Mining apps for abnormal usage of sensitive data

AutorAvdiienko, Vitalii; Kuznetsov, Konstantin; Gorla, Alessandra; Zeller, Andreas; Arzt, Steven; Rasthofer, Siegfried; Bodden, Eric
ArtConference Paper
AbstraktWhat is it that makes an app malicious? One important factor is that malicious apps treat sensitive data differently from benign apps. To capture such differences, we mined 2,866 benign Android applications for their data flow from sensitive sources, and compare these flows against those found in malicious apps. We find that (a) for every sensitive source, the data ends up in a small number of typical sinks; (b) these sinks differ considerably between benign and malicious apps; (c) these differences can be used to flag malicious apps due to their abnormal data flow; and (d) malicious apps can be identified by their abnormal data flow alone, without requiring known malware samples. In our evaluation, our MUDFLOW prototype correctly identified 86.4% of all novel malware, and 90.1% of novel malware leaking sensitive data.
KonferenzInternational Conference on Software Engineering (ICSE) <37, 2015, Florence>
ReferenzInstitute of Electrical and Electronics Engineers -IEEE-: IEEE/ACM 37th IEEE International Conference on Software Engineering, ICSE 2015. Proceedings. Vol.1, Pt.1: Florence, Italy, 16 - 24 May 2015. Piscataway, NJ: IEEE, 2015, pp. 426-436