Static Analysis of Android Apps Interaction with Automotive CAN

The pervasive adoption of Android in the smartphone market has attracted the attention of malicious actors who continually exploit its open system architecture. A number of cybercriminals have been targeting Android in recent times due to its popularity. As a result of the increasing demand for smartphones, malicious users have recently been drawn to Android and taken advantage of its open system design to commit crimes. As Android has grown in popularity, attackers have been targeting it more. It is possible to gain access to data hidden from view using algorithms even though security measures have been implemented. An Android malware detection system based on machine-deep learning has been developed by utilizing dynamic analysis, in which suspected malware is executed in a secure environment in order to observe its behavior, as well as static analysis, in which malware files are examined without being executed on an Android device. As a result of our experimental results, our suggested models have a higher accuracy rate than industry standards, with a static accuracy rate of 99 and a dynamic accuracy rate of 98 for CNN-LSTM

For the last few years, Android is known to be the most widely used operating system and this rapidly increasing popularity has attracted the malware developer’s attention. Android allows downloading and installation of apps from other unofficial market places. This gives malware developers an opportunity to put repackaged malicious applications in third-party app-stores and attack the Android devices. A large number of malware analysis and detection systems have been developed which uses static analysis, dynamic analysis, or hybrid analysis to keep Android devices secure from malware. However, the existing research clearly lags in detecting malware efficiently and accurately. For accurate malware detection, multilayer analysis is required which consumes large amount of hardware resources of resource constrained mobile devices. This research proposes an efficient and accurate solution to this problem, named SAMADroid, which is a novel 3-level hybrid malware detection model for Android operating systems. The research contribution includes multiple folds. First, many of the existing Android malware detection techniques are thoroughly investigated and categorized on the basis of their detection methods. Also, their benefits along with limitations are deduced. A novel 3-level hybrid malware detection model for Android operating systems is developed, that can provide high detection accuracy by combining the benefits of the three different levels: 1) Static and Dynamic Analysis; 2) Local and Remote Host; and 3) Machine Learning Intelligence. Experimental results show that SAMADroid achieves high malware detection accuracy by ensuring the efficiency in terms of power and storage consumption.

As the number of android applications (apps) available in the market are increasing rapidly, various types of security attacks using the android apps are also increasing with the same pace. The ransomware attack is one of these kind of security attacks in which the attackers locks the user's phone, encrypts user's data or blocks the user's access to their own data and threatens the user to pay a ransom to gain the access back. This cyber-threat is terrorizing the world from many years as it performs mimicry attacks i. e. combination of encryption & locking attacks. Android devices are more prone to these ransomware attacks compared to Windows and IOS devices. RansomwareElite is an android application which detects the presence of ransomware in the apps installed on an android device by checking the presence of any threatening text in app code or by verifying the permissions requested by the app from the user. In this paper, we focused on improving the performance of RansomwareElite app by extending its features. Now, the RansomwareElite app also searches the presence of any threatening image or file containing threatening text by analyzing the Android Package Kit(APK) file of android app. Moreover, it also detects some specific methods and classes in the code of the APK which could be used for locking the device and checks some specific permissions requested, for uninstalled apps now. Further, it maintains a database on the online server for the records of all the suspicious and ransomware apps detected by RansomwareElite. We have tested RansomwareElite with 9 Test Apps which are manually created based on the features of ransomware family and on 48 android devices. After analyzing the test results, we have found that the performance of RansomwareElite is improved after incorporating the new features and RansomwareElite app detects the presence of ransomware in installed as well as uninstalled apps present on an android's device in an efficient manner.

With the rise in the underground Internet economy, automated malicious programs popularly known as malwares have become a major threat to computers and information systems connected to the internet. Properties such as self healing, self hiding and ability to deceive the security devices make these software hard to detect and mitigate. Therefore, the detection and the mitigation of such malicious software is a major challenge for researchers and security personals. The conventional systems for the detection and mitigation of such threats are mostly signature based systems. Major drawback of such systems are their inability to detect malware samples for which there is no signature available in their signature database. Such malwares are known as zero day malware. Moreover, more and more malware writers uses obfuscation technology such as polymorphic and metamorphic, packing, encryption, to avoid being detected by antivirus. Therefore, the traditional signature based detection system is neither effective nor efficient for the detection of zero-day malware. Hence to improve the effectiveness and efficiency of malware detection system we are using classification method based on structural information and behavioral specifications. In this paper we have used both static and dynamic analysis approaches. In static analysis we are extracting the features of an executable file followed by classification. In dynamic analysis we are taking the traces of executable files using NtTrace within controlled atmosphere. Experimental results obtained from our algorithm indicate that our proposed algorithm is effective in extracting malicious behavior of executables. Further it can also be used to detect malware variants.

The Android operating system dominates the smartphone market. Thus, to service the market, the number of Android applications has risen dramatically. These applications are processing a great amount of sensitive data, which could result in various concerns including data leakage and privacy violations. For example, applications may misuse the sensitive data stored on Android devices and violate the privacy of the user. Therefore, it is essential to maintain user privacy and protect sensitive data from leakage. Static data flow analysis approaches are used for analyzing Android applications to uncover security and privacy issues. However, these approaches frequently generate false alarms, given the different challenges created by Android applications, such as inter-component communication (ICC), reflection, and implicit flow. This work presents the DroidRista approach for conducting static data flow analysis on Android applications to detect sensitive data leakage. DroidRista analyzes ICC, reflection, and implicit flow in Android applications. To evaluate the performance of DroidRista, it was tested on three data sets. The results demonstrate improved performance in terms of detecting data leakage compared to existing static data flow analysis approaches.

With the continuous growth in the usage of Android apps, ensuring their security has become critically important. An increasing number of malicious apps adopt anti-analysis techniques to evade security measures. Although some research has started to consider anti-runtime analysis (ARA), it is unfortunate that they have not systematically examined ARA techniques. Furthermore, the rapid evolution of ARA technology exacerbates the issue, leading to increasingly inaccurate analysis results. To effectively analyze Android apps, understanding their adopted ARA techniques is necessary. However, no systematic investigation has been conducted thus far. <p xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">In this paper, we conduct the first systematic study of the ARA implementations in a wide range of 117,270 Android apps (including both malicious and benign ones) collected between 2016 and 2023. Additionally, we propose a specific investigation tool named <small>ARAP</small> to assist this study by leveraging both static and dynamic analysis. According to the evaluation results, <small>ARAP</small> not only effectively identifies the ARA implementations in Android apps but also reveals many important findings. For instance, almost all apps have implemented at least one category of ARA technology (99.6% for benign apps and 97.0% for malicious apps).

The malicious code on the network is increasingly rampant that the traditional detection method of characteristic code has been difficult to deal with malicious code, with features of various variants, deformations and other problems. In this paper we present a new static analysis model based on software fingerprint to distinguish malicious codes. Through obtaining the software call graph by disassembling the binary file and mapping it as an image, shape moments can be obtained as the software fingerprint based on the retrieval theory of content image, combined with moment theory and the image's color, texture and shape features. The idea of pattern matching is used to measure the extracted software fingerprint similarity to determine whether it is malicious code or not. Then, we analyze the collected program samples. Test and verify whether the program has good performance in uniqueness, invariability and sensibility. With the rapid popularization of Internet and corporate information technology acceleration, the computer is a great convenience to people's lives, whether it is shopping, leisure or work and more obvious the importance of the Internet, but due to the openness of the Internet and flexible application and operating system vulnerability so that people can enjoy the benefits brought by the computer at the same time, also is experiencing distress and abuse of all kinds of malicious code threats to network security events increased year by year. Network security incidents, the most serious harm caused by malicious code, causing huge economic losses to the country as a whole, society and the individual, information security has become a major challenge facing. Domestic and foreign researchers turned to the semantics of malicious code, trying to judge the signatures of the two deformation malicious code through the instruction-level semantics rather than program syntax, further can determine whether the deformation of the malicious code. Trying to evade detection of malicious code, malicious codes are disassembled and for standardization or stack analysis system call for the use of fuzzy transformation technology to discriminate. In recent years, the researchers also uses malicious code detection technology engineering methodology, based on feature detection based on the application of malicious code detection technology based on data mining and machine learning. However, while foreign research scholars during the malicious code detection and anti-virus software R & D, the attacker malicious code using anti-debugging techniques, anti-Hook technology, to detect whether the code being debugged, the to find themselves debugger or analysis environment, malicious code using fuzzy transform technique and a series of anti-debugging measures show some non-anomalous behavior of the code, so as to protect their own purposes. In this process, we need manually assistive technology. Most automated virus analysis software only to capture some of the behavior, security experts need further analysis and screening of experimental results, and finally determine the extent of the harm of malicious behavior. In summary, the malicious code on the network more and more rampant code detection method for the traditional characteristics of difficult to deal with malicious code variants, deformation problem, solve the problem of the detection of unstable deformation caused due to malicious code upgrade has become a research focus and difficulty, but also of the issues that must be resolved key issues.

Beacons are the devices which are connected with any android devices using Bluetooth. This can be utilized to check the presence of a client inside premises. In many schools and colleges, the educator physically records the attendance in the class. In this paper, I am aiming at implementing a Bluetooth low energy based attendance administration framework. When the student reaches into within the range of beacon, the android app will detect the previously registered beacon devices and it establishes connection. The application is used to collect the data from the Bluetooth and store it accordingly. To ensure the credibility of the framework I am utilizing individuals checking framework through video surveillance. This technique not only enhances the use of Bluetooth but also supports the ERP for decision making.

Google's Android platform is a widely used operating system for mobile phones and a fully commercial application (App) market has been established. However, because of the easy access to Android internal files, unlicensed Android Apps are widely being distributed. To protect the intellectual property of Android developers, various techniques are being proposed that can prevent the illegal access to Apps [6]. But all current techniques ignore the possibility of memory hacking. We show by example that memory hacking is actually possible on Android devices. In this paper we especially focused on the possibility of memory hacking and show that it is indeed possible, which shows that the memory hacking factor has to be included in the security analysis of current protection systems.

Modern smartphone operating systems (e.g., Android 6.0 and later versions) employ an ask-on-first-use policy to regulate app permissions. To assist users in policy decisions, relevant efforts have been focusing on leveraging contexts to capture users' privacy preferences. However, these techniques have various limitations, such as heavily relying on users' historical decisions on granting permissions, ignoring the fact that users are not experts on privacy protection, and hard to determine whether a permission shall be granted. To address this problem, we propose an autonomous permission recommendation system, AutoPer+, to automatically recommend users the permission decisions at runtime. The main insight of our proposed system is that the natural language description of an app reflects its functionality and its similarity to other apps, and thus can be used to analyze whether a permission is needed indeed by it, and the apps similar to it. First, we introduce a multi-topic model into app functionality mining, and design a topic-permission mapper for the proposed recommendation system. Then we propose a deep semi-supervised machine using Long Short-Term Memory (LSTM) neural networks to identify similar apps, by which we can explore privacy permission usage in a cluster of apps. Finally, we capture a trade-off between privacy and utility to present a systematic recommendation. In addition to the permission decision (“Allow” or “Deny”), the permission explanations are also provided for users to make decisions (called “Ask”). We evaluate the proposed system via extensive comparison experiments on 31,023 Android apps. The results show that our approach achieves an accuracy of 84.1%. Moreover, we conduct user studies via installing AutoPer+ in the participants' own Android devices. We receive positive responses from the participants, which implies AutoPer+ is potentially for real-world deployment for enhancing current permission recommendation.

Android devices are popular nowadays due to their rich functionality and good performance. Android provides a permission model that supports user privacy by protecting restricted data access and actions on the Android operating system. Based on the app's defined functionality, any app must get users' permission to access different types of restricted data or resources. However, some developers request additional permissions other than the app's functionality, known as over-claim permissions. These over-claim permissions may steal sensitive information from users, Which is one of the leading privacy issues. Looking towards its criticality, many researchers have started working on detecting over-claim permission. This paper conducts a comprehensive survey of various approaches to identify and handle over-claim permissions. It also discusses the limitations of existing techniques and further research scope in this direction, which may help researchers define a path for designing new methods or optimizing existing strategies to resolve over-claim permission problems satisfactorily.

An Android Application Analyzer (AAA) is a tool that helps user to detect malware in Android devices. In addition, it also provides provision to remove detected malware. The system detects various types of existing malware using a novel approach by learning behavior of Android Apps based on its permissions. Android Apps are generally using combination of permissions to perform their desired actions on the device such as reading from or writing to internal/external storage, accessing network or Bluetooth etc. In most of the cases, the malicious Apps use combination of permissions that may pose a risk to user. The implemented system learns these malicious permissions of Apps by using data mining algorithm such as clustering and classification and classifies them either into harmful or safe. The paper discusses the test cases that show how the system is accurately able to classify malware by increasing the number of clusters size.

Mobile applications use Accessibility Services to assist users with disabilities (UWDs) in using Graphical User Interface (GUI)-based apps. However, such mobile assistive technologies are not fully secure as these can obtain data from the GUI objects, enhance this data for UWDs and transmit it to a server, thereby potentially exposing sensitive data to the external world. SEAPHISH (SEcuring Accessibility using PHISHing) is a platform aimed towards protecting against such an attack by providing defense by deception. This platform generates a phishing app i.e. an app similar to the original app installed on the user’s smartphone by extracting GUI elements and properties from the original app. A simulation for SEAPHISH can help determine the situations when an attack against a particular app can be performed with a high degree of probability. But performing effective simulations requires a fundamental understanding of the properties of GUI layouts of apps at large. This thesis aims at providing a framework that analyzes GUI layouts and their transitions using a large base of approximately three million Android apps. Various state-of-the-art tools that use different strategies in traversing layouts are explored. We created a framework where the tool Backstage performs static analysis and another tool AndroidRipper performs dynamic analysis of the layouts to help build a GUI model of the app. Using these models, we investigate the layouts of Android apps by collecting statistics on various GUI elements and screens. This investigation enhances SEAPHISH with statistically significant real-world constraints thereby providing defense against malwares and reducing the security vulnerabilities faced by UWDs.

Forensics from volatile memory plays an important role in the investigation of cyber crime. The acquisition of RAM Memory or other terms of RAM dump can assist forensic investigators in retrieving much of the information related to crime. There are various tools available for RAM analysis including Volatility, which currently dominates open source forensic RAM tools. It has happened that many forensic investigators are thinking that they probably have malware in the RAM dump. And, if they do exist, they're still not very capable Malware Analysts, so it's hard for them to analyze the possibilities of malware in a RAM dump. The availability of tools such as Volatility allows forensic investigators to identify and link the various components to conclude whether the crime was committed using malware or not. However, the use of volatility requires knowledge of basic commands as well as static malware analysis. This work is done to assist forensic investigators in detecting and analyzing possible malware from dump RAM. This work is based on the volatility framework and the result is a Forensic tool for analyzing RAM dumps and detecting possible malware in it using machine learning algorithms in order to detect offline (not connected to the internet)

Android introduces a new permission model that allows apps to request permissions at runtime rather than at the installation time since 6.0 (Marshmallow, API level 23). While this runtime permission model provides users with greater flexibility in controlling an app's access to sensitive data and system features, it brings new challenges to app development. First, as users may grant or revoke permissions at any time while they are using an app, developers need to ensure that the app properly checks and requests required permissions before invoking any permission-protected APIs. Second, Android's permission mechanism keeps evolving and getting customized by device manufacturers. Developers are expected to comprehensively test their apps on different Android versions and device models to make sure permissions are properly requested in all situations. Unfortunately, these requirements are often impractical for developers. In practice, many Android apps suffer from various runtime permission issues (ARP issues). While existing studies have explored ARP issues, the understanding of such issues is still preliminary. To better characterize ARP issues, we performed an empirical study using 135 Stack Overflow posts that discuss ARP issues and 199 real ARP issues archived in popular open-source Android projects on GitHub. Via analyzing the data, we observed 11 types of ARP issues that commonly occur in Android apps. For each type of issues, we systematically studied: (1) how they can be manifested, (2) how pervasive and serious they are in real-world apps, and (3) how they can be fixed. We also analyzed the evolution trend of different types of issues from 2015 to 2020 to understand their impact on the Android ecosystem. Furthermore, we conducted a field survey and in-depth interviews among the practitioners from open-source community and industry, to gain insights from practitioners’ practices and learn their requirements of tools that can help combat ARP issues. Finally, to understand the strengths and weaknesses of the existing tools that can detect ARP issues, we built <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ARPBench</small> , an open benchmark consisting of 94 real ARP issues, and evaluated the performance of three available tools. The experimental results indicate that the existing tools have very limited supports for detecting our observed issue types and report a large number of false alarms. We further analyzed the tools’ limitations and summarized the challenges of designing an effective ARP issue detection technique. We hope that our findings can shed light on future research and provide useful guidance to practitioners.