FloVasion: Towards Detection of non-sensitive Variable Based Evasive Information-Flow in Android Apps

References

• Smartphone OS market share, 2016. Available: http://www.idc.com/promo/smartphone-market-share/os
   Google Scholar
• P. Faruki, A. Bharmal, V. Laxmi, V. Ganmoor, M. S. Gaur, M. Conti, and M. Rajarajan, “Android security: A survey of issues, malware penetration, and defenses,” IEEE Commun. Surv. Tut., Vol. 17, no. 2, pp. 998–1022, 2015. doi: 10.1109/COMST.2014.2386139
   Web of Science ®Google Scholar
• W. Zhou, Y. Zhou, X. Jiang, and P. Ning. “Detecting repackaged smartphone applications in third-party android marketplaces,” in Proceedings of the second ACM conference on Data and Application Security and Privacy, ACM, 2012, pp. 317–326.
   Google Scholar
• W. You, B. Liang, J. Li, W. Shi, and X. Zhang. “Android implicit information flow demystified,” in Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, ASIA CCS ‘15, ACM, New York, NY, USA, 2015, pp. 585–590.
   Google Scholar
• M. Yoon, N. Salajegheh, Y. Chen, and M. Christodorescu. “PIFT: predictive information-flow tracking,” in Proceedings of the Twenty-First International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS ‘16, Atlanta, GA, USA, April 2–6, 2016, 2016, pp. 713–725.
   Google Scholar
• A. P. Felt, M. Finifter, E. Chin, S. Hanna, and D. Wagner. “A survey of mobile malware in the wild,” in Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices, ACM, 2011, pp. 3–14.
   Google Scholar
• M. C. Grace, W. Zhou, X. Jiang, and A. Sadeghi. “Unsafe exposure analysis of mobile in-app advertisements,” in Proceedings of the Fifth ACM Conference on Security and Privacy in Wireless and Mobile Networks, WISEC2012, Tucson, AZ, USA, April 16–18, 2012, 2012, pp. 101–112.
   Google Scholar
• A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. “Android permissions demystified,” in: Proceedings of the 18th ACM conference on Computer and communications security, ACM, 2011, pp. 627–638.
   Google Scholar
• M. I. Gordon, D. Kim, J. H. Perkins, L. Gilham, N. Nguyen, and M. C. Rinard. “Information flow analysis of android applications in droidsafe,” in 22nd Annual Network and Distributed System Security Symposium, NDSS 2015, San Diego, California, USA, February 8–11, 2015, 2015.
   Google Scholar
• S. Arzt, S. Rasthofer, and E. Bodden. Susi: A tool for the fully automated classification and categorization of android sources and sinks, 2013.
   Google Scholar
• L. Sinha, S. Bhandari, P. Faruki, M. S. Gaur, V. Laxmi, and M. Conti. “Flowmine: Android app analysis via data flow,” in 13th IEEE Annual Consumer Communications & Networking Conference, CCNC 2016, LasVegas, NV, USA, January 9–12, 2016, pp. 435–441.
   Google Scholar
• S. Hong, and J. H. Park. Information security and cryptology – ICISC2016 - 19th International Conference, Seoul, South Korea, November 30–December 2, 2016, Revised Selected Papers, Vol. 10157 of Lecture Notesin Computer Science, 2017.
   Google Scholar
• S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. Le Traon, D. Octeau, and P. McDaniel. “Flowdroid: Precise context, flow, field, object sensitive and lifecycle-aware taint analysis for android apps,” in Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI ‘14, New York, NY, USA, 2014, pp. 259–269.
   Google Scholar
• W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth. “Taintdroid: An information-flow tracking system for real-time privacy monitoring on smartphones,” in Proceedings of the 9th USENIX Conference on Operating Systems Design and Implementation, OSDI’10, USENIX Association, Berkeley, CA, USA, 2010, pp. 393–407.
   Google Scholar
• B. Lokhande, and S. Dhavale. “Overview of information flow tracking techniques based on taint analysis for android,” in: 2014 International Conference on Computing for Sustainable Global Development (INDIACom), 2014, pp. 749–753.
   Google Scholar
• P. Faruki. “Techniques for analysis and detection of android malware,” Ph.D. thesis, Computer Science and Engineering, Malaviya National Institute of Technology Jaipur, MNIT Digital Library, 3 2016.
   Google Scholar
• V. Avdiienko, K. Kuznetsov, A. Gorla, A. Zeller, S. Arzt, S. Rasthofer, and E. Bodden. “Mining apps for abnormal usage of sensitive data,” in Proceedings of the 37th International Conference on Software Engineering -Volume 1, ICSE ‘15, IEEE Press, Piscataway, NJ, USA, 2015, pp. 426–436.
   Google Scholar
• J. A. Clause, W. Li, and A. Orso. “Dytan: a generic dynamic taint analysis framework,” in Proceedings of the ACM/SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2007, London, UK, July 9–12, 2007, 2007, pp. 196–206.
   Google Scholar
• FloVasion apps at droidbench test suite. Available: http://github.com.bvbld/DroidBench
   Google Scholar
• AVL, 2018 first rank android antivirus. Available: http://www.viralhax.com/best-antivirus-for-android/
   Google Scholar
• S. Rasthofer, S. Arzt, M. Miltenberger, and E. Bodden. “Harvesting runtime values in android applications that feature anti-analysis techniques,” in 23nd Annual Network and Distributed System Security Symposium, NDSS 2016, San Diego, California, USA, February 21–24, 2016.
   Google Scholar
• Bharat Buddhdev et. al, DroidBench Testsuite, Available: https://github.com/secure-softwareengineering/DroidBench/pull/34> [Last Access Date: 02-Jan-2020]
   Google Scholar
• L. Li, T. F. Bissyandé, D. Octeau, and J. Klein. “Droidra: taming reflection tosupport whole-program analysis of android apps,” in Proceedings of the25th International Symposium on Software Testing and Analysis, ISSTA2016, Saarbrücken, Germany, July 18–20, 2016, 2016, pp. 318–329.
   Google Scholar
• Fakeinstaller android malware. Available: https://securingtomorrow.mcafee.com/mcafee-labs/fakeinstaller-leads-the-attack-on-android-phones/
   Google Scholar
• J.-T. Chan, and W. Yang, “Advanced obfuscation techniques for java bytecode,” J. Syst. Softw., Vol. 71, no. 1, pp. 1–10, 2004. doi: 10.1016/S0164-1212(02)00066-3
   Web of Science ®Google Scholar
• C. Collberg, C. Thomborson, and D. Low. “Manufacturing cheap, resilient, and stealthy opaque constructs,” in Proceedings of the 25th ACM SIGPLANSIGACT Symposium on Principles of Programming Languages, POPL’98, ACM, New York, NY, USA, 1998, pp. 184–196.
   Google Scholar
• R. Wartell, V. Mohan, K. W. Hamlen, and Z. Lin. “Binary stirring: self-randomizing instruction addresses of legacy x86 binary code,” in the ACM Conference on Computer and Communications Security, CCS’12,Raleigh, NC, USA, October 16–18, 2012, 2012, pp. 157–168.
   Google Scholar
• L. Xue, Y. Zhou, T. Chen, X. Luo, and G. Gu. Malton: Towards on-device non-invasive mobile malware analysis for ART, in: 26th USENIX Security Symposium (USENIX Security 17), USENIX Association, Vancouver, BC, 2017, pp. 289–306.
   Google Scholar
• M. Sun, T. Wei, and J. C. Lui. “Taintart: A practical multi-level information-flow tracking system for android runtime,” in Proceedings of the 2016ACM SIGSAC Conference on Computer and Communications Security, CCS ‘16, 2016, pp. 331–342.
   Google Scholar
• S. Sakamoto, K. Okuda, R. Nakatsuka, and T. Yamauchi, “Droidtrack: tracking and visualizing information diffusion for preventing information leakage on android,” Journal of Internet Services and Information Security (JISIS, Vol. 4, no. 2, pp. 55–69, 2014.
   Google Scholar
• Requesting permissions — android developers. Available: https://developer.android.com/guide/topics/permissions/requesting.html
   Google Scholar
• M. Zheng, M. Sun, and J. C. S. Lui. Droidtrace: A ptrace based android dynamic analysis system with forward execution capability, 2014 International Wireless Communications and Mobile Computing Conference (IWCMC), 2014, pp. 128–133.
   Google Scholar
• N. Chaabouni, M. Mosbah, A. Zemmari, C. Sauvignac, and P. Faruki, “Network intrusion detection for IoT security based on learning techniques,” IEEE Communication Surveys and Tutorials, Vol. 21, no. 3, pp. 2671–2701, 2019. doi: 10.1109/COMST.2019.2896380
   Web of Science ®Google Scholar
• P. Faruki, V. Laxmi, M. S. Gaur, and P. Vinod. “Behavioural detection with api call-grams to identify malicious pe files,” in: Proceedings of the First International Conference on Security of Internet of Things, SecurIT ‘12, 2012, pp. 85–91.
   Google Scholar
• P. Faruki, V. Kumar, B. Ammar, M. S. Gaur, V. Laxmi, M. Conti, “Platform neutral sandbox for analyzing malware and resource hogger apps,” in International conference on security and privacy in communication networks, J. Tian, J. Jing, M. Srivatsa Eds. Cham: Springer International Publishing, 2015, pp. 556–560.
   Google Scholar
• P. Faruki, V. Laxmi, V. Ganmoor, M. S. Gaur, and A. Bharmal. “Droidolytics: Robust feature signature for repackaged android apps on offcial andthird party android markets,” in 2013 2nd International Conference onAdvanced Computing, Networking and Security, Mangalore, India, December15–17, 2013, 2013, pp. 247–252.
   Google Scholar
• P. Faruki, H. Fereidooni, V. Laxmi, M. Conti, and M. S. Gaur. Android code protection via obfuscation techniques: Past, present and future directions, CoRR abs/1611.10231.
   Google Scholar
• N. Chaabouni, M. Mosbah, A. Zemmari, C. Sauvignac, and P. Faruki, “Network intrusion detection for IoT security based on learning techniques,” IEEE Communication Surveys and Tutorials, Vol. 21, no. 3, pp. 2671–2701, 2019. doi: 10.1109/COMST.2019.2896380
   Web of Science ®Google Scholar
• H. Okhravi, S. Bak, S. T. King, “Design, implementation and evaluation of covert channel attacks,” in: 2010 IEEE International Conference on Technologies for Homeland Security (HST), 2010, pp. 481–487.
   Google Scholar
• L. K. Yan, and H. Yin. “Droidscope: Seamlessly reconstructing the OS and Dalvik Semantic views for Dynamic Android Malware Analysis,” in: Proceedings of the 21st USENIX Security Symposium, 2012.
   Google Scholar
• O. Mirzaei, G. Suarez-Tangil, J. Tapiador, and J. M. de Fuentes. “Triflow:Triaging android applications using speculative information flows,” in Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, ASIA CCS ‘17, ACM, New York, NY, USA, 2017, pp. 640–651.
   Google Scholar
• W. Enck, M. Ongtang, and P. McDaniel. “On lightweight mobile phone application certification,” in: Proceedings of the 16th ACM Conference on Computer and Communications Security, CCS ‘09, ACM, New York, NY, USA, 2009, pp. 235–245.
   Google Scholar
• M. C. Grace, Y. Zhou, Q. Zhang, S. Zou, and X. Jiang. “Riskranker: scalable and accurate zero-day android malware detection,” in The 10th International Conference on Mobile Systems, Applications, and Services, MobiSys’12, Ambleside, United Kingdom - June 25–29, 2012, 2012, pp.281–294.
   Google Scholar
• Y. Jing, G. Ahn, Z. Zhao, H. Hu, “Riskmon: continuous and automated risk assessment of mobile applications,” in: Fourth ACM Conference on Data and Application Security and Privacy, CODASPY’14, San Antonio, TX, USA - March 03–05, 2014, 2014, pp. 99–110.
   Google Scholar
• T. Yu, G. Danezis, and V. D. Gligor. The ACM conference on computer and communications security, CCS’12, Raleigh, NC, USA, October 16–18, 2012, ACM, 2012.
   Google Scholar
• B. P. Sarma, N. Li, C. S. Gates, R. Potharaju, C. Nita-Rotaru, and I. Molloy. Android permissions: a perspective combining risks and benefits, in: 17th ACM Symposium on Access Control Models and Technologies, SACMAT ‘12, Newark, NJ, USA - June 20–22, 2012, 2012, pp. 13–22.
   Google Scholar
• P. Faruki, A. Zemmari, M. S. Gaur, V. Laxmi, and M. Conti. “MimeoDroid: large scale dynamic app analysis on cloned devices via machine learning classifiers,” in 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshop (DSN-W), 2016, pp. 60–65.
   Google Scholar
• Y. Acar, M. Backes, S. Bugiel, S. Fahl, P. D. McDaniel, and M. Smith. Sok: lessons learned from android security research for appified software platforms, in: IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22–26, 2016, 2016, pp. 433–451.
   Google Scholar
• V. Rastogi, Y. Chen, and X. Jiang, “Catch me if you can: evaluating android anti-malware against transformation attacks,” IEEE Trans. Information Forensics and Security, Vol. 9, no. 1, pp. 99–108, 2014. doi: 10.1109/TIFS.2013.2290431
   Web of Science ®Google Scholar
• P. Faruki, V. Laxmi, A. Bharmal, M. S. Gaur, and V. Ganmoor, “Androsimilar: robust signature for detecting variants of android malware,” J. Inf. Sec.Appl, Vol. 22, pp. 66–80, 2015.
   Web of Science ®Google Scholar
• D. Fu, and R. Rheinans-Yoo. Simpletimingpwn: evading information flowanalysis via an extremely simple timing channel. Available: http://www.danfu.org/files/SimpleTimingPwn.pdf.
   Google Scholar
• N. Vachharajani, M. J. Bridges, J. Chang, R. Rangan, G. Ottoni, J. A. Blome, G. A. Reis, M. Vachharajani, and D. I. August. Rifle: an architecturalframework for user-centric information-flow security, in: Microarchitecture,2004. MICRO-37 2004. 37th International Symposium on, IEEE, 2004, pp. 243–254.
   Google Scholar