Abstract:Android is the most widely used mobile operating system with billions of users and devices. The popularity of Android apps have enticed malware writers to target them. Recently, Jamrozik et al. proposed an approach, named Boxmate, to mine sandboxes to protect Android users from malicious behaviors. In a nutshell, Boxmate analyzes the execution of an app, and collects a list of sensitive APIs that are invoked by that app in a monitoring phase. Then, it constructs a sandbox that can restrict accesses to sensitive APIs not called by the app. In such a way, malicious behaviors that are not observed in the monitoring phase - occurring, for example, due to malicious code injection during an attack - can be prevented. Nevertheless, Boxmate only focuses on a specific API type (i.e., sensitive APIs); it also ignores parameter values of many API methods and requested permissions during the execution of a target app. As a result, Boxmate is not able to detect malicious behaviors in many cases. In this work, we address the limitation of Jamrozik et al.'s work by considering input parameters of many different types of API methods for mining a more comprehensive sandbox. Given a benign app, we first extract a list of Android permissions that the app may request during its execution. Next, we leverage an automated test case generation tool, named Droidbot, to generate a rich set of GUI test cases for exploring behaviors of the app. During the execution of these test cases, we analyze the execution of four different types of API methods. Furthermore, we record input parameters to these API methods, and classify those into four different categories. We leverage the collected parameter values, and the list of requested permissions to create a sandbox that can protect users from malicious behaviors. Our experiments on 25 pairs of real benign and malicious apps show that our approach is more effective than the coarse-and fine-grained variants of Boxmate by 267.37% and 81.64% in terms of F-measure respectively.

Application Policy Security Mechanisms of Android System.

Hybrid User-level Sandboxing of Third-party Android Apps.

Taming Information-Stealing Smartphone Applications (On Android)

Towards Mining Comprehensive Android Sandboxes.

The Android Platform Security Model (2023)

Google Android: A State-of-the-Art Review of Security Mechanisms

Policy-based Secure Application Framework for Mobile Devices

ON ACCESS CONTROL ENHANCEMENT MECHANISM FOR SENSITIVE DATA AND CAPACITIES IN ANDROID

Permission based Android security: Issues and countermeasures

A survey of android mobile platform security

Towards a multilayered permission-based access control for extending Android security.

Demystifying security and compatibility issues in Android Apps

Android application fine-grained access control based on self-defined security policy

Android Security Framework: Enabling Generic and Extensible Access Control on Android

Enhancement of Permission Management for an ARM-Android Platform.

Management system for secure mobile application development

Review of Application and Analysis Techniques for Mobile System Security

Dynamic Protection Technology for Privilege Escalation Attack on Android

Android Multi-Level System Permission Management Approach

Android Security Reinforcement Technology

Brief View and Analysis to Latest Android Security Issues and Approaches