Towards automated Android app collusion detection

Android OS supports multiple communication methods between apps. This opens the possibility to carry out threats in a collaborative fashion, c.f. the Soundcomber example from 2011. In this paper we provide a concise definition of collusion and report on a number of automated detection approaches, developed in co-operation with Intel Security.

N-opcode analysis for android malware classification and categorization

Malware detection is a growing problem particularly on the Android mobile platform due to its increasing popularity and accessibility to numerous third party app markets. This has also been made worse by the increasingly sophisticated detection avoidance techniques employed by emerging malware families. This calls for more effective techniques for detection and classification of Android malware. Hence, in this paper we present an n-opcode analysis based approach that utilizes machine learning to classify and categorize Android malware. This approach enables automated feature discovery that eliminates the need for applying expert or domain knowledge to define the needed features. Our experiments on 2520 samples that were performed using up to 10-gram opcode features showed that an f-measure of 98% is achievable using this approach.

Dynalog: an automated dynamic analysis framework for characterizing android applications

Android is becoming ubiquitous and currently has the largest share of the mobile OS market with billions of application downloads from the official app market. It has also become the platform most targeted by mobile malware that are becoming more sophisticated to evade state-of-the-art detection approaches. Many Android malware families employ obfuscation techniques in order to avoid detection and this may defeat static analysis based approaches. Dynamic analysis on the other hand may be used to overcome this limitation. Hence in this paper we propose DynaLog, a dynamic analysis based framework for characterizing Android applications. The framework provides the capability to analyse the behaviour of applications based on an extensive number of dynamic features. It provides an automated platform for mass analysis and characterization of apps that is useful for quickly identifying and isolating malicious applications. The DynaLog framework leverages existing open source tools to extract and log high level behaviours, API calls, and critical events that can be used to explore the characteristics of an application, thus providing an extensible dynamic analysis platform for detecting Android malware. DynaLog is evaluated using real malware samples and clean applications demonstrating its capabilities for effective analysis and detection of malicious applications.

Extracellular cathepsin S and intracellular caspase 1 activation are surrogate biomarkers of particulate-induced lysosomal disruption in macrophages

BACKGROUND: Particulate matter has been shown to stimulate the innate immune system and induce acute inflammation. Therefore, while nanotechnology has the potential to provide therapeutic formulations with improved efficacy, there are concerns such pharmaceutical preparations could induce unwanted inflammatory side effects. Accordingly, we aim to examine the utility of using the proteolytic activity signatures of cysteine proteases, caspase 1 and cathepsin S (CTSS), as biomarkers to assess particulate-induced inflammation.

METHODS: Primary peritoneal macrophages and bone marrow-derived macrophages from C57BL/6 mice and ctss(-/-) mice were exposed to micro- and nanoparticulates and also the lysosomotropic agent, L-leucyl-L-leucine methyl ester (LLOME). ELISA and immunoblot analyses were used to measure the IL-1β response in cells, generated by lysosomal rupture. Affinity-binding probes (ABPs), which irreversibly bind to the active site thiol of cysteine proteases, were then used to detect active caspase 1 and CTSS following lysosomal rupture. Reporter substrates were also used to quantify the proteolytic activity of these enzymes, as measured by substrate turnover.

RESULTS: We demonstrate that exposure to silica, alum and polystyrene particulates induces IL-1β release from macrophages, through lysosomal destabilization. IL-1β secretion positively correlated with an increase in the proteolytic activity signatures of intracellular caspase 1 and extracellular CTSS, which were detected using ABPs and reporter substrates. Interestingly IL-1β release was significantly reduced in primary macrophages from ctss(-/-) mice.

CONCLUSIONS: This study supports the emerging significance of CTSS as a regulator of the innate immune response, highlighting its role in regulating IL-1β release. Crucially, the results demonstrate the utility of intracellular caspase 1 and extracellular CTSS proteolytic activities as surrogate biomarkers of lysosomal rupture and acute inflammation. In the future, activity-based detection of these enzymes may prove useful for the real-time assessment of particle-induced inflammation and toxicity assessment during the development of nanotherapeutics.

Towards a threat assessment framework for apps collusion

App collusion refers to two or more apps working together to achieve a malicious goal that they otherwise would not be able to achieve individually. The permissions based security model (PBSM) for Android does not address this threat, as it is rather limited to mitigating risks due to individual apps. This paper presents a technique for assessing the threat of collusion for apps, which is a first step towards quantifying collusion risk, and allows us to narrow down to candidate apps for collusion, which is critical given the high volume of Android apps available. We present our empirical analysis using a classified corpus of over 29000 Android apps provided by Intel Security.

Fuzzy logic-based implicit authentication for mobile access control

In order to address the increasing compromise of user privacy on mobile devices, a Fuzzy Logic based implicit authentication scheme is proposed in this paper. The proposed scheme computes an aggregate score based on selected features and a threshold in real-time based on current and historic data depicting user routine. The tuned fuzzy system is then applied to the aggregated score and the threshold to determine the trust level of the current user. The proposed fuzzy-integrated implicit authentication scheme is designed to: operate adaptively and completely in the background, require minimal training period, enable high system accuracy while provide timely detection of abnormal activity. In this paper, we explore Fuzzy Logic based authentication in depth. Gaussian and triangle-based membership functions are investigated and compared using real data over several weeks from different Android phone users. The presented results show that our proposed Fuzzy Logic approach is a highly effective, and viable scheme for lightweight real-time implicit authentication on mobile devices.