Conventional mobile communication systems often use one single channel for data transmission, i.e., mobile devices use cellular network to transfer multimedia information. However, if attackers successfully hijack the single transmission channel, they can recover the communicated data. Focused on this issue, we introduce a Multichannel Communication System (MSYM), which aims to improve the data communication security for Android devices. The key idea of our approach is to leverage the diversity of communication mechanisms (e.g., Wi-Fi/cellular network, Bluetooth, and SMS) for transferring sensitive data in a secure way. More specifically, we use the VpnService interface provided by the Android platform to intercept the network data delivered by a sender program. Then, we split the network data into different fragments and improve the security by disordering and encrypting them via multiple transmission channels. When the target Android device receives the data fragments from different channels, it can decrypt and reorder them to reassemble the original data. In the end, we reuse the VpnService interface to inject the network data into the receiver program. Our approach can be deployed in Android devices to secure communication without the need of modifying the communication programs. In the evaluation, as a proof of concept, we implemented our approach on Android system. The experimental results show that our prototype system can secure data transmission with moderate performance cost.

Introduction

Mobile communication plays an increasingly important role in recent years, as more and more people exchange information via mobile devices. For example, over 2 billion people are using the instant messaging apps (e.g., WeChat and WhatsApp) on their mobile phones for exchanging messages, pictures and videos [6]. In addition, 90% of enterprises utilize mobile communication to boost productivity and streamline various business processes. Traditionally, most mobile devices only use one single wireless transmission channel (e.g., cellular network) for mobile communication. However, due to the openness of the wireless channel, it is possible for advanced attackers to eavesdrop the transmission and recover the sensitive data. For instance, adversaries can make use of bogus base stations to conduct man-in-the-middle (MITM) attack on modern Samsung mobile devices and obtain the sensitive information [23]. To prevent the communication data from being eavesdropped and recovered, a conventional solution is to leverage cryptographic protocols to perform data encryption and endpoint authentication. For example, the Wi-Fi Protected Access (WPA) and its subsequent standards (WPA2, WPA3) attempt to secure the wireless networks by applying multiple security protocols [13]. However, they may still suffer from eavesdropping attacks like the KRACK [35] attack. This attack shows that an attacker can exploit the vulnerability of WPA2 to read previously encrypted information. On the other hand, most mobile applications adopt the client-server model, which requires that all the communication data between two or more clients should be firstly forwarded to a central server. Nevertheless, some service providers may not be fully trusted. Taking the messaging server as an example, once it is hacked by adversaries, the recorded information would be leaked.

1- Introduction

2- Related work

3- Methodology and experiments

4- Experimental results and discussions

5- Conclusion

References

Abstract

The Android operating system has been the most popular for smartphones and tablets since 2012. This popularity has led to a rapid raise of Android malware in recent years. The sophistication of Android malware obfuscation and detection avoidance methods have significantly improved, making many traditional malware detection methods obsolete. In this paper, we propose DL-Droid, a deep learning system to detect malicious Android applications through dynamic analysis using stateful input generation. Experiments performed with over 30,000 applications (benign and malware) on real devices are presented. Furthermore, experiments were also conducted to compare the detection performance and code coverage of the stateful input generation method with the commonly used stateless approach using the deep learning system. Our study reveals that DL-Droid can achieve up to 97.8% detection rate (with dynamic features only) and 99.6% detection rate (with dynamic + static features) respectively which outperforms traditional machine learning techniques. Furthermore, the results highlight the significance of enhanced input generation for dynamic analysis as DL-Droid with the state-based input generation is shown to outperform the existing state-of-the-art approaches.

Introduction

Android operating system, which is provided by Google, is predicted to continue have a dramatic increase in the market with around 1.5 billion Android-based devices to be shipped by 2021 sta. It is currently leading the mobile OS market with over 80% market share compared to iOS, Windows, Blackberry, and Symbian OS. The availability of diverse Android markets such as Google Play, the official store, and third-party markets makes Android devices a popular target to not only legitimate developers, but also malware developers. Over one billion devices have been sold and more than 65 billion downloads have been made from Google Play (Smartphone, 0000). Android apps can be found in different categories, such as educational apps, gaming apps, social media apps, entertainment apps, banking apps, etc. As a technology that is open source and widely adopted, Android is facing many challenges especially with malicious applications. The malware infected apps have the ability to send text mes-sages to premium rate numbers without the user acknowledgment, gain access to private data, or even install code that can download and execute additional malware on the victim’s device. The malware can also be used to create mobile botnets (Anagnostopoulos et al., 2016). Over the last few years, the number of malware samples attacking Android has significantly increased. According to a recent report from McAfee, over 2.5 million new Android malware apps were discovered in 2017, thus increasing the number of mobile malware samples in the wild to almost 25 million in 2017 (McA, 0000).

Primary storage that holds data in the mobile device is known as RAM (Random Access Memory).RAM acts as a container that keeps things ready for the CPU. It is used differently by different operating systems and is also infinitely (almost) rewritable and very fast. When we start a particular application on the phone, the application gets loaded from the device memory into the RAM. This same process is observed in computers and the main reason behind doing this is because it increases the access speed and reduces the access time. It was designed to be used fully by Android, Mac OS and Ubuntu. The widgets, system , different tools, graphics are first loaded in the ram and then the available ram is used for loading different applications. Load the paramount applications into the ram and keep it there until the RAM gets completely filled up. If new applications needs to be occupied by the ram and there is no space available then flush the existing RAM and now there will be space left for a new application to occupy the RAM. More the system is being used the performance of the RAM gets better and better. If you have 50 applications installed on your mobile devices, but there are few applications which are being used again and again. The Continuous opening and closing of specific applications will be stored in the RAM because these applications are frequently used. It takes a long time to load an application from the secondary storage which in return consumes more battery and it affects the execution time. Operating system utilizes maximum RAM and hence that is the reason why you can’t free it up 100%. Everything is cleared in the RAM as you restart your mobile device. Performance is determined by how the operating system utilizes the RAM. When the OS starts up, all the icons and widgets (and other graphical items) are rendered and this is the thing the phone is doing before it’s responsive. Even if you are viewing them or not, those pictures, files of icons/widgets/etc. will be persistently in the RAM as long as the OS has booted; and ‘cleaning’ the RAM should not cause the icons to reload. The RAM is generally rapidly occupied and freed. Occupancy is never fixed even if you get a fixed RAM size (i. e. When you are performing multiple operations, the RAM gets filled and when no application is running it automatically gets cleared). In android, some or the other application is always running and hence you will never find RAM utilization as null.

As the number of useful and convenient applications in smartphones is increasing, more and more people prefer to use their smartphones for entertainment and daily activities. Android is the most popular mobile operating system in the world, with hundreds of millions of mobile devices distributed among more than 190 countries [1]. Along with its wide application, many studies concentrate on its security [2], memory [3], power consuming [4], bugs [5], etc. In this paper, we analyze the Android operating system from the viewpoint of bugs. Previous studies on bugs in Android mainly focused on bug locations in modules and their persistence, code modification [5], duplicate bug detection [6], [7], or bug changes [8], etc. Although the fruits present good results for the understanding of bugs in Android, the distribution of bug types in this operating system and the relationship between the bug types and bug attributes are significant topics deserved to be studied, which has not been fully explored till now. Several bug classification methods have been conducted based on bug manifestations. For example, Gray [9] classified bugs into Bohrbugs and Heisenbugs according to the principle whether corresponding failures can be systematically reproduced or not. Grottke et al. [10] defined Mandelbugs as the complementary antonym of Bohrbugs. Due to the simplicity of the activation and error propagation of a Bohrbug, its failure reproduction and hence isolating are easy to be processed. Comparatively the activation and/or error propagation of a Mandelbug are complex – the complexity may be induced by the time lag between bug activation and the failure occurrence, interactions of the software application with its system-internal environment, the timing of inputs and operations, and the sequencing of operations. Different from Bohrbugs, Mandelbugs could make system exhibit chaotic or even nondeterministic behavior during operation [11]. Furthermore, Mandelbugs can be divided into aging related Bugs (ARB) and non-aging related Mandelbugs (NAM). ARBs refer to bugs that can result in software aging (a phenomenon that software exhibits an increasing failure rate and/or degrading performance in a long-running software system). Based on above classification, Cotroneo et al. [12] proposed an extensive analysis of fault triggers. Several researchers have analyzed the manifestation characteristics of each type of bugs in popular software systems, like Apache HTTPD server, MySQL, Linux kernel, Apache AXIS framework [12] and space mission system software [13]. To the best of our knowledge, this is the first paper focusing on the bug classification according to fault triggers in Android. Our study is performed with 513 bug reports of Cyanogenmod, a widely used Android operating system [14]. For each report, we examine the bug description, comments, as well as attached files carefully. The empirical study is undertaken from the following three aspects: (1) Analyze the bug types in Android. In this part, a systematic capture of bug distribution is obtained. The observations are useful to guide developers in Android focusing on the specific subtypes during bug mitigation.

The operating system is a program that acts as an intermediary between a computer user and the computer hardware. We shall use both the abbreviation OS and the complete denomination operating system. An operating system has the following main objectives: first it has to execute user programs and facilitate troubleshooting for users; secondly it has to make the computing system easy to use; and third it has to use efficiently the hardware of the computing system [1], [2]. The operating system offers services to both users and developers who make possible the operation of a computer without the need of employing low-level hardware controls, which are difficult run. The operating system provides relatively uniform interfaces to access a wide range of devices the computer interacts with, from input/output devices, such as printers or digital cameras, to wire or wireless network components that ensure communication among computers. The operating system allows users to create, manage and organize different types of files [11]. Most modern operating systems provide graphical interfaces (GUI – Graphical User Interface) to ensure the relatively easy usage for customers [6], [9], [10], [18].

II. OPERATING SYSTEMS

Operating systems usually provided a set of APIs, named system calls. However safer operating systems have been adopted recently. Currently we have multithreading and multicore architectures integrated into our operating systems. Modern operating systems for mobile devices support many media formats: audio, video, image, and may use video cameras, touchscreens, GPS, accelerometers, accelerated 3D graphics and other types of sensors. System calls have changed so dramatically in the past two years that they actually became irrelevant. This change may be attributed to two companies, Apple and Google, which are real innovation forces. With the launch of the iPhone by Apple a new paradigm has been introduced on the market, i.e. the one where the keywords are controlled user interfaces and application stores. Google followed this example with the introduction of the Android operating system, which was quickly adopted by both application developers and users. This caused a major change in the way we think about operating systems, [8], [12], [13], [14], [15].

The Android operating system has become one of the most popular platforms in mobile devices with a market share of 86.2 % in Q2 2016 [1]. This operating system supports a very large number of applications that are provided on application distributing sites by operating system developers [2], career services [3][4], and others. Monitoring application behavior is important for various reasons, such as security purposes [5] or the estimation of power consumption [6]. Battery-draining applications can be identified effectively by monitoring the number of times WakeLock is acquired and Alarm is set [7][8]. In addition, some application distributing sites conduct application analyses as a service for users [5]. In addition, monitoring application behavior is an important process used by application developers to verify their own applications. Therefore, it is important to actually execute an application when assessing its behavior. However, analyses based on actual executions are highly time consuming [6][7][8]. Naturally, monitoring the behavior of an application over the course of one day takes 24 hours. We previously proposed a method to overcome this problem by constructing an accelerated environment [9][10][11], which was achieved by modifying the implementation of time flow management in the operating system kernel. These studies demonstrated that this method was accurate for low acceleration ratios, such as twice the usual operating speed. However, the method has not been evaluated for high ratios, such as ten or one hundred times. This paper introduces an accelerating method and presents an evaluation of its stability and accuracy with high acceleration ratios. We then describe the problems associated with stability-based evaluation. We explore the causes of system instability and explain our findings, namely that timers in the system are one of the important reasons. Finally, we describe the results we obtained after disabling these timers and investigating the effect of this solution on the system stability.