Android malware detection via a latent network behavior analysis

Proc. of the 11th IEEE Int. Conference on Trust, Security and Privacy in Computing and Communications, TrustCom-2012 - 11th IEEE Int. Conference on Ubiquitous Computing and Communications, IUCC-2012

Volumn , Issue , 2012, Pages 1251-1258

  Wei, Te En ^a   Mao, Ching Hao ^b   Jeng, Albert B ^a,c   Lee, Hahn Ming ^a   Wang, Horng Tzer ^a   Wu, Dong Jie ^a  

^a NATIONAL TAIWAN UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Taiwan)

^b INSTITUTE FOR INFORMATION INDUSTRY   (Taiwan)

^c JINWEN UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Taiwan)

Author keywords

Domain Name; Independent Component Analysis; Latent Behavior; Machine Learning; Malware

Indexed keywords

APP STORES; DATA SETS; DOMAIN NAMES; LATENT BEHAVIOR; MALWARE DETECTION; MALWARES; MOBILE APPLICATIONS; NETWORK BEHAVIORS; PRECISION AND RECALL; RAPID GROWTH; REVIEW PROCESS;

COMMERCE; COMPUTER CRIME; FEATURE EXTRACTION; INDEPENDENT COMPONENT ANALYSIS; LEARNING SYSTEMS; SMARTPHONES; UBIQUITOUS COMPUTING;

ROBOTS;

EID: 84868122250     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/TrustCom.2012.91     Document Type: Conference Paper

References (32)

1. Charlie Miller, Mobile Attacks and Defense, IEEE Security and Privacy, vol. 9, no. 4, pp. 68-70, July/Aug. 2011, doi:10.1109/MSP.2011.85.
2. Apple Inc. iphone. http://www.apple.com/iphone/, 2009. Visited 26.09.2011.
3. Open Handset Alliance. Android - an open handset alliance project. http://developer.android.com/, 2008. visited 26.09.2011.
4. Microsoft Corporation. Windows mobile. http://www.microsoft.com/germany/ windowsmobile/default.mspx, 2007. Visited 26.09.2011.
5. Eingereicht von, Diplom-Informatiker and Aubrey-Derrick Schmidt, Detection of Smartphone Malware, http://opus.kobv.de/tuberlin/volltexte/2011/ 3150/pdf/schmidtaubrey.pdf, 2011. Visited 26.09.2011.
6. D. Wetherall, D. Cho?nes, B. Greenstein, S. Han, P. Hornyack, J. Jung, S. Schechter, and X.Wang, Privacy revelations for web and mobile apps, In Proc. HotOS XIII, 2011.
7. B Solvr and Pedersen Stian Rene, Privacy services for mobile devices, http://ntnu.divaportal.org/smash/record.jsf;jsessionid= 9969f679ed72e0f61cd7b76e04bc?searchId=1&pid=diva2:443205, 2011. Visited26.09.201.
8. William Enck, Machigar Ongtang, and Patrick McDaniel, Understanding Android Security, IEEE Security & Privacy Magazine, 7(1):10-17, January, 2009.
9. William Enck, Damien Octeau, Patrick McDaniel, and Swarat Chaudhuri, A Study of Android Application Security, Proceedings of the 20th USENIX Security Symposium, August, 2011. San Francisco, CA.
10. William Enck, Peter Gilbert, Byung-Gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N. Sheth. TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones, Proceedings of the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI), October, 2010. Vancouver, BC.
11. Adrienne Porter Felt, Matthew Finifter, Erika Chin, Steven Hanna, and David Wagner, A Survey of Mobile Malware in the Wild, SPSM'11 Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices, New York, NY, USA, 2011
12. Jonathan Reade Duncan, Protecting Location Privacy on Android SmartPhones, http://kaso.co.uk/msccyber/JonathanDuncan-MSc-Dissertation.pdf, 2011. Visited 26.09.201.
13. Symantec. Android threat set to trigger on the end of days, or the day's end. http://www.symantec.com/connect/blogs/androidthreatset-trigger-end-days-or- day-s-end, 2011.
14. Juniper Global Threat Center. Fake player. http://globalthreatcenter.com/ ?p=1907.
15. Symantec. Android.geinimi. http://www.symantec.com/securityresponse/ writeup.jsp?docid=2011-010111-5403-99.
16. T. Strazzere. Security Alert: HongTouTou, New Android Trojan, Found in China. The Lookout Blog, 2011.
17. Android Market. http://www.android.com/market.
18. S. Dumais, Latent sematic analysis, 2004, ARIST Review of Information Science and Technology, Vol. 38, 2004.
19. SVD, http://en.wikipedia.org/wiki/Singular-value-decomposition.
20. H. Kim and H. Park, Non-negative matrix factorization based on alternating non-negativity constrained least squares and active set method, SIAM Journal on Matrix Analysis and Application, Vol. 30(2), pp. 713- 730, 2008.
21. J.-Y. Pan, H. Kitagawa, C.Faloutsos and M. Hamamoto,AutoSplit: FastandScalableDiscoveryof Hidden Variables in Stream and Multimedia Databases, PAKDD'04.
22. A. Hyvarinen, Fast and Robust Fixed-Point Algorithms for Independent Component Analysis, IEEE Transactions on Neural Networks, Vol. 10, pp. 626-634, 1999.
23. J. Sun and Y. Xie and H. Zhang and C. Faloutso, Less is more: Compact matrix decomposition for large sparse graphs, In Proc. SIAM Intl. Conf. Data Mining, 2007.
24. Droidbox, http://code.google.com/p/droidbox/.
25. Wireshark, http://www.wireshark.org/.
26. HOSTIP Project, "My ip address lookup and geotargetingcommunity geotarget ip,"2009, [Online]. Available:http://www.hostip.info.
27. T. Holz, C. Gorecki, K. Rieck, and F. Freiling, Measuring and detecting fastflux service networks, in Proceedings of the 15th Network and Distributed System Security Symposium (NDSS), 2008.
28. Greenwich2000, Greenwich mean time (gmt), 2009, [Online]. Available: http://wwp.greenwichmeantime.com/.
29. WorldTimeZone, "Standard time zones," 2009, [Online]. Available: http://www.worldtimezone.com/standard.html.
30. M. Konings, "Initial report of the gnso fast flux hosting working group," Generic Names Supporting Organization (GNSO), Tech. Rep., 2009.
31. R. Kohavi and F. Provost. Glossary of terms. Editorial for the Special Issue on Applications of Machine Learning and the Knowledge Discovery Process, 30:271-274, 1998
32. A. Shabtai U. Kanonov, Y. Elovici, C. Glezer and Y. Weiss, "Andromaly": a behavior malware detection framework for android devices, Journal of Intelligent System, Springer 2011.