King's College London

Research portal

Anomaly-based Exploratory Analysis and Detection of Exploits in Android Mediaserver

Research output: Contribution to journalArticle

Guillermo Suárez-Tangil, Santanu Kumar Dash, Pedro Garcia-Teodoro, Jose Camacho, Lorenzo Cavallaro

Original languageEnglish
JournalIET Information Security
Early online date4 Apr 2018
DOIs
Publication statusE-pub ahead of print - 4 Apr 2018

Documents

  • Anomaly-based Exploratory Analysis _SUAREZ-TANGIL_Accepted2March2018_GREEN AAM

    2018iet_exploits.pdf, 463 KB, application/pdf

    11/06/2018

    Accepted author manuscript

    Other

    This paper is a postprint of a paper submitted to and accepted for publication in 'IET Information Security', and is subject to Institution of Engineering and Technology Copyright. The copy of record is
    available at the IET Digital Library.

King's Authors

Abstract

Smartphone platforms are becoming increasingly complex, which gives way to software vulnerabilities difficult to identify and that might allow malware developers to gain unauthorized privileges through technical exploitation. However, we maintain that these type of attacks indirectly renders a number of unexpected behaviors in the system that can be profiled. In this work we present CoME, an anomaly- based methodology aiming at detecting software exploitation in Android systems. CoME models the normal behavior of a given software component or service and it is capable of identifying any unanticipated behavior. To this end, we first monitor the normal operation of a given exploitable component through lightweight virtual introspection. Then, we use a multivariate analysis approach to estimate the normality model and detect anomalies. We evaluate our system against one of the most critical vulnerable and widely exploited services in Android, i.e., the mediaserver. Results show that our approach can not only provide a meaningful explanatory of discriminant features for illegitimate activities, but can also be used to accurately detect malicious software exploitations at runtime.

Download statistics

No data available

View graph of relations

© 2018 King's College London | Strand | London WC2R 2LS | England | United Kingdom | Tel +44 (0)20 7836 5454