Menu
Android malware detection boosted by university research

Android malware detection boosted by university research

Researchers from North Carolina State University have found a way to monitor for Android malware with very low overhead

North Carolina State University's Practical Root Exploit Containment captures the performance characteristics of Android apps to spot malware

North Carolina State University's Practical Root Exploit Containment captures the performance characteristics of Android apps to spot malware

With smartphones and tablets increasingly at risk from malware, researchers from North Carolina State University have devised a new and potentially better way to detect it on Android devices.

The tool they have developed, called Practical Root Exploit Containment (PREC), is trained to uncover aberrant code written in the C programming language, the language in which they say most malicious Android code is written.

PREC looks for root exploits, in which a program gains system administration access rights to the entire device, which a malicious hacker can use with ill intent.

The researchers detailed their work, captured in the paper "PREC: Practical Root Exploit Containment for Android Devices," at the Association for Computing Machinery's Conference on Data and Application Security and Privacy, which was held this week in San Antonio, Texas.

PREC uses a well-known technique for identifying malicious code, called anomaly detection. Anomaly detection compares the expected behavior of an application with how it actually behaves when it is running on a device, in terms of the system calls it makes.

PREC is unique in that it can identify calls made to native C code from a Java program, and check to see if such actions fit into the application's profile for typical usage. The bulk of software programs for Android are written in Java, which other experimental anomaly detectors have focused on.

"We've observed that most all of the existing exploits are coming from C code," said Helen Gu, an associate professor of computer science at NCSU who was involved in the work. "It's hard, if not impossible, to launch exploits in Java code, because it has to go through the virtual machine."

With this approach, PREC has been able to reduce the number of false identifications by an order of magnitude, compared to other anomaly detectors. Focusing on native C code gives PREC a more accurate model of how attacks would differ from standard operations.

The researchers tested a prototype against 150 Android apps, of which 140 were benign and 10 contained root exploits. The experiments were run on a Google Galaxy Nexus and on an emulator. PREC was able to identify all of the root exploits with a minimum number of false alarms.

What the researchers hope to do is convince app stores, such as the Google Play Store, to create a database describing the typical performance characteristics of all their apps. They could use PREC to build these assessments. Then when a user downloads a new app, the Android device can also download the PREC execution profile for that application, and use that profile to monitor for any unusual activity coming from the app.

While app marketplace operators such as Apple or Google already screen the apps submitted to their stores, malware programmers have learned how to bury their code within an app so it doesn't execute until after the program has been downloaded, Gu said.

The researchers chose Android over Apple's iOS because the Android kernel, which is Linux, is open source, whereas Apple keeps the kernel for iOS under wraps. They built PREC as a module that can be compiled into the kernel.

PREC is not the only Android malware detector based on anomaly detection that researchers have created. Crowdroid uses a crowd-sourcing model of determining routine app behavior, and Paranoid Android offloads some of the detection duties to servers.

Both of those detectors require far more processing power on the portable device, compare to PREC, according to the NCSU researchers. Running PREC typically incurs about 3 percent overhead on the system, compared to the 15 to 30 percent overhead incurred by Crowdroid and Android.

IBM, Google, the U.S. National Science Foundation and the U.S. Army funded the research.

Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab's e-mail address is Joab_Jackson@idg.com


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags GoogleAndroid OS

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments