Detecting Misuse of Google Cloud Messaging in Android Badware
| Autor: | Davide Ariu, Mansour Ahmadi, Giorgio Giacinto, Battista Biggio, Steven Arzt |
|---|---|
| Rok vydání: | 2016 |
| Předmět: |
0301 basic medicine
business.industry Computer science Botnet 020207 software engineering Cloud computing 02 engineering and technology Adware computer.software_genre Computer security 03 medical and health sciences 030104 developmental biology Server Push technology 0202 electrical engineering electronic engineering information engineering Operating system Command and control Malware Android (operating system) business computer |
| Zdroj: | SPSM@CCS |
| Popis: | Google Cloud Messaging (GCM) is a widely-used and reliable mechanism that helps developers to build more efficient Android applications; in particular, it enables sending push notifications to an application only when new information is available for it on its servers. For this reason, GCM is now used by more than 60\% among the most popular Android applications. On the other hand, such a mechanism is also exploited by attackers to facilitate their malicious activities; e.g., to abuse functionality of advertisement libraries in adware, or to command and control bot clients. However, to our knowledge, the extent to which GCM is used in malicious Android applications (badware, for short) has never been evaluated before. In this paper, we do not only aim to investigate the aforementioned issue, but also to show how traces of GCM flows in Android applications can be exploited to improve Android badware detection. To this end, we first extend Flowdroid to extract GCM flows from Android applications. Then, we embed those flows in a vector space, and train different machine-learning algorithms to detect badware that use GCM to perform malicious activities. We demonstrate that combining different classifiers trained on the flows originated from GCM services allows us to improve the detection rate up to 2.4%, while decreasing the false positive rate by 1.9%, and, more interestingly, to correctly detect 14 never-before-seen badware applications. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|