Behavioral detection of malware on mobile handsets

MobiSys'08 - Proceedings of the 6th International Conference on Mobile Systems, Applications, and Services

Volumn , Issue , 2008, Pages 225-238

  Bose, Abhijit ^a   Hu, Xin ^b   Shin, Kang G ^b   Park, Taejoon ^c  

^a IBM   (United States)

^b UNIVERSITY OF MICHIGAN   (United States)

^c SAMSUNG Electronics   (South Korea)

Author keywords

Machine learning; Mobile handsets; Security; Worm detection

Indexed keywords

APPLICATIONS; COMPUTER CRIME; COMPUTER OPERATING SYSTEMS; COMPUTER WORMS; DIESEL ENGINES; LEARNING SYSTEMS; MICROORGANISMS; MOBILE DEVICES; MOBILE TELECOMMUNICATION SYSTEMS; PORTABLE EQUIPMENT; SHELTERS (FROM ATTACK); SUPPORT VECTOR MACHINES; TELECOMMUNICATION EQUIPMENT; TELEPHONE SETS; VIDEO STREAMING; VIRUSES;

BEHAVIOR SIGNATURES; DETECTION FRAMEWORKS; MACHINE LEARNING; MALICIOUS BEHAVIORS; MALWARE; MAPPING TECHNIQUES; MOBILE HANDSETS; MONITORED SYSTEMS; NORMAL BEHAVIORS; SECURITY; SUPPORT VECTORS; SYMBIAN OSSA; TROJANS; WORM DETECTION;

COMPUTER VIRUSES;

EID: 57349125651     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1378600.1378626     Document Type: Conference Paper

References (54)

1. Rootkitrevealer 1.71. http://technet.microsoft.com/enus/sysinternals/ bb897445.aspx.
2. Upx: the ultimate packer for executables. http://upx.sourceforge.net/.
3. G. Berry and G. Gonthier. The esterel synchronous programming language: Design, semantics, implementation. Science of Computer Programming, 19(2):87-152, 1992.
4. A. Bose and K. G. Shin. On mobile viruses exploiting messaging and Bluetooth services. Secure Comm, 2006.
5. T. Brosch and M. Morgenstern. Runtime packers: The hidden problem? Black Hat USA 2006.
6. C.-C. Chang and C.-J. Lin. LIBSVM: a library for support vector machines, 2001. Software available at http://www.csie.ntu.edu.tw/cjlin/ libsvm.
7. J. Cheng, S. H. Wong, H. Yang, and S. Lu. Smartsiren: virus detection and alert for smartphones. In Mohi Sys'07: Proceedings of the 5th international conference on Mobile systems, applications and sendces, pages 258-271, New York, NY, USA, 2007. ACM.
8. N. Christianini and J. Shawe-Taylor. An introduction to Support Vector Machines and other kernel-based learning methods. Cambridge University Press, 2000.
9. W. W. Cohen. Fast effective rule induction. In Proc. of the 12th International Conference on Machine Learning, 1995.
10. S. Corp. Symantec internet security threat report trends. http://www.symantec.com/business/theme.jsp?themeid=threatreport.
11. K. Corporation". Kaspersky Anti-Virus Mobile. http://usa.kaspersky. com/products-services/antivirusmobile.php.
12. E. Kirda, C. Kruegel, G. Banks, G. Vigna, and R. Kemmerer. Behavior-based spyware detection. In Proceedings of the 15th USENIX Security Symposium, 2006.
13. D. R. Ellis, J. G. Aiken, K. S. Attwood, and S. D. Tenaglia. A behavioral approach to worm detection. In ACM Workshop on Rapid malcode (WORM), pages 43-53, 2004.
14. W. Enck, P. Traynor, P. McDaniel, and T. La Porta. Exploiting open functionality in SMS-capable cellular networks. ACM Conference on Computer and communications security, 2005.
15. F-secure. Cabir. http://www.f-secure.com/v-descs/cabir.shtml.
16. F-secure. Lasco. http://www.f-secure.com/v-descs/lasco-a.shtml.
17. F-secure. Mobile detection descriptions. http://www.fsecure.com/v-descs/ mobile-description-index.shtml.
18. F-Secure. SymbOS. Acallno Trojan description. http://www.f-secure.com/sw- desc/acallno-a.shtml, Aug 2005.
19. F-Secure. SymbOS.Cardtrap Trojan description. http://www.f-secure.com/v- descs/cardtrap-a.shtml, 2005.
20. C. Fleizach, M. Liljenstam, P. Johansson, G. M. Voelker, and A. Mehes. Can you infect me now?: malware propagation in mobile phone networks. In WORM'07: Proceedings of the 2007 ACM workshop on Recurring malcode, pages 61-68, New York, NY, USA, 2007. ACM.
21. S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff. A sense of self for Unix processes. IEEE Symposium on Security and Privacy, 120, 1996.
22. A. K. Ghosh, A. Schwartzbard, and M. Schatz. Learning program behavior profiles for intrusion detection. In ID'99: Proceedings of the 1st conference on Workshop on Intrusion Detection and Network Monitoring, 1999.
23. A. Honig, A. Howard, E. Eskin, and S. Stolfo. Adaptive model generation:: An architecture for the deployment of data minig-based intrusion detection systems. Data Mining for Security Applications, 2002.
24. H. Wang, S. Jha, and V. Ganapathy. Netspy: Automatic generation of spyware signatures for nids. In Proceedings of Annual Computer Security Applications Conference, 2006.
25. T. M. Incorporated. Trend Micro mobile security. http://www.trendmicro. com/en/products/mobile/tmms/, 2006.
26. T. Joachims. Making large-scale support vector machine learning practical. In B. Scholkopf, C. Burges, and A. Smola, editors, Advances in Kernel Methods: Support Vector Machines. MIT Press, Cambridge, MA, 1998.
27. Y Kaplan. Api spying techniques for windows 9x, nt and 2000. http://www.internals.com/articles/apispy/apispy.htm.
28. S. T. King and P. M. Chen. Backtracking intrusions. ACM Transactions on Computer Systems (TOCS), 2005.
29. J. Kleinberg. The wireless epidemic. Nature, 449(20):287-288, September 2007.
30. K. Lab. Kaspersky security bulletin 2006: Mobile malware. http://www.viruslist.com/en/analysis?pubid=204791922.
31. K. Lab. Mobile malware evolution: An overview, part 2. http://www.viruslist.com/en/analysis?pubid=201225789.
32. K. Lab. Mobile threats - myth or reality? http://www.viruslist.com/en/ weblog?weblogid=204924390.
33. L. Lamport. Time, clocks, and the ordering of events in a distributed system. Communications of the ACM, 21(7):558-565, 1978.
34. M. Christodorescu, S. Jha, S.A. Seshia, D. Song, and R.E. Bryant. Semantics-aware malware detection. In Proceedings of the IEEE Symposium on Security and Privacy, 2005.
35. J. W. Mickens and B. D. Noble. Modeling epidemic spreading in mobile environments. In 2005 ACM Workshop on Wireless Security (WiSe 2005), September 2005.
36. J. A. Morales, P. J. Clarke, Y. Deng, and B. M. G. Kibria. Testing and evaluating virus detectors for handheld devices. Journal in Computer Virology, 2(2):135-147, November 2006.
37. S. Mukkamala, G. Janoski, and A. Sung. Intrusion detection using neural networks and support veetormachines. Intl. Joint Conf. on Neural Networks, 2002, 2, 2002.
38. W. Penczek. Temporal logic of causal knowledge. Proc. of WoLLiC, 98, 1998.
39. S. Schechter, J. Jung, and A. Berger. Fast detection of scanning worm infections. In International Symposium on- Recent Advances in Intrusion Detection (RAID), 2004.
40. B. Scholkopf and A. J. Smola. Learning with Kernels: Support Vector Machines, Regularization, Optimization, and Beyond. MIT Press, Cambridge, MA, USA, 2001.
41. R. Sekar, M. Bendre, D. Dhurjati, and P. Bollineni. A fast automaton-based method for detecting anomalous program behaviors. In SP'01: Proceedings of the 2001 IEEE Symposium on Security and Privacy, page 144, Washington, DC, USA, 2001. IEEE Computer Society.
42. A. Seshadri, M. Luk, N. Qu, and A. Perrig. Secvisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity oses. In SOSP'07: Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, pages 335-350, New York, NY, USA, 2007. ACM.
43. Symantec. SymbOS. Commwarrior Worm Description. http://securityresponse. symantec.com/avcenter/venc/data/symbos.commwarrior.a.html, October 2005.
44. Symantec. SymbOS. Mabir Worm Description. http://securityresponse. symantec.com/avcenter/venc/data/symbos.mabir.html, April 2005.
45. Symbian. Symbian Signed platform security. http://www.symbiansigned.com.
46. T. Lee and J.J. Mody. Behavioral classification. http://www.microsoft. com/downloads/details.aspx?FamilyID=7b5d8cc8-b336-4091 -abb5-2cc500a6c41 a&displaylang=en, 2006.
47. S. Töyssy and M. Helenius. About malicious software in smartphones. Journal in Computer Virology, 2(2), 2006.
48. V. Vapnik. The Nature of Statistical Learning Theory. Springer, New York, 1995.
49. D. Wagner and P. Soto. Mimicry attacks on host based intrusion detection systems, 2002.
50. K. Wang, G. Cretu, and S. J. Stolfo. Anomalous payload-based worm detection and signature generation. International Symposium on Recent Advances in Intrusion Detection (RAID), 2005.
51. C. Warrender, S. Forrest, and B. A. Pearlmutter. Detecting intrusions using system calls: Alternative data models. In IEEE Symposium on Security and Privacy, pages 133-145, 1999.
52. G. Yan, and S. Eidenbenz. Bluetooth worms: Models, dynamics, and defense implications. In Computer Security Applications Conference, 2006.
53. G. Yan, H. D. Flores, L. Cuellar, N. Hengartner, S. Eidenbenz, and V. Vu. Bluetooth worm propagation: mobility pattern matters! In Proceedings of the 2nd ACM symposium on Information, computer and communications security, 2007.
54. C. C. Zou, W. Gong, D. Towsley, and L. Gao. The monitoring and early detection of Internet worms. IEEE/ACM Transactions on Networking, 13(5):961-974, 2005.