ABSTRACT
There is little information from independent sources in the public domain about mobile malware infection rates. The only previous independent estimate (0.0009%) [11], was based on indirect measurements obtained from domain-name resolution traces. In this paper, we present the first independent study of malware infection rates and associated risk factors using data collected directly from over 55,000 Android devices. We find that the malware infection rates in Android devices estimated using two malware datasets (0.28% and 0.26%), though small, are significantly higher than the previous independent estimate. Based on the hypothesis that some application stores have a greater density of malicious applications and that advertising within applications and cross-promotional deals may act as infection vectors, we investigate whether the set of applications used on a device can serve as an indicator for infection of that device. Our analysis indicates that, while not an accurate indicator of infection by itself, the application set does serve as an inexpensive method for identifying the pool of devices on which more expensive monitoring and analysis mechanisms should be deployed. Using our two malware datasets we show that this indicator performs up to about five times better at identifying infected devices than the baseline of random checks. Such indicators can be used, for example, in the search for new or previously undetected malware. It is therefore a technique that can complement standard malware scanning. Our analysis also demonstrates a marginally significant difference in battery use between infected and clean devices.
- D. Barrera, J. Clark, D. McCarney, and P. C. van Oorschot. Understanding and improving app installation security mechanisms through empirical analysis of android. In Proc. the second ACM workshop on Security and privacy in smartphones and mobile devices, SPSM'12, pages 81--92. ACM, 2012. Google ScholarDigital Library
- I. Burguera, U. Zurutuza, and S. Nadjm-Tehrani. Crowdroid: behavior-based malware detection system for android. In Proc. the 1st ACM workshop on Security and privacy in smartphones and mobile devices, pages 15--26. ACM, 2011. Google ScholarDigital Library
- M. Chandramohan and H. B. K. Tan. Detection of mobile malware in the wild. Computer, 45(9):65--71, 2012. Google ScholarDigital Library
- P. H. Chia, Y. Yamamoto, and N. Asokan. Is this app safe?: a large scale study on application permissions and risk signals. In Proc. the 21st international conference on World Wide Web, WWW '12, pages 311--320. ACM, 2012. Google ScholarDigital Library
- Damballa Labs. Damballa threat report -- first half 2011. Technical report, 2011. https://www.damballa.com/downloads/r_pubs/Damballa_Threat_Report-First_Half_2011.pdf.Google Scholar
- A. P. Felt, M. Finifter, E. Chin, S. Hanna, and D. Wagner. A survey of mobile malware in the wild. In Proc. the 1st ACM workshop on Security and privacy in smartphones and mobile devices, SPSM'11, pages 3--14. ACM, 2011. Google ScholarDigital Library
- J. Hoffmann, S. Neumann, and T. Holz. Mobile malware detection based on energy fingerprints - a dead end? In RAID, 2013.Google ScholarDigital Library
- H. Kim, J. Smith, and K. G. Shin. Detecting energy-greedy anomalies and mobile malware variants. In Proc. the 6th international conference on Mobile systems, applications, and services, MobiSys '08, pages 239--252. ACM, 2008. Google ScholarDigital Library
- K. Kostiainen, E. Reshetova, J.-E. Ekberg, and N. Asokan. Old, new, borrowed, blue: a perspective on the evolution of mobile platform security architectures. In First ACM Conference on Data and Application Security and Privacy, pages 13--24. ACM, 2011. Google ScholarDigital Library
- B. Krebs. Mobile Malcoders Pay to Google Play, Mar. 2013. http://krebsonsecurity.com/2013/03/mobile-malcoders-pay-to-google-play/.Google Scholar
- C. Lever, M. Antonakakis, B. Reeves, P. Traynor, and W. Lee. The core of the matter: Analyzing malicious traffic in cellular carriers. In Proc. the 2013 Network and Distributed Systems Security Conference (NDSS 2013). Internet Society, 2013.Google Scholar
- Lookout Mobile. 2013 mobile threat predictions, Dec 2012. https://blog.lookout.com/blog/2012/12/13/2013-mobile-threat-predictions/.Google Scholar
- Lookout Mobile. Lookout tours the current world of mobile threats. Lookout blog, June 2013. https://blog.lookout.com/blog/2013/06/05/world-current-of-mobile-threats/.Google Scholar
- R. McGarvey. Threat of the week: Mobile malware, menace or myth? CreditUnion Times, Apr. 2013.Google Scholar
- NQMobile. Mobile malware up 163% in 2012, getting even smarter in 2013. PRNEwsWire, 2013. http://ir.nq.com/phoenix.zhtml?c=243152&p=irol-newsArticle&id=1806588.Google Scholar
- A. J. Oliner, A. P. Iyer, I. Stoica, E. Lagerspetz, and S. Tarkoma. Carat: Collaborative energy diagnosis for mobile devices. In Proc. 11th ACM Conference on Embedded Networked Sensor Systems, Nov 2013. Google ScholarDigital Library
- L. Page. Update from the CEO, Mar. 2013. http://googleblog.blogspot.fi/2013/03/update-from-ceo.html.Google Scholar
- A. Pathak, A. Jindal, Y. C. Hu, and S. Midkiff. What is keeping my phone awake? Characterizing and detecting no-sleep energy bugs in smartphone apps. In Mobisys, 2012. Google ScholarDigital Library
- S. M. Patterson. Contrary to what you've heard, Android is almost impenetrable to malware, Oct 2013. http://qz.com/131436/contrary-to-what-youve-heard-android-is-almost-impenetrable-to-malware/.Google Scholar
- V. Paxson. Bro:\ a system for detecting network intruders in real-time. In Computer Networks, volume 31, 1999. Google ScholarDigital Library
- G. Portokalidis, P. Homburg, K. Anagnostakis, and H. Bos. Paranoid android: versatile protection for smartphones. In Proc. the 26th Annual Computer Security Applications Conference, ACSAC '10, pages 347--356, New York, NY, USA, 2010. ACM. Google ScholarDigital Library
- M. M. Sebring and R. A. Whitehurst. Expert systems in intrusion detection:\ a case study. In National Computer Security Conference, 1988.Google Scholar
- M. Spreitzenbarth, F. Echtler, T. Schrek, F. C. Freiling, and J. Hoffman. MobileSandbox: looking deeper into android applications. In Proc. the 28th ACM Symposium on Applied Computing (SAC), 2013. Google ScholarDigital Library
- C. Sumner and R. Wald. Predicting susceptibility to social bots on twitter. BlackHat US presentation. https://media.blackhat.com/us-13/US-13-Sumner-Predicting-Susceptibility-to-Social-Bots-on-Twitter-Slides.pdf.Google Scholar
- Trend Labs. Trojanized security tool serves as backdoor app, Mar 2011. http://blog.trendmicro.com/trendlabs-security-intelligence/trojanized-security-tool-serves-as-backdoor-app/.Google Scholar
- H. T. T. Truong, E. Lagerspetz, P. Nurmi, A. J. Oliner, S. Tarkoma, N. Asokan, and S. Bhattacharya. The Company You Keep: Mobile Malware Infection Rates and Inexpensive Risk Indicators. CoRR, abs/1312.3245, 2013. http://arxiv.org/abs/1312.3245.Google Scholar
- C. Wagner, S. Mitter, C. Körner, and M. Strohmaier. When social bots attack: Modeling susceptibility of users in online social networks. In 2nd workshop on Making Sense of Microposts at WWW2012, 2012.Google Scholar
- L. Yang, V. Ganapathy, and L. Iftode. Enhancing mobile malware detection with social collaboration. In Privacy, Security, Risk and Trust (PASSAT), IEEE Third International Conference on Social Computing (SocialCom), pages 572--576, 2011.Google Scholar
- Y. Zhou and X. Jiang. Dissecting android malware: Characterization and evolution. In 2012 IEEE Symposium on Security and Privacy (SP), pages 95--109, 2012. Google ScholarDigital Library
- Y. Zhou, Z. Wang, W. Zhou, and X. Jiang. Hey, you, get off of my market: Detecting malicious apps in official and alternative android markets. In Proc. the 2012 Network and Distributed Systems Security Conference (NDSS 2012), Feb. 2012.Google Scholar
Index Terms
- The company you keep: mobile malware infection rates and inexpensive risk indicators
Recommendations
A comprehensive survey on deep learning based malware detection techniques
AbstractRecent theoretical and practical studies have revealed that malware is one of the most harmful threats to the digital world. Malware mitigation techniques have evolved over the years to ensure security. Earlier, several classical ...
On mobile malware infections
WiSec '14: Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile networksAndro-Dumpsys
Our system (Andro-Dumpsys) leverages volatile memory acquisition.Andro-Dumpsys leverages malware creator information and malware information.Andro-Dumpsys is anti-malware system based on similarity matching of footprints.Andro-Dumpsys is capable of ...
Comments