東華大學圖書館 |

Android Security via Static Analysis Techniques.

紀錄類型:	書目-電子資源 : Monograph/item
正題名/作者:	Android Security via Static Analysis Techniques./
作者:	Shen, Feng.
出版者:	Ann Arbor : ProQuest Dissertations & Theses, : 2018,
面頁冊數:	93 p.
附註:	Source: Dissertations Abstracts International, Volume: 80-04, Section: B.
Contained By:	Dissertations Abstracts International80-04B.
標題:	Information Technology. -
電子資源:	http://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=10930812
ISBN:	9780438456594

Android Security via Static Analysis Techniques.
Shen, Feng.

Android Security via Static Analysis Techniques. - Ann Arbor : ProQuest Dissertations & Theses, 2018 - 93 p.

Source: Dissertations Abstracts International, Volume: 80-04, Section: B.

Thesis (Ph.D.)--State University of New York at Buffalo, 2018.

This item must not be sold to any third party vendors.

Android is a popular platform designed for mobile devices. It consists of a customized Linux kernel, middleware, and a few core applications such as the Phone application. The middleware, commonly referred to as the Android framework, provides libraries and runtime services to applications. Applications in Android are written mainly in Java. Once compiled, Android transforms its applications into the Dalvik Executable (or DEX) format to minimize the memory footprint. Android uses a Java VM called Dalvik to execute DEX bytecode. Unlike other mobile OSes, Android has a unique permission mechanism. At development time, an application developer needs to explicitly request permissions by including them in an application configuration file (AndroidManifest.xml). We refer to this configuration file simply as the manifest in the remainder of the paper. At installation time, each user needs to review the permissions that the application requests and explicitly grant them. Android currently has over 130 permissions applications can request in API level 17. These permissions are API-oriented and access-based, i.e., permissions control access to sensitive APIs (referred to as protected APIs). Generally, an application can ask for permissions to use protected APIs for phone resources (e.g, storage, NFC, WiFi, etc.) or information available on the phone (e.g., contacts, location, call logs, etc.). While this permission mechanism is effective in pinpointing which sensitive APIs that an application uses, it does not provide any insight into what the application actually does with the APIs. Thus, our goal is to complement the existing mechanism by providing both behavioral information of a single application as well as the interactions among multiple applications. This thesis proposes Flow Permissions, an extension to the Android permission mechanism. Unlike the existing permission mechanism, our permission mechanism contains semantic information based on information flows. Flow Permissions allow users to examine and grant per-app information flows within an application (e.g., a permission for reading the phone number and sending it over the network) as well as cross-app information flows across multiple applications (e.g., a permission for reading the phone number and sending it to another application already installed on the user's phone). Our goal with Flow Permissions is to provide visibility into the holistic behavior of the applications installed on a user's phone. In order to support Flow Permissions on Android, we have developed a static analysis engine that detects flows within an Android application. We have also modified Android's existing permission mechanism and installation procedure to support Flow Permissions. Along with rapid growth of Android market, both Android malware and benignware have been evolved and become more complicated. Due to the diverse functionalities modern apps provide, the benign apps are more complex and it is common for a benign app to leverage multiple sensitive data sources for normal usage. Besides, malware apps disguise themselves as benign apps and hide the malicious code among benign code. It becomes more and more difficult to distinguish malware apps from benign apps. As a result, mobile malware detection continues to be a challenging problem, with security researchers estimating new malware being created and deployed every 4.2 seconds. To combat this problem, there have been many different proposed approaches and tools proposed in recent years. However, all these tools are evaluated on hand selected or private data sets, making comparison across tools and techniques very difficult. The only common comparison point is a public malware benchmark set gathered in 2012. To tackle these issues, this paper introduces a new benchmark app set for comparing and contrasting Android malware detection strategies. We begin with a survey and systematic study of 56,000 modern malware apps. We discuss current Android malware detection tools and synthesize a set of features/metrics that these tools leverage. Next, we statistically analyze our dataset based on these metrics. We consider the evolution of both malware and benign applications with respect to these metrics. Based on these studies and comparisons, we select a representative 1,000 malware apps and 1,000 benign apps as a modern app benchmark. (Abstract shortened by ProQuest.).

ISBN: 9780438456594Subjects--Topical Terms:

1030799
Information Technology.

Android Security via Static Analysis Techniques.
LDR:05515nmm a2200325 4500 001 2207827
005 20190923114238.5
008 201008s2018 ||||||||||||||||| ||eng d
020 $a 9780438456594
035 $a (MiAaPQ)AAI10930812
035 $a (MiAaPQ)buffalo:16053
035 $a AAI10930812
040 $a MiAaPQ $c MiAaPQ
100 1 $a Shen, Feng. $3 3434829
245 1 0 $a Android Security via Static Analysis Techniques.
260 1 $a Ann Arbor : $b ProQuest Dissertations & Theses, $c 2018
300 $a 93 p.
500 $a Source: Dissertations Abstracts International, Volume: 80-04, Section: B.
500 $a Publisher info.: Dissertation/Thesis.
500 $a Advisor: Ko, Steven Y.;Ziarek, Lukasz.
502 $a Thesis (Ph.D.)--State University of New York at Buffalo, 2018.
506 $a This item must not be sold to any third party vendors.
520 $a Android is a popular platform designed for mobile devices. It consists of a customized Linux kernel, middleware, and a few core applications such as the Phone application. The middleware, commonly referred to as the Android framework, provides libraries and runtime services to applications. Applications in Android are written mainly in Java. Once compiled, Android transforms its applications into the Dalvik Executable (or DEX) format to minimize the memory footprint. Android uses a Java VM called Dalvik to execute DEX bytecode. Unlike other mobile OSes, Android has a unique permission mechanism. At development time, an application developer needs to explicitly request permissions by including them in an application configuration file (AndroidManifest.xml). We refer to this configuration file simply as the manifest in the remainder of the paper. At installation time, each user needs to review the permissions that the application requests and explicitly grant them. Android currently has over 130 permissions applications can request in API level 17. These permissions are API-oriented and access-based, i.e., permissions control access to sensitive APIs (referred to as protected APIs). Generally, an application can ask for permissions to use protected APIs for phone resources (e.g, storage, NFC, WiFi, etc.) or information available on the phone (e.g., contacts, location, call logs, etc.). While this permission mechanism is effective in pinpointing which sensitive APIs that an application uses, it does not provide any insight into what the application actually does with the APIs. Thus, our goal is to complement the existing mechanism by providing both behavioral information of a single application as well as the interactions among multiple applications. This thesis proposes Flow Permissions, an extension to the Android permission mechanism. Unlike the existing permission mechanism, our permission mechanism contains semantic information based on information flows. Flow Permissions allow users to examine and grant per-app information flows within an application (e.g., a permission for reading the phone number and sending it over the network) as well as cross-app information flows across multiple applications (e.g., a permission for reading the phone number and sending it to another application already installed on the user's phone). Our goal with Flow Permissions is to provide visibility into the holistic behavior of the applications installed on a user's phone. In order to support Flow Permissions on Android, we have developed a static analysis engine that detects flows within an Android application. We have also modified Android's existing permission mechanism and installation procedure to support Flow Permissions. Along with rapid growth of Android market, both Android malware and benignware have been evolved and become more complicated. Due to the diverse functionalities modern apps provide, the benign apps are more complex and it is common for a benign app to leverage multiple sensitive data sources for normal usage. Besides, malware apps disguise themselves as benign apps and hide the malicious code among benign code. It becomes more and more difficult to distinguish malware apps from benign apps. As a result, mobile malware detection continues to be a challenging problem, with security researchers estimating new malware being created and deployed every 4.2 seconds. To combat this problem, there have been many different proposed approaches and tools proposed in recent years. However, all these tools are evaluated on hand selected or private data sets, making comparison across tools and techniques very difficult. The only common comparison point is a public malware benchmark set gathered in 2012. To tackle these issues, this paper introduces a new benchmark app set for comparing and contrasting Android malware detection strategies. We begin with a survey and systematic study of 56,000 modern malware apps. We discuss current Android malware detection tools and synthesize a set of features/metrics that these tools leverage. Next, we statistically analyze our dataset based on these metrics. We consider the evolution of both malware and benign applications with respect to these metrics. Based on these studies and comparisons, we select a representative 1,000 malware apps and 1,000 benign apps as a modern app benchmark. (Abstract shortened by ProQuest.).
590 $a School code: 0656.
650 4 $a Information Technology. $3 1030799
650 4 $a Computer science. $3 523869
690 $a 0489
690 $a 0984
710 2 $a State University of New York at Buffalo. $b Computer Science and Engineering. $3 1035503
773 0 $t Dissertations Abstracts International $g 80-04B.
790 $a 0656
791 $a Ph.D.
792 $a 2018
793 $a English
856 4 0 $u http://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=10930812