MetaDroid: A Framework for Automatic Identification of Malicious Applications Through App-Market Metadata

Add to your list(s) Download to your calendar using vCal

• Ilias Leontiadis (University of Cambridge)
• Tuesday 11 December 2012, 13:00-14:00
• Computer Laboratory, William Gates Building, Room FW11.

If you have a question about this talk, please contact Ionel Gog.

The increasing popularity of modern smartphones can be largely attributed to the wide range of third-party mobile applications easily downloadable and installable through App-stores. However, allowing users to install third party applications also raises privacy and security concerns: applications often ask for permissions that reveal private information such as the user’s location, contacts and messages without the actual need for these data to be revealed to the developers. Furthermore, with the number of available mobile applications growing, so is the presence of malicious applications which, beyond data stealing, could impact the user’s nances by for example sending text messages to premium rate numbers.

While the detection of the maliciousness or the level of overprivileged permission set of an application is possible through static or run-time analysis of the application binaries, techniques that are able to assess the risks as soon as applications appear in the market are still lacking. In this work, we present an approach to the automatic detection of malicious applications that solely exploits information included in the application roles and permission sets. We devise a machine learning framework and evaluate it using two full snapshots of the Google Play store containing more than 700,000 applications, as well as publicized datasets of malicious applications discovered before October 2012. Our results indicate that by examining the market meta-information we can automatically identify up to 93% of possible threats as soon as they enter the market.

This talk is part of the Computer Laboratory NetOS Group Talklets series.

This talk is included in these lists:

• All Talks (aka the CURE list)
• Cambridge talks
• Computer Laboratory NetOS Group Talklets
• Computer Laboratory, William Gates Building, Room FW11
• Department of Computer Science and Technology talks and seminars
• Interested Talks
• School of Technology
• Trust & Technology Initiative - interesting events
• bld31

Note that ex-directory lists are not shown.