AspectDroid

Toward a more dependable hybrid analysis of android malware using aspect-oriented programming

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.
\n
\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.
\n
\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.
\n
\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

An empirical study of collaborative model and its security risk in Android

Android applications need to request permissions to access sensitive personal data and system resources. Certain permissions may be requested by Android malware to facilitate their malicious activities. In this paper, we present ARP-Miner, an algorithm based on association rule mining that can automatically extract Android Risk Patterns indicating possible malicious activities of apps. The experimental results show that ARP-Miner can efficiently discover risk rules associating permission request patterns with malicious activities. Examples to relate the extracted risk patterns with behaviors of typical malware families are presented. It is also shown that the extracted risk patterns can be used for malware detection.

This paper explores the problem of identifying malicious code sections in applications for the Android. A method for analyzing Android applications is proposed, based on applying of static analysis using control flow graphs and data flow graphs. The paper formally describes the dependency relationships that are used to construct graphs, and also describes an algorithm that allows to identify malicious sections of code using the received graphs. The results of an experimental evaluation of the effectiveness of the proposed method are presented, demonstrated a high probability of detecting malicious portions of the code of Android applications.

With the popularity of Android devices and the improvement of intelligence of mobile phones, our life becomes more and more convenient. Meanwhile, the popularity brings new challenges to Android security, especially the application vulnerabilities. These vulnerabilities may lead to sensitive data leaks. To address this issue, researchers have proposed methods to detect the vulnerabilities in Android applications. But most of them only detect one type of vulnerabilities. In this paper, we propose VDetector, a data flow tracking based method for detecting three types of vulnerabilities, Log Leak Vulnerability, Content Provider Vulnerability, and Inter-Components Communication Vulnerability. Based on the reasons of the three types of vulnerabilities, VDetector transforms the detection into the data flow tracking. We first extend the source and sink sets corresponding to the vulnerabilities. Then we explore whether there are paths between the sources and the sinks. If there are paths, it indicates that the vulnerabilities exist. At last, three datasets are used for experiments and the result indicates that VDetector effectively finds such android application vulnerabilities above.

Instrumentation and controls play a significant role in preventing process safety incidents. Ensuring the reliability of instrumented systems can be challenging due to the large number of devices that need to perform when called upon. The International Society of Automation (ISA) 84 committee has issued a series of documents over the last 30 years covering how to design, operate, and maintain instrumentation and control systems in process safety applications. The requirements for safety instrumented systems (SIS) are determined by ANSI/ISA 61511. The question for many practitioners is what standard addresses requirements for designing and managing instrumented protection layers other than SIS. An emerging standard, ISA 84.91.03, pulls together several regulations and current industry practices for managing safety‐related instrumented systems. Since the term basic process control system is often confused with the plant's primary distributed control system, the new standard uses the term “low‐integrity protection layer” to cover any instrumented protection layer that is used to meet a company's risk tolerance criteria but will not be implemented as SIS. This paper provides an overview of ISA 84.91.03 to raise awareness of the requirements of the new standard and discuss the impact on typical process industry practices.

Components within a system may be related to one another in two primary ways: in either a serial or a parallel configuration. The other way associated system components is developed on the basis of series and parallel systems. Although some complex systems cannot generate from series and parallel system, the result of this paper is helpful to study more complex gradual system reliability problems. In this paper, a hypothesis is formed that the reliability of the components of the system is variable with time. Then, the reliability of the system is gradual, on condition that the components are combined by some related way. If the system reliability analysis is based on the static analysis, it may be different from the actual value of the reliability because the components of the system would afford stochastic load or generate degradation of performance. The method considering the random resistant degradation may make the result of reliability accurate. In this paper, gamma process is used to simulate the use of the components of the system, as deterioration is generally uncertain and non-decreasing, it can best be regarded as a gamma process. Combining the Edgeworth series method and forth moment technique, the method that calculate the reliability of series and parallel system is deduced. Then, the reliability of different systems and the failure rate of the systems are illustrated with time. The results show that the reliability of the systems will decline in different ways with time.

Smartphones have become the important part of our lives. We carry Smartphones to carry out a wide range of services ranging from social networking to internet banking. Security of our private data stored in our smartphone is very important as there are thousands of applications that we can download and install from different app stores, without checking the authenticity of these apps. In order to enhance the security of our smart phones we propose and implement a novel algorithm which can stop the access of the malicious apps at runtime. The algorithm keeps track of all the apps running in the background and monitors their activity. If the app tries to do something which it was not supposed to do it automatically informs the novice user about the malicious activity. We proposed the algorithm for Android based Smartphones.

PurposeThe paper presents reliability, maintainability and life cycle cost (LCC) analysis of a computerized numerical control (CNC) turning center which is manufactured and used in India. The purpose of this paper is to identify the critical components/subsystems from reliability and LCC perspective. The paper further aims at improving reliability and LCC by implementing reliability-improvement methods.Design/methodology/approachThis paper uses a methodology for the reliability analysis based on the assessment of trends in maintenance data. The data required for reliability and LCC analysis are collected from the manufacturers and users of CNC turning center over a period of eight years. ReliaSoft’s Weibull++9 software has been used for verifying goodness of fit and estimating parameters of the distribution. The LCC of the system is estimated for five cost elements: acquisition cost, operation cost, failure cost, support cost and net salvage value.FindingsThe analysis shows that the spindle bearing, spindle belt, spindle drawbar, insert, tool holder, drive battery, hydraulic hose, lubricant hose, coolant hose and solenoid valve are the components with low reliability. With certain design changes and implementation of reliability-based maintenance policies, system reliability is improved, especially during warranty period. The reliability of the CNC turning center is improved by nearly 45 percent at the end of warranty period and system mean time between failure is increased from 15,000 to 17,000 hours. The LCC analysis reveals that the maintenance cost, operating cost and support costs dominate the LCC and contribute to the tune of 87 percent of the total LCC.Research limitations/implicationsThe proposed methodology provides an excellent tool that can be utilized in industries, where safety, reliability, maintainability and availability of the system play a vital role. The approach may be improved by collecting data from more number of users of the CNC turning centers.Practical implicationsThe approach presented in this paper is generic and can be applied to analyze the repairable systems. A real case study is presented to show the applicability of the approach.Originality/valueThe proposed methodology provides a practical approach for the analysis of time-to-failure and time-to-repair data based on the assessment of trends in the maintenance data. The methodology helps in selecting a proper approach of the analysis such as Bayesian method, parametric methods and nonparametric methods.

Statistics show that more than 80 applications are installed on each android smartphone. Vulnerability research on Android applications is of critical importance. Recently, academic researchers mainly focus on single bug patterns, while few of them investigate the relations between multiple bugs. Industrial researchers proposed a series of logic exploit chains leveraging multiple logic bugs. However, there is no general model to evaluate the chaining abilities between bugs. This paper presents a formal model to elucidate the relations between multiple bugs in Android applications. To prove the effectiveness of the model, we design and implement a prototype system named AppChainer. AppChainer automatically identifies attack surfaces of Android applications and investigates whether the payloads entering these attack surfaces are “chainable”. Experimental results on 2138 popular Android applications show that AppChainer is effective in identifying and chaining attacker-controllable payloads. It identifies 14467 chainable payloads and constructs 5458 chains both inside a single application and among various applications. The time cost and resource consumption of AppChainer are also acceptable. For each application, the average analysis time is 317 s, and the average memory consumed is 2368 MB. Compared with the most relevant work Jandroid, the experiment results on our custom DroidChainBench show that AppChainer outperforms Jandroid at the precision rate and performs equally with Jandroid at the recall rate.

PurposeDegraded failures and sudden critical failures are quite prevalent in industries. Degradation processes commonly belong to Weibull family and critical failures are found to follow exponential distribution. Therefore, it becomes important to carry out reliability and availability analysis of such systems. From the reported literature, it is learnt that models are available for the situations where the degraded failures as well as critical failures follow exponential distribution. The purpose of this paper is to present models suitable for reliability and availability analysis of systems where the degradation process follows Weibull distribution and critical failures follow exponential distribution.Design/methodology/approachThe research uses Semi-Markov modeling using the approach of method of stages which is suitable when the failure processes follow Weibull distribution. The paper considers various states of the system and uses state transition diagram to present the transition of the system among good state, degraded state and failed state. Method of stages is used to convert the semi-Markov model to Markov model. The number of stages calculated in Method of stages is usually not an integer value which needs to be round off. Method of stages thus suffers from the rounding off error. A unique approach is proposed to arrive at failure rates to reduce the error in method of stages. Periodic inspection and repairs of systems are commonly followed in industries to take care of system degradation. This paper presents models to carry out reliability and availability analysis of the systems including the case where degraded failures can be arrested by appropriate inspection and repair.FindingsThe proposed method for estimating the degraded failure rate can be used to reduce the error in method of stages. The models and the methodology are suitable for reliability and availability analysis of systems involving degradation which is very common in systems involving moving parts. These models are very suitable in accurately estimating the system reliability and availability which is very important in industry. The models conveniently cover the cases of degraded systems for which the model proposed by Hokstad and Frovig is not suitable.Research limitations/implicationsThe models developed consider the systems where the repair phenomenon follows exponential and the failure mechanism follows Weibull with shape parameter greater than 1.Practical implicationsThese models can be suitably used to deal with reliability and availability analysis of systems where the degradation process is non-exponential. Thus, the models can be practically used to meet the industrial requirement of accurately estimating the reliability and availability of degradable systems.Originality/valueA unique approach is presented in this paper for estimating degraded failure rate in the method of stages which reduces the rounding error. The models presented for reliability and availability analyses can deal with degradable systems where the degradation process follows Weibull distribution, which is not possible with the model presented by Hokstad and Frovig.

According to the piezoelectric material damage theory and the fracture criterion based on damage theory, which has been established by Yang etc., reliability analysis is carried through about a damaged piezoelectric truss. Taken the mechanical damage extension force, electric damage extension force and cross-section area of bar element as stochastic variables, the expression of safety margins of bar element has been proposed. Based on those, the SFEM and PNET method are introduced to solve the reliability index of the structural system. The result indicates positive applied and negative applied electric field have great effect on the reliability of the system, which provides the basis to control the reliability of structural system. Finally, a calculation example is carried out under the conditions of positive applied electric field, negative applied electric field and no electric field. Meantime, the quantification results of the reliability index under three conditions are compared with each other.

In this study, long term component reliability analysis of PV system is performed using Markov method. Four major components for evaluation of the system are considered with 16 different states to evaluate a PV system as a package with one reliability index. The probability analysis for each state shows that although at very first years the states of combination of multiple failures are negligible, after several years of operation, all states are effective in the reliability of the system. Based on Markov modeling given in the study and actual failure and repair rates of components, the reliability analysis shows that the reliability of the system decreases from 0.99 to 0.81 in 20 years. The initial condition for each year is gained from the final condition of the previous year. The annual value of the reliability of PV system makes the designers plan major maintenance and switching based on cost and load. 1

The optimal design of multidisciplinary systems under uncertainty involves three types of iterative analyses- multidisciplinary analyses, reliability analyses, and optimization. If these processes are carried out in a nested manner in reliability based multidisciplinary design optimization (RBMDO), the computational expense can be enormous. Computationally efficient simultaneous analysis and design (SAND) or All-AtOnce methods have been developed earlier for deterministic MDO. Single loop RBDO methods have also been developed to integrate reliability analysis and optimization in a single loop. This paper develops a novel formulation of RBMDO problems with both system and component level reliability constraints. The formulation allows for solution with a single design optimization loop by using the KKT optimality conditions of the first-order reliability method (FORM) as constraints in the design optimization along with disciplinary consistency constraints. Alternative solution processes which remove the FORM MPP’s from the decision space and many constraints from the problem are developed. The alternative solution methods are more efficient and more robust than using nonlinear programming to solve the single loop formulation. A numerical example is solved with the two proposed solution algorithms. I. Introduction In the design of multidisciplinary systems it is often necessary to make decisions under uncertainty. This requires that multidisciplinary systems modeling be integrated with uncertainty analysis and optimization. A common example of such an engineering design application would be the design of an aircraft wing under uncertain aerodynamic loading conditions, with multiple structural components with uncertain capacities, such that the entire structural system achieves a prescribed level of reliability. The problem has coupled physics, in that the pressure distribution is dependent upon the deflection, and the deflection is dependent on the pressure distribution. Such designs have been performed using multidisciplinary optimization (MDO). Other examples where MDO may be applied include electronics packaging, in which the disciplines of heat transfer and circuit analysis are coupled, the design of new types of aircraft and integrating them into an existing fleet of aircraft, and even the management of interconnected homeland infrastructures. While MDO has matured with the development of different types of algorithms for various types of problems and design organizations, there has been little work to incorporate reliability analysis into MDO. However, system and component reliabilities are often a major concern in the design of multidisciplinary systems. MDO can be computationally expensive due to the need to achieve consistency across multiple disciplinary analysis codes; each disciplinary analysis code may be computationally expensive to run. Further, the optimal design of multidisciplinary systems under uncertainty involves three types of iterative procedures- multidisciplinary analyses, reliability analyses, and optimization. The integration of these three procedures is referred to in this paper as reliability based multidisciplinary design optimization (RBMDO). If these processes are carried out simultaneously, the computational expense can be enormous. Computational savings can often be achieved with simultaneous analysis and design (SAND) or All-At-Once methods, which allow for the solution of the multidisciplinary analyses and the optimization in one single loop. Single loop RBDO methods allow for the integration of reliability analysis and optimization in a single loop. Applying SAND and single-loop RBDO together may allow for large computational savings when applied to problems in RBMDO. This paper develops a novel formulation of RBMDO problems with both system and component level reliability constraints based on the SAND method for MDO and by use of the KKT conditions of the first order reliability method (FORM). The resulting formulation may be solved as a standard nonlinear programming problem. While the single loop formulation presented in this paper is a solution of the RBMDO problem, robustness and efficiency are improved through two improved algorithms which can remove the MPP’s from the decision space, thereby significantly reducing the optimizer’s workload.