Android恶意软件检测：AndroDialysis分析Intent效能

需积分: 10 60 浏览量更新于2024-07-19 收藏 2.02MB PDF 举报

"AndroDialysis: Analysis of Android Intent Effectiveness in Malware Detection" 这篇文章是关于Android操作系统中恶意软件检测的一项研究，名为"AndroDialysis"。该研究聚焦于Android系统的Intent机制在识别和防御恶意软件中的效果。Intent是Android系统中用于组件间通信的关键机制，恶意软件往往利用Intent来实现其恶意行为。通过分析Intent的行为模式，研究人员旨在提高对Android平台上的恶意软件检测能力。文章发表在2017年3月的《Computers & Security》期刊上，由包括Ali Feizollah, Nor Badrul Anuar, Guillermo Suarez-Tangil 和 Steven Furnell等在内的5位作者共同完成。这些作者在安全领域有丰富的研究背景，其中部分人还从事相关的项目，如Android僵尸网络检测与响应系统和网络威胁情报研究。在AndroDialysis项目中，作者们可能分析了大量的恶意软件样本，研究它们如何利用Intent进行传播、控制或其他恶意活动。他们可能通过逆向工程、行为分析和机器学习方法，深入理解Intent在恶意软件生命周期中的作用，并评估了基于Intent特征的检测方法的有效性。尽管文章在发布时未获得引用（截至给出的信息），但其阅读量达到了288次，表明它在学术界和业界有一定的关注度。由于文章的全文并未提供，我们无法得知具体的实验设计、结果和结论。不过，可以推测，研究可能提出了新的检测策略或改进了现有方法，以更有效地检测那些利用Intent机制的Android恶意软件。此外，文章中提到的研究链接到ResearchGate平台，允许读者访问并获取更多的相关研究成果，进一步研究Intent在Android安全中的角色，以及如何通过理解这些机制来提升移动设备的安全防护能力。这对于Android开发者、安全研究员以及对移动安全感兴趣的个人来说，都是一个宝贵的资源。

instance, Google Play employs a review system to vet poten-

tially dangerous applications (Oberheide and Miller, 2012).

Despite all these efforts, commercial surve ys still report a large

number of malicious applications attacking the Android

markets. For instance, GData reported nearly half a million new

Android malware in 2015

. More recently, new malwares such

as the BrainTest (

Polkovnichenko and Boxiner , 2015) ha ve suc-

ceeded in infecting ov er half a million Android de vices, targeting

Google Play in particular. Many recent studies have resulted

in a number of automated approaches to tackle the spread of

malware (

Aresu et al., 2015; F eizollah et al., 2013; Narudin et al.,

2016; Tam et al., 2015

). Static analysis techniques, which have

traditionally been used for detecting malware targeting desktop

computers, have recently gained popularity as effective mea-

sures for the protection of mobile applications (

Desnos, 2012).

In particular, static approaches aim at detecting Android

malware by analyzing their permission usage (

Zhang et al.,

2013

), mining their code structures (Suarez-Tangil et al., 2014),

understanding the components they used (

Arp et al., 2014), and

monitoring the APIs they invoked (Aafer et al., 2013; Arp et al.,

2014; Yang et al., 2014

). Inter-process communication is one

of the most notable features of the Android framework as it

allows the reuse of components across process boundaries. It

is used as gateway to access different sensitive services in the

Android framework. In the Android platform, this communi-

cation system is usually driven by a late runtime binding

messaging object known as Intent. Intent objects provide an

abstract deﬁnition of the operations an application intends to

perform.

The rich semantics encoded in this type of component in-

dicate that Intent could be used to characterize malware. For

instance, the listing in

Table 1 shows an excerpt of Intent actions

used in a legitimate banking application and the actions stipu-

lated in the infected version of the same application. In this

example, it is obvious that the infected version of the appli-

cation is subscribing to a notiﬁcation service that will be

triggered by the Android OS whenever the BOOT_COMPLETED

event occurs. In addition, SMS_RECEIVED allows the sub-

scriber to access all incoming SMS messages (

Fr atantonio et al.,

2016). While the former action is used by the malware as a form

of evasion, the latter is used to steal the Transaction Autho-

rization Code (TAC) (

Jain, 2015; Jiang and Zhou, 2013).

In this paper, we propose AndroDialysis

, a system that ana-

lyzes two different types of Intent objects, i.e., implicit and

explicit Intents. To evaluate the effectiveness of the proposed

system, we will compare our results with that from a base-

line detection system that uses similar le v el of granularity, and

we will then analyze the permissions usage. In summary, we

make the following contributions in this paper:

1. We propose the use of Android Intents (implicit and ex-

plicit) for detecting Android malware.The usage of Intents

will be extracted from both clean and infected applica-

tions in a dataset containing 7406 applications.

2. We extract permissions used by each application and ev alu-

ate the effectiveness of our approach when compared to

the use of permissions. W e also conduct experiment on com-

bination of Android permission and Android Intent to verify

that they are not overlapping.

3. We also compare the time taken to process permissions and

Intents in our experiments, as it is important to deter-

mine which component of the Android ﬁle is faster and more

efﬁcient. Furthermore, we calculated power consumption

of AndroDialysis and compared it with three popular

applications.

This paper is organized as follows:

Section 2 explains in

detail Android Intent, and presents a snippet code for im-

plicit and explicit Intents, respectively.

Section 3 discusses the

method of data collection and analysis of the dataset, analyz-

ing the permission and Intent.

Section 4 describes the proposed

system and its various modules and sub-modules. Section 5

presents details of experiments and the results obtained, as

well as evaluation of the proposed system.

Section 6 reviews

related works done by other researchers, and highlights their

weaknesses and strengths.

Section 7 concludes this paper by

summarizing main ﬁndings from this research.

2. Android intent

Intent is a complex messaging system in the Android plat-

form, and is considered as a security mechanism to hinder

applications from g aining access to other applications di-

rectly. Applications must have speciﬁc permissions to use

Intents. This is a way of controlling what applications can do

once they are installed in Android. Intent-ﬁlter – deﬁned in

AndroidManifest.xml ﬁle – announces the type of Intent the

application is capable of receiving.

Applications use Intents for intra-application and inter-

application communications. Intra-application communication

takes place inside an application between activities. An Android

application consists of many activities, each referring to buttons,

labels, and texts available on a single page of the application,

with which the user interacts. When interacting with the ap-

plication, the user moves from activity to activity (i.e. from page

to page). Android Intents assist developers in performing in-

teractions among the activities. Furthermore, Intents are used

in pushing data from one activity to another , carrying the results

at the end of any particular activity (

Aftab and Karim, 2014).

Inter-application communication is achieved when appli-

cations send messages or data to other applications through

Intent.The applications should also be able to receive data from

other applications. To receive Intents, applications must deﬁne

what type of Intent they accept in the Intent section of

AndroidManifest.xml ﬁle, as intent-ﬁlter. Many past studies

(

Chakradeo et al., 2013; Feng et al., 2014; Luoshi et al., 2013)

referred to this type of Intent. The actual communication

between two applications is done through the Binder, which

handles all inter-process communications. The Binder pro-

www.gdata-software.com.

Android Deep Intent Analysis.

Table 1 – Intent section of clean and infected versions of

Zurich Cantonal Bank application.

Clean version Infected version

android.intent.

action.MAIN

android.intent.action.MAIN

android.intent.action.BOOT_COMPLETED

android.provider.Telephony.SMS_RECEIVED

122 computers & security 65 (2017) 121–134

剩余14页未读，继续阅读

fengpan91

粉丝: 1
资源: 9

Android恶意软件检测：AndroDialysis分析Intent效能

Android的Intent实验

Android intent原理分析

EmailIntentBuilder：一个用于使用mailto：URI创建SendTo Intent的Android库

AndroidIntentFuzzer:iSec 合作伙伴 Android Intent Fuzzer 的分叉 (https)

Android Activity与Intent详解：生命周期及Intent使用

Android入门：理解与实践Intent操作

Android入门：Activity详解与Intent桥梁作用

Android对象传递：序列化、Intent与JSON详解

Android基础教程：mars老师讲解intent与控件使用

Android开发笔记：布局参数，Intent，Service与更多

最新资源