Abstract:Recent years have experienced explosive growth of smartphone sales. Inevitably, the rise in the popularity of smartphones also makes them an attractive target for attacks. In light of these threats, current mobile platform providers have developed various server-side vetting processes to block malicious applications (“apps”). While helpful, they are still far from ideal in achieving their goals. To make matters worse, the presence of alternative (less-regulated) mobile marketplaces also opens up new attack vectors, which necessitate client-side solutions (e.g., mobile anti-virus software) to run on mobile devices. However, existing client-side solutions still exhibit limitations in their capability or deployability. In this paper, we present AirBag, a lightweight OS-level virtualization approach to enhance the popular Android platform and boost our defense capability against mobile malware infection. Assuming a trusted smartphone OS kernel and the fact that untrusted apps will be eventually installed onto users’ phones, AirBag is designed to isolate and prevent them from infecting our normal systems (e.g., corrupting the phone firmware) or stealthily leaking private information. More specifically, by dynamically creating an isolated runtime environment with its own dedicated namespace and virtualized system resources, AirBag not only allows for transparent execution of untrusted apps, but also effectively mediates their access to various system resources or phone functionalities (e.g., SMSs or phone calls). We have implemented a proof-of-concept prototype on three representative mobile devices, i.e., Google Nexus One, Nexus 7, and Samsung Galaxy S III. The evaluation results with a number of untrusted apps, including real-world mobile malware, demonstrate its practicality and effectiveness.

A Hybrid Security Framework of Mobile Code

AirBag: Boosting Smartphone Resistance to Malware Infection.

An Instance-Oriented Security Mechanism in Grid-Based Mobile Agent System

Program Analysis for Mobile Application Integrity and Privacy Enforcement

A Hybrid Approach to Detecting Security Defects in Programs

Study on Mobile Code Safety Based on Certifying Compilation

MobSafe: Cloud Computing Based Forensic Analysis for Massive Mobile Applications Using Data Mining

Integrated Coverage Control and Security Connectivity in Mobile Sensor Networks

Supporting secure programming in web applications through interactive static analysis.

A Dynamic and Static Combined Android Malicious Code Detection Model Based on SVM.

Security of mobile agents: a new concept of the integrity protection

A security framework for mobile agent systems

A Study of Key Security Threats and Countermeasures in Mobile Agent Systems

Hybrid Information Flow Analysis for Python Bytecode

Demystifying security and compatibility issues in Android Apps

Policy-based Secure Application Framework for Mobile Devices

A DETECTION FRAMEWORK OF CODE-HIDING EVASION TECHNIQUE BASED ON ANDROID SYSTEM

An Approach for Modeling and Analyzing Code Mobility.

Hybrid Dynamic Analysis for Android Malware Protected by Anti-Analysis Techniques with DOOLDA

Protecting Android Native Code Based on Instruction Virtualization

Defensor: Lightweight and Efficient Security-Enhanced Framework for Android