SlideShare a Scribd company logo

Android Malware Detection Mechanisms

•
•
Talha Kabakus
Talha Kabakus
Technology
1 of 23
Android Malware Detection Mechanisms Talha KABAKUŞ talhakabakus@gmail.com
Agenda ● Android Market Share ● Malware Types ● Android Security Mechanism ● User Profiles ● Static Analysis ● Signature Based Analysis & Protection ● Encrypted Data Communication
Android Users more than 1 billion users Surdar Pichai Q4 2013
Applications more than 1 million applications Hugo Barra Temmuz 2013
Android Market Share Source: Strategy Analytics 81.3% Q3 2013
Why Android is so popular? ● Open source ● Google support ● Free ● Linux based ● Java ● Rich SDK ● Strong third party community ve support ○ Sony, Motorola, HTC, Samsung
Malware Market 99%Source: CISCO 2014 Security Report
Malware Stats Source: Sophos Labs 1 million
Malware Types ● Backdoor ○ Access to a computer system that bypasses security mechanisms ● Exploit ○ Modifications on operating system ○ User interface modifications ● Spyware ○ Unauthorized advertising ○ Private data collection, transmission ○ Unauthorized operations (SMS, calls)
Android Security Mechanism ● Permission based ○ Accept / Reject ● Public, indefensible market ○ Everyone can upload any application ● Passive protection - feedback based ○ Applications are removed through negative feedbacks
User Profiles 42% Unaware about permissions 83% do not interest in permissions Source: Felt, A.P., Ha, E., Egelman, S., Haney, A., Chin, E., Wagner, D.: Android permissions: User Attention, Comprehension, and Behavior. Proceedings of the Eighth Symposium on Usable Privacy and Security - SOUPS ’12. p. 1 (2012).
Static Analysis Approach ● Inspection of APK files using reverse engineering ● Manifest file ○ Permissions ○ Activities ○ Services ○ Receives ● API calls ● Source code inspection
Static Analysis Tools ● apktool ○ Extracts .apk archives ● aapt ○ Lists .apk archive contents ● dex2jar ○ Converts .dex files into .jar ● jd-gui ○ Converts .class files into Java sources
● Equality checks ● Type conversion controls ● Static updates ● Dead code detection ● Inconsistent hashCode and equals definitions ● null pointer controls ● Termination controls Source Code Inspection
Type Conversion Sample <EditText android:layout_width="fill_parent" android:layout_height="wrap_content" android: id="@+id/username"/> EditText editText = (EditText) findViewById(R. id.username); XML Java
null pointer control sample Java Activity Class Layout definition
Dead Code Detection Sample Never be executed Unreachable code
Signature Based Analysis & Control ● Signature database ● Smartphone client ● Central server ● Learning based ● Classification Bening Malware
Encrypted Data Communication ● All valuable data is encrypted and stored in SQLite database; decrypted when it is required. ● SMS ● Email ● Sensitive files ● Password ● Personal information Pocatilu, 2011
System Comparisons Ability MADAM DroidMat Julia Manifest inspection Var Var Var API call trace Var Var Var Signature database Var Var Yok Encrypted communication Yok Yok Yok Machine learning Var Var Yok
References I ● Bicheno, S.: Android Captures Record 81 Percent Share of Global Smartphone Shipments in Q3 2013, http://blogs.strategyanalytics.com/WSS/post/2013/10/31/Android-Captures- Record-81-Percent-Share-of-Global-Smartphone-Shipments-in-Q3-2013.aspx. ● Rowinski, D.: Google Play Hits One Million Android Apps, http://readwrite. com/2013/07/24/google-play-hits-one-million-android-apps. ● Cisco 2014 Annual Security Report, https://www.cisco. com/web/offer/gist_ty2_asset/Cisco_2014_ASR.pdf. ● Felt, A.P., Finifter, M., Chin, E., Hanna, S., Wagner, D.: A survey of mobile malware in the wild. SPSM ’11 Proceedings ● Zhou, Y., Wang, Z., Zhou, W., Jiang, X.: Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets. Proceedings of the 19th Annual Network and Distributed System Security Symposium (NDSS) (2012). ● Felt, A.P., Ha, E., Egelman, S., Haney, A., Chin, E., Wagner, D.: Android permissions: User Attention, Comprehension, and Behavior. Proceedings of the Eighth Symposium on Usable Privacy and Security - SOUPS ’12. p. 1 (2012). ● Felt, A.P., Greenwood, K., Wagner, D.: The effectiveness of application permissions. Proceeding of the WebApps’11 Proceedings of the 2nd USENIX conference on Web application development. p. 7. USENIX Association, Berkeley, CA, USA (2011). ● Enck, W., Ongtang, M., Mcdaniel, P.: On Lightweight Mobile Phone Application Certification. ACM conference on Computer and communications security. pp. 235–245 (2009).
References II ● Android Architecture, http://www.tutorialspoint. com/android/android_architecture.htm. ● Wu, D.-J., Mao, C.-H., Wei, T.-E., Lee, H.-M., Wu, K.-P.: DroidMat: Android Malware Detection through Manifest and API Calls Tracing. 2012 Seventh Asia Joint Conference on Information Security. pp. 62–69 (2012). ● Payet, É., Spoto, F.: Static analysis of Android programs, (2012). ● Guido, M., Ondricek, J., Grover, J., Wilburn, D., Nguyen, T., Hunt, A.: Automated identification of installed malicious Android applications. Digital Investigation (2013). ● Dini, G., Martinelli, F., Saracino, A., Sgandurra, D.: MADAM: A Multi-level Anomaly Detector for Android Malware. In: Kotenko, I. and Skormin, V. (eds.) Computer Network Security. pp. 240–253. Springer Berlin Heidelberg, Berlin, Heidelberg (2012). ● Pocatilu, P.: Android applications security. Inform. Econ. 15, 163–171. Retrieved from http://revistaie.ase.ro (2011).
Thanks... /talhakabakus talhakabakus@gmail.com talhakabakus.weebly.com

Recommended

Android malware presentation
Android malware presentationAndroid malware presentation
Android malware presentationSandeep Joshi
 
Fast detection of Android malware: machine learning approach
Fast detection of Android malware: machine learning approachFast detection of Android malware: machine learning approach
Fast detection of Android malware: machine learning approachYury Leonychev
 
Android malware analysis
Android malware analysisAndroid malware analysis
Android malware analysisJason Ross
 
Android Security
Android SecurityAndroid Security
Android SecurityArqum Ahmad
 
Android Security
Android SecurityAndroid Security
Android SecurityLars Jacobs
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning Cysinfo Cyber Security Community
 
Android security
Android securityAndroid security
Android securityMidhun P Gopi
 
Android Security
Android SecurityAndroid Security
Android SecuritySuminda Gunawardhana
 

Recommended

Android malware presentation
Android malware presentationAndroid malware presentation
Android malware presentationSandeep Joshi
 
Fast detection of Android malware: machine learning approach
Fast detection of Android malware: machine learning approachFast detection of Android malware: machine learning approach
Fast detection of Android malware: machine learning approachYury Leonychev
 
Android malware analysis
Android malware analysisAndroid malware analysis
Android malware analysisJason Ross
 
Android Security
Android SecurityAndroid Security
Android SecurityArqum Ahmad
 
Android Security
Android SecurityAndroid Security
Android SecurityLars Jacobs
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning Cysinfo Cyber Security Community
 
Android security
Android securityAndroid security
Android securityMidhun P Gopi
 
Android Security
Android SecurityAndroid Security
Android SecuritySuminda Gunawardhana
 
IRJET- Android Malware Detection System
IRJET- Android Malware Detection SystemIRJET- Android Malware Detection System
IRJET- Android Malware Detection SystemIRJET Journal
 
Threat Modelling
Threat ModellingThreat Modelling
Threat Modellingn|u - The Open Security Community
 
Malware detection-using-machine-learning
Malware detection-using-machine-learningMalware detection-using-machine-learning
Malware detection-using-machine-learningSecurity Bootcamp
 
Android security
Android securityAndroid security
Android securityMobile Rtpl
 
Basic malware analysis
Basic malware analysisBasic malware analysis
Basic malware analysissecurityxploded
 
IRJET- Android Malware Detection using Machine Learning
IRJET- Android Malware Detection using Machine LearningIRJET- Android Malware Detection using Machine Learning
IRJET- Android Malware Detection using Machine LearningIRJET Journal
 
malware analysis
malware analysismalware analysis
malware analysis20CS201AkashR
 
Women security application
Women security applicationWomen security application
Women security applicationAkshay Surve
 
Android Application Development
Android Application DevelopmentAndroid Application Development
Android Application DevelopmentBenny Skogberg
 
Mobile Malware
Mobile MalwareMobile Malware
Mobile MalwareMartin Holovský
 
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Ajin Abraham
 
Malware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesMalware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesArshadRaja786
 
Malware forensic
Malware forensicMalware forensic
Malware forensicSumeraHangi
 
Man in The Middle Attack
Man in The Middle AttackMan in The Middle Attack
Man in The Middle AttackDeepak Upadhyay
 
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...Sam Bowne
 
Security Testing
Security TestingSecurity Testing
Security TestingKiran Kumar
 
Malware and security
Malware and securityMalware and security
Malware and securityGurbakash Phonsa
 
Malware analysis
Malware analysisMalware analysis
Malware analysisPrakashchand Suthar
 
Building Custom Android Malware BruCON 2013
Building Custom Android Malware BruCON 2013Building Custom Android Malware BruCON 2013
Building Custom Android Malware BruCON 2013Stephan Chenette
 
Mobile security
Mobile securityMobile security
Mobile securitypriyanka pandey
 
Android Malware Detection Literature Review
Android Malware Detection Literature ReviewAndroid Malware Detection Literature Review
Android Malware Detection Literature ReviewAhmed Sabbah
 
W01 Levent Gurses X
W01 Levent Gurses XW01 Levent Gurses X
W01 Levent Gurses XMovel
 

More Related Content

What's hot

IRJET- Android Malware Detection System
IRJET- Android Malware Detection SystemIRJET- Android Malware Detection System
IRJET- Android Malware Detection SystemIRJET Journal
 
Malware detection-using-machine-learning
Malware detection-using-machine-learningMalware detection-using-machine-learning
Malware detection-using-machine-learningSecurity Bootcamp
 
Android security
Android securityAndroid security
Android securityMobile Rtpl
 
IRJET- Android Malware Detection using Machine Learning
IRJET- Android Malware Detection using Machine LearningIRJET- Android Malware Detection using Machine Learning
IRJET- Android Malware Detection using Machine LearningIRJET Journal
 
Women security application
Women security applicationWomen security application
Women security applicationAkshay Surve
 
Android Application Development
Android Application DevelopmentAndroid Application Development
Android Application DevelopmentBenny Skogberg
 
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Ajin Abraham
 
Malware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesMalware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesArshadRaja786
 
Malware forensic
Malware forensicMalware forensic
Malware forensicSumeraHangi
 
Man in The Middle Attack
Man in The Middle AttackMan in The Middle Attack
Man in The Middle AttackDeepak Upadhyay
 
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...Sam Bowne
 
Security Testing
Security TestingSecurity Testing
Security TestingKiran Kumar
 
Building Custom Android Malware BruCON 2013
Building Custom Android Malware BruCON 2013Building Custom Android Malware BruCON 2013
Building Custom Android Malware BruCON 2013Stephan Chenette
 

What's hot (20)

IRJET- Android Malware Detection System
IRJET- Android Malware Detection SystemIRJET- Android Malware Detection System
IRJET- Android Malware Detection System
 
Threat Modelling
Threat ModellingThreat Modelling
Threat Modelling
 
Malware detection-using-machine-learning
Malware detection-using-machine-learningMalware detection-using-machine-learning
Malware detection-using-machine-learning
 
Android security
Android securityAndroid security
Android security
 
Basic malware analysis
Basic malware analysisBasic malware analysis
Basic malware analysis
 
IRJET- Android Malware Detection using Machine Learning
IRJET- Android Malware Detection using Machine LearningIRJET- Android Malware Detection using Machine Learning
IRJET- Android Malware Detection using Machine Learning
 
malware analysis
malware analysismalware analysis
malware analysis
 
Women security application
Women security applicationWomen security application
Women security application
 
Android Application Development
Android Application DevelopmentAndroid Application Development
Android Application Development
 
Mobile Malware
Mobile MalwareMobile Malware
Mobile Malware
 
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
 
Malware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesMalware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning Techniques
 
Malware forensic
Malware forensicMalware forensic
Malware forensic
 
Man in The Middle Attack
Man in The Middle AttackMan in The Middle Attack
Man in The Middle Attack
 
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
 
Security Testing
Security TestingSecurity Testing
Security Testing
 
Malware and security
Malware and securityMalware and security
Malware and security
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
 
Building Custom Android Malware BruCON 2013
Building Custom Android Malware BruCON 2013Building Custom Android Malware BruCON 2013
Building Custom Android Malware BruCON 2013
 
Mobile security
Mobile securityMobile security
Mobile security
 

Similar to Android Malware Detection Mechanisms

Android Malware Detection Literature Review
Android Malware Detection Literature ReviewAndroid Malware Detection Literature Review
Android Malware Detection Literature ReviewAhmed Sabbah
 
W01 Levent Gurses X
W01 Levent Gurses XW01 Levent Gurses X
W01 Levent Gurses XMovel
 
Usability vs. Security: Find the Right Balance in Mobile Apps
Usability vs. Security: Find the Right Balance in Mobile AppsUsability vs. Security: Find the Right Balance in Mobile Apps
Usability vs. Security: Find the Right Balance in Mobile AppsJosiah Renaudin
 
Penetration Testing for Android Smartphones
Penetration Testing for Android SmartphonesPenetration Testing for Android Smartphones
Penetration Testing for Android SmartphonesIOSR Journals
 
A Systematic Review of Android Malware Detection Techniques
A Systematic Review of Android Malware Detection TechniquesA Systematic Review of Android Malware Detection Techniques
A Systematic Review of Android Malware Detection TechniquesCSCJournals
 
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...IOSR Journals
 
Android Security: A Survey of Security Issues and Defenses
Android Security: A Survey of Security Issues and DefensesAndroid Security: A Survey of Security Issues and Defenses
Android Security: A Survey of Security Issues and DefensesIRJET Journal
 
1668170.ppt
1668170.ppt1668170.ppt
1668170.ppt230405
 
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...IJNSA Journal
 
IRJET- A Review on Several Vulnerabilities Detection Techniques in Androi...
IRJET- A Review on Several Vulnerabilities Detection Techniques in Androi...IRJET- A Review on Several Vulnerabilities Detection Techniques in Androi...
IRJET- A Review on Several Vulnerabilities Detection Techniques in Androi...IRJET Journal
 
[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security Workshop[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security WorkshopOWASP
 
Mitigating Privilege-Escalation Attacks on Android Report
Mitigating Privilege-Escalation Attacks on Android ReportMitigating Privilege-Escalation Attacks on Android Report
Mitigating Privilege-Escalation Attacks on Android ReportVinoth Kanna
 
MOST VIEWED ARTICLES IN ACADEMIA - INTERNATIONAL JOURNAL OF MOBILE NETWORK CO...
MOST VIEWED ARTICLES IN ACADEMIA - INTERNATIONAL JOURNAL OF MOBILE NETWORK CO...MOST VIEWED ARTICLES IN ACADEMIA - INTERNATIONAL JOURNAL OF MOBILE NETWORK CO...
MOST VIEWED ARTICLES IN ACADEMIA - INTERNATIONAL JOURNAL OF MOBILE NETWORK CO...ijmnct
 
Behavior-Based Security for Mobile Devices Using Machine Learning Techniques
Behavior-Based Security for Mobile Devices Using Machine Learning TechniquesBehavior-Based Security for Mobile Devices Using Machine Learning Techniques
Behavior-Based Security for Mobile Devices Using Machine Learning Techniquesgerogepatton
 
Android-manifest extraction and labeling method for malware compilation and d...
Android-manifest extraction and labeling method for malware compilation and d...Android-manifest extraction and labeling method for malware compilation and d...
Android-manifest extraction and labeling method for malware compilation and d...IJECEIAES
 
Evaluating android antimalware against transformation attacks
Evaluating android antimalware against transformation attacksEvaluating android antimalware against transformation attacks
Evaluating android antimalware against transformation attacksIAEME Publication
 
Security Incident machnism Security Incident machnismSecurity Incident machni...
Security Incident machnism Security Incident machnismSecurity Incident machni...Security Incident machnism Security Incident machnismSecurity Incident machni...
Security Incident machnism Security Incident machnismSecurity Incident machni...karthikvcyber
 

Similar to Android Malware Detection Mechanisms (20)

Android Malware Detection Literature Review
Android Malware Detection Literature ReviewAndroid Malware Detection Literature Review
Android Malware Detection Literature Review
 
W01 Levent Gurses X
W01 Levent Gurses XW01 Levent Gurses X
W01 Levent Gurses X
 
Usability vs. Security: Find the Right Balance in Mobile Apps
Usability vs. Security: Find the Right Balance in Mobile AppsUsability vs. Security: Find the Right Balance in Mobile Apps
Usability vs. Security: Find the Right Balance in Mobile Apps
 
Penetration Testing for Android Smartphones
Penetration Testing for Android SmartphonesPenetration Testing for Android Smartphones
Penetration Testing for Android Smartphones
 
A Systematic Review of Android Malware Detection Techniques
A Systematic Review of Android Malware Detection TechniquesA Systematic Review of Android Malware Detection Techniques
A Systematic Review of Android Malware Detection Techniques
 
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...
 
Android Security: A Survey of Security Issues and Defenses
Android Security: A Survey of Security Issues and DefensesAndroid Security: A Survey of Security Issues and Defenses
Android Security: A Survey of Security Issues and Defenses
 
Android security
Android securityAndroid security
Android security
 
Android security
Android securityAndroid security
Android security
 
1668170.ppt
1668170.ppt1668170.ppt
1668170.ppt
 
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
 
IRJET- A Review on Several Vulnerabilities Detection Techniques in Androi...
IRJET- A Review on Several Vulnerabilities Detection Techniques in Androi...IRJET- A Review on Several Vulnerabilities Detection Techniques in Androi...
IRJET- A Review on Several Vulnerabilities Detection Techniques in Androi...
 
[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security Workshop[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security Workshop
 
Mitigating Privilege-Escalation Attacks on Android Report
Mitigating Privilege-Escalation Attacks on Android ReportMitigating Privilege-Escalation Attacks on Android Report
Mitigating Privilege-Escalation Attacks on Android Report
 
What is Android app Pentesting in 2022- DetoxTechnologies.pdf
What is Android app Pentesting in 2022- DetoxTechnologies.pdfWhat is Android app Pentesting in 2022- DetoxTechnologies.pdf
What is Android app Pentesting in 2022- DetoxTechnologies.pdf
 
MOST VIEWED ARTICLES IN ACADEMIA - INTERNATIONAL JOURNAL OF MOBILE NETWORK CO...
MOST VIEWED ARTICLES IN ACADEMIA - INTERNATIONAL JOURNAL OF MOBILE NETWORK CO...MOST VIEWED ARTICLES IN ACADEMIA - INTERNATIONAL JOURNAL OF MOBILE NETWORK CO...
MOST VIEWED ARTICLES IN ACADEMIA - INTERNATIONAL JOURNAL OF MOBILE NETWORK CO...
 
Behavior-Based Security for Mobile Devices Using Machine Learning Techniques
Behavior-Based Security for Mobile Devices Using Machine Learning TechniquesBehavior-Based Security for Mobile Devices Using Machine Learning Techniques
Behavior-Based Security for Mobile Devices Using Machine Learning Techniques
 
Android-manifest extraction and labeling method for malware compilation and d...
Android-manifest extraction and labeling method for malware compilation and d...Android-manifest extraction and labeling method for malware compilation and d...
Android-manifest extraction and labeling method for malware compilation and d...
 
Evaluating android antimalware against transformation attacks
Evaluating android antimalware against transformation attacksEvaluating android antimalware against transformation attacks
Evaluating android antimalware against transformation attacks
 
Security Incident machnism Security Incident machnismSecurity Incident machni...
Security Incident machnism Security Incident machnismSecurity Incident machni...Security Incident machnism Security Incident machnismSecurity Incident machni...
Security Incident machnism Security Incident machnismSecurity Incident machni...
 

More from Talha Kabakus

Abant İzzet Baysal Üniversitesi Lisansüstü Programlara Başvuru Ön Kayit Sistemi
Abant İzzet Baysal Üniversitesi Lisansüstü Programlara Başvuru Ön Kayit SistemiAbant İzzet Baysal Üniversitesi Lisansüstü Programlara Başvuru Ön Kayit Sistemi
Abant İzzet Baysal Üniversitesi Lisansüstü Programlara Başvuru Ön Kayit SistemiTalha Kabakus
 
Web Saldırı Teknikleri & Korunma Yöntemleri
Web Saldırı Teknikleri & Korunma YöntemleriWeb Saldırı Teknikleri & Korunma Yöntemleri
Web Saldırı Teknikleri & Korunma YöntemleriTalha Kabakus
 
Programlanabilir DDRx Denetleyicileri
Programlanabilir DDRx DenetleyicileriProgramlanabilir DDRx Denetleyicileri
Programlanabilir DDRx DenetleyicileriTalha Kabakus
 
Android Kötücül Yazılım (Malware) Tespit Mekanizmaları
Android Kötücül Yazılım (Malware) Tespit MekanizmalarıAndroid Kötücül Yazılım (Malware) Tespit Mekanizmaları
Android Kötücül Yazılım (Malware) Tespit MekanizmalarıTalha Kabakus
 
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi v.2
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi v.2Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi v.2
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi v.2Talha Kabakus
 
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt SistemiAbant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt SistemiTalha Kabakus
 
OSI Veri Bağı Katmanı
OSI Veri Bağı KatmanıOSI Veri Bağı Katmanı
OSI Veri Bağı KatmanıTalha Kabakus
 
Google Arama Motorunda Matrislerin Önemi
Google Arama Motorunda Matrislerin ÖnemiGoogle Arama Motorunda Matrislerin Önemi
Google Arama Motorunda Matrislerin ÖnemiTalha Kabakus
 
Görüntü i̇şlemede makine öğrenme teknikleri
Görüntü i̇şlemede makine öğrenme teknikleriGörüntü i̇şlemede makine öğrenme teknikleri
Görüntü i̇şlemede makine öğrenme teknikleriTalha Kabakus
 
64 bit işlemcilerin modern tarihçesi
64 bit işlemcilerin modern tarihçesi64 bit işlemcilerin modern tarihçesi
64 bit işlemcilerin modern tarihçesiTalha Kabakus
 
ID3 Algorithm & ROC Analysis
ID3 Algorithm & ROC AnalysisID3 Algorithm & ROC Analysis
ID3 Algorithm & ROC AnalysisTalha Kabakus
 

More from Talha Kabakus (12)

Abant İzzet Baysal Üniversitesi Lisansüstü Programlara Başvuru Ön Kayit Sistemi
Abant İzzet Baysal Üniversitesi Lisansüstü Programlara Başvuru Ön Kayit SistemiAbant İzzet Baysal Üniversitesi Lisansüstü Programlara Başvuru Ön Kayit Sistemi
Abant İzzet Baysal Üniversitesi Lisansüstü Programlara Başvuru Ön Kayit Sistemi
 
Web Saldırı Teknikleri & Korunma Yöntemleri
Web Saldırı Teknikleri & Korunma YöntemleriWeb Saldırı Teknikleri & Korunma Yöntemleri
Web Saldırı Teknikleri & Korunma Yöntemleri
 
Programlanabilir DDRx Denetleyicileri
Programlanabilir DDRx DenetleyicileriProgramlanabilir DDRx Denetleyicileri
Programlanabilir DDRx Denetleyicileri
 
Android Kötücül Yazılım (Malware) Tespit Mekanizmaları
Android Kötücül Yazılım (Malware) Tespit MekanizmalarıAndroid Kötücül Yazılım (Malware) Tespit Mekanizmaları
Android Kötücül Yazılım (Malware) Tespit Mekanizmaları
 
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi v.2
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi v.2Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi v.2
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi v.2
 
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt SistemiAbant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi
Abant İzzet Baysal Üniversitesi Enstitü Ön Kayıt Sistemi
 
Atlassian JIRA
Atlassian JIRAAtlassian JIRA
Atlassian JIRA
 
OSI Veri Bağı Katmanı
OSI Veri Bağı KatmanıOSI Veri Bağı Katmanı
OSI Veri Bağı Katmanı
 
Google Arama Motorunda Matrislerin Önemi
Google Arama Motorunda Matrislerin ÖnemiGoogle Arama Motorunda Matrislerin Önemi
Google Arama Motorunda Matrislerin Önemi
 
Görüntü i̇şlemede makine öğrenme teknikleri
Görüntü i̇şlemede makine öğrenme teknikleriGörüntü i̇şlemede makine öğrenme teknikleri
Görüntü i̇şlemede makine öğrenme teknikleri
 
64 bit işlemcilerin modern tarihçesi
64 bit işlemcilerin modern tarihçesi64 bit işlemcilerin modern tarihçesi
64 bit işlemcilerin modern tarihçesi
 
ID3 Algorithm & ROC Analysis
ID3 Algorithm & ROC AnalysisID3 Algorithm & ROC Analysis
ID3 Algorithm & ROC Analysis
 

Recently uploaded

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUK Journal
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)wesley chun
 
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfhans926745
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilV3cube
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdflior mazor
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CVKhem
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Enterprise Knowledge
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?Igalia
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun
 

Recently uploaded (20)

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 

Android Malware Detection Mechanisms

  • 1. Android Malware Detection Mechanisms Talha KABAKUŞ talhakabakus@gmail.com
  • 2. Agenda ● Android Market Share ● Malware Types ● Android Security Mechanism ● User Profiles ● Static Analysis ● Signature Based Analysis & Protection ● Encrypted Data Communication
  • 3. Android Users more than 1 billion users Surdar Pichai Q4 2013
  • 5. Android Market Share Source: Strategy Analytics 81.3% Q3 2013
  • 6. Why Android is so popular? ● Open source ● Google support ● Free ● Linux based ● Java ● Rich SDK ● Strong third party community ve support ○ Sony, Motorola, HTC, Samsung
  • 7. Malware Market 99%Source: CISCO 2014 Security Report
  • 9. Malware Types ● Backdoor ○ Access to a computer system that bypasses security mechanisms ● Exploit ○ Modifications on operating system ○ User interface modifications ● Spyware ○ Unauthorized advertising ○ Private data collection, transmission ○ Unauthorized operations (SMS, calls)
  • 10. Android Security Mechanism ● Permission based ○ Accept / Reject ● Public, indefensible market ○ Everyone can upload any application ● Passive protection - feedback based ○ Applications are removed through negative feedbacks
  • 11. User Profiles 42% Unaware about permissions 83% do not interest in permissions Source: Felt, A.P., Ha, E., Egelman, S., Haney, A., Chin, E., Wagner, D.: Android permissions: User Attention, Comprehension, and Behavior. Proceedings of the Eighth Symposium on Usable Privacy and Security - SOUPS ’12. p. 1 (2012).
  • 12. Static Analysis Approach ● Inspection of APK files using reverse engineering ● Manifest file ○ Permissions ○ Activities ○ Services ○ Receives ● API calls ● Source code inspection
  • 13. Static Analysis Tools ● apktool ○ Extracts .apk archives ● aapt ○ Lists .apk archive contents ● dex2jar ○ Converts .dex files into .jar ● jd-gui ○ Converts .class files into Java sources
  • 14. ● Equality checks ● Type conversion controls ● Static updates ● Dead code detection ● Inconsistent hashCode and equals definitions ● null pointer controls ● Termination controls Source Code Inspection
  • 15. Type Conversion Sample <EditText android:layout_width="fill_parent" android:layout_height="wrap_content" android: id="@+id/username"/> EditText editText = (EditText) findViewById(R. id.username); XML Java
  • 16. null pointer control sample Java Activity Class Layout definition
  • 17. Dead Code Detection Sample Never be executed Unreachable code
  • 18. Signature Based Analysis & Control ● Signature database ● Smartphone client ● Central server ● Learning based ● Classification Bening Malware
  • 19. Encrypted Data Communication ● All valuable data is encrypted and stored in SQLite database; decrypted when it is required. ● SMS ● Email ● Sensitive files ● Password ● Personal information Pocatilu, 2011
  • 20. System Comparisons Ability MADAM DroidMat Julia Manifest inspection Var Var Var API call trace Var Var Var Signature database Var Var Yok Encrypted communication Yok Yok Yok Machine learning Var Var Yok
  • 21. References I ● Bicheno, S.: Android Captures Record 81 Percent Share of Global Smartphone Shipments in Q3 2013, http://blogs.strategyanalytics.com/WSS/post/2013/10/31/Android-Captures- Record-81-Percent-Share-of-Global-Smartphone-Shipments-in-Q3-2013.aspx. ● Rowinski, D.: Google Play Hits One Million Android Apps, http://readwrite. com/2013/07/24/google-play-hits-one-million-android-apps. ● Cisco 2014 Annual Security Report, https://www.cisco. com/web/offer/gist_ty2_asset/Cisco_2014_ASR.pdf. ● Felt, A.P., Finifter, M., Chin, E., Hanna, S., Wagner, D.: A survey of mobile malware in the wild. SPSM ’11 Proceedings ● Zhou, Y., Wang, Z., Zhou, W., Jiang, X.: Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets. Proceedings of the 19th Annual Network and Distributed System Security Symposium (NDSS) (2012). ● Felt, A.P., Ha, E., Egelman, S., Haney, A., Chin, E., Wagner, D.: Android permissions: User Attention, Comprehension, and Behavior. Proceedings of the Eighth Symposium on Usable Privacy and Security - SOUPS ’12. p. 1 (2012). ● Felt, A.P., Greenwood, K., Wagner, D.: The effectiveness of application permissions. Proceeding of the WebApps’11 Proceedings of the 2nd USENIX conference on Web application development. p. 7. USENIX Association, Berkeley, CA, USA (2011). ● Enck, W., Ongtang, M., Mcdaniel, P.: On Lightweight Mobile Phone Application Certification. ACM conference on Computer and communications security. pp. 235–245 (2009).
  • 22. References II ● Android Architecture, http://www.tutorialspoint. com/android/android_architecture.htm. ● Wu, D.-J., Mao, C.-H., Wei, T.-E., Lee, H.-M., Wu, K.-P.: DroidMat: Android Malware Detection through Manifest and API Calls Tracing. 2012 Seventh Asia Joint Conference on Information Security. pp. 62–69 (2012). ● Payet, É., Spoto, F.: Static analysis of Android programs, (2012). ● Guido, M., Ondricek, J., Grover, J., Wilburn, D., Nguyen, T., Hunt, A.: Automated identification of installed malicious Android applications. Digital Investigation (2013). ● Dini, G., Martinelli, F., Saracino, A., Sgandurra, D.: MADAM: A Multi-level Anomaly Detector for Android Malware. In: Kotenko, I. and Skormin, V. (eds.) Computer Network Security. pp. 240–253. Springer Berlin Heidelberg, Berlin, Heidelberg (2012). ● Pocatilu, P.: Android applications security. Inform. Econ. 15, 163–171. Retrieved from http://revistaie.ase.ro (2011).