁₁	通讯录	Android设备通讯录改变	环境改变
E ₁₂	短信	Android 设备运行过程中，接收到外来短信	外来事件

字段名	字段类型	字段描述
id	int	表项编号
PermissionId	int	权限编号
PermissionDescribe	varchar(50)	权限描述
EventId	int	场景模拟事件编号
EventWeight	float	场景模拟事件权重

敏感信息内容	示例值
Android设备ID	3531505c0b421c4d
Android设备型号	Huawei C8817l
Android设备IMEI号	864036026855634
Android设备IMSI号	310005123456789
操作系统版本	Android4.4
Android设备位置	E118°46′N32°03′
Android设备电话号码	15555215554

类别	正常样本个数	应用程序示例	正确率
新闻	161	新浪新闻	0.882
购物	105	淘宝	0.857
视频	170	爱奇艺视频	0.912
云盘	55	百度网盘	0.909
工具	77	antutu.powersaver	0.974

正常样本	恶意样本	漏报率	误报率	正确率
568	105	0.124	0.099	0.897

DroidBet:event-driven automatic detection of network behaviors for Android applications

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 14

References 22

Related Articles 11

Metrics

Recommended 0

检测工具	选取特征	动态/静态	算法	触发方式	测试过程	数据集
文献[18]中的ComDroid	系统权限	静态	—	—	手动	100个APP
文献[19]中的CrowDroid	系统调用特征	动态	K-means	特定交互触发	手动	2类APP
文献[20]中的工具	API	动态	—	monkey随机触发	手动	1 600个APP
文献[21]中的AASandBox	系统调用特征	动静结合	—	monkey随机触发	手动	150个APP
DroidBet	网络特征	动态	BP神经网络	测试序列触发	自动	673个APP

[1]	Yubo SONG, Qi CHEN, Rui SONG, Aiqun HU. Android application privacy protection mechanism based on virtual machine bytecode injection [J]. Journal on Communications, 2021, 42(6): 171-181.
[2]	Jiawei QIN, Hua ZHANG, Hanbing YAN, Nengqiang HE, Tengfei TU. Research on context-aware Android application vulnerability detection [J]. Journal on Communications, 2021, 42(11): 13-27.
[3]	Zhu WANG,Kun HE,Xinyu WANG,Ben NIU,Fenghua LI. Traffic characteristic based privacy leakage assessment scheme for Android device [J]. Journal on Communications, 2020, 41(2): 155-164.
[4]	Xinyu WANG,Ben NIU,Fenghua LI,Kun HE. Risk assessing and privacy-preserving scheme for privacy leakage in APP [J]. Journal on Communications, 2019, 40(5): 13-23.
[5]	Hongyu YANG,Zaiming WANG. Android collusion attack detection model [J]. Journal on Communications, 2018, 39(6): 27-36.
[6]	Bo CHEN,Yong-tao PAN,Tie-ming CHEN. Android malware detection method based on SimHash [J]. Journal on Communications, 2017, 38(Z2): 30-36.
[7]	Yan LIU,Yong-ping ZHANG,Cheng ZHU,Jun GAO,Qi-ming LIU. Intelligent forecasting and monitoring of air index based on big data and internet of things [J]. Journal on Communications, 2017, 38(Z2): 129-138.
[8]	Hai-yan KANG,Han YAN,Hao-ran HUANG,Xuan1 SUN. Wi-Fi security evaluation model based on BP neural network [J]. Journal on Communications, 2016, 37(Z1): 50-56.
[9]	Yan-ping XU,Zhao-feng MA,Zhong-hua WANG,Xin-xin NIU,Yi-xian YANG. Survey of security for Android smart terminal [J]. Journal on Communications, 2016, 37(6): 169-184.
[10]	. Android malware detection method based onpermission sequential pattern mining algorithm [J]. Journal on Communications, 2013, 34(Z1): 14-115.
[11]	Huan YANG,Yu-qing ZHANG,Yu-pu HU,Qi-xu LIU. Android malware detection method based on permission sequential pattern mining algorithm [J]. Journal on Communications, 2013, 34(Z1): 106-115.