Android malware detection boosted by university research

Researchers from North Carolina State University have found a way to monitor for Android malware with very low overhead

North Carolina State University's Practical Root Exploit Containment captures the performance characteristics of Android apps to spot malware

North Carolina State University's Practical Root Exploit Containment captures the performance characteristics of Android apps to spot malware

With smartphones and tablets increasingly at risk from malware, researchers from North Carolina State University have devised a new and potentially better way to detect it on Android devices.

The tool they have developed, called Practical Root Exploit Containment (PREC), is trained to uncover aberrant code written in the C programming language, the language in which they say most malicious Android code is written.

PREC looks for root exploits, in which a program gains system administration access rights to the entire device, which a malicious hacker can use with ill intent.

The researchers detailed their work, captured in the paper "PREC: Practical Root Exploit Containment for Android Devices," at the Association for Computing Machinery's Conference on Data and Application Security and Privacy, which was held this week in San Antonio, Texas.

PREC uses a well-known technique for identifying malicious code, called anomaly detection. Anomaly detection compares the expected behavior of an application with how it actually behaves when it is running on a device, in terms of the system calls it makes.

PREC is unique in that it can identify calls made to native C code from a Java program, and check to see if such actions fit into the application's profile for typical usage. The bulk of software programs for Android are written in Java, which other experimental anomaly detectors have focused on.

"We've observed that most all of the existing exploits are coming from C code," said Helen Gu, an associate professor of computer science at NCSU who was involved in the work. "It's hard, if not impossible, to launch exploits in Java code, because it has to go through the virtual machine."

With this approach, PREC has been able to reduce the number of false identifications by an order of magnitude, compared to other anomaly detectors. Focusing on native C code gives PREC a more accurate model of how attacks would differ from standard operations.

The researchers tested a prototype against 150 Android apps, of which 140 were benign and 10 contained root exploits. The experiments were run on a Google Galaxy Nexus and on an emulator. PREC was able to identify all of the root exploits with a minimum number of false alarms.

What the researchers hope to do is convince app stores, such as the Google Play Store, to create a database describing the typical performance characteristics of all their apps. They could use PREC to build these assessments. Then when a user downloads a new app, the Android device can also download the PREC execution profile for that application, and use that profile to monitor for any unusual activity coming from the app.

While app marketplace operators such as Apple or Google already screen the apps submitted to their stores, malware programmers have learned how to bury their code within an app so it doesn't execute until after the program has been downloaded, Gu said.

The researchers chose Android over Apple's iOS because the Android kernel, which is Linux, is open source, whereas Apple keeps the kernel for iOS under wraps. They built PREC as a module that can be compiled into the kernel.

PREC is not the only Android malware detector based on anomaly detection that researchers have created. Crowdroid uses a crowd-sourcing model of determining routine app behavior, and Paranoid Android offloads some of the detection duties to servers.

Both of those detectors require far more processing power on the portable device, compare to PREC, according to the NCSU researchers. Running PREC typically incurs about 3 percent overhead on the system, compared to the 15 to 30 percent overhead incurred by Crowdroid and Android.

IBM, Google, the U.S. National Science Foundation and the U.S. Army funded the research.

Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab's e-mail address is Joab_Jackson@idg.com

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags GoogleAndroid OS

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Joab Jackson

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?