Abstract:Recent years have experienced explosive growth of smartphone sales. Inevitably, the rise in the popularity of smartphones also makes them an attractive target for attacks. In light of these threats, current mobile platform providers have developed various server-side vetting processes to block malicious applications (“apps”). While helpful, they are still far from ideal in achieving their goals. To make matters worse, the presence of alternative (less-regulated) mobile marketplaces also opens up new attack vectors, which necessitate client-side solutions (e.g., mobile anti-virus software) to run on mobile devices. However, existing client-side solutions still exhibit limitations in their capability or deployability. In this paper, we present AirBag, a lightweight OS-level virtualization approach to enhance the popular Android platform and boost our defense capability against mobile malware infection. Assuming a trusted smartphone OS kernel and the fact that untrusted apps will be eventually installed onto users’ phones, AirBag is designed to isolate and prevent them from infecting our normal systems (e.g., corrupting the phone firmware) or stealthily leaking private information. More specifically, by dynamically creating an isolated runtime environment with its own dedicated namespace and virtualized system resources, AirBag not only allows for transparent execution of untrusted apps, but also effectively mediates their access to various system resources or phone functionalities (e.g., SMSs or phone calls). We have implemented a proof-of-concept prototype on three representative mobile devices, i.e., Google Nexus One, Nexus 7, and Samsung Galaxy S III. The evaluation results with a number of untrusted apps, including real-world mobile malware, demonstrate its practicality and effectiveness.

Detection and Prevention of Code Injection Attacks on HTML5-Based Apps

New Deep Learning Method to Detect Code Injection Attacks on Hybrid Applications.

Detecting Code Injection Attacks on Hybrid Apps with Machine Learning

DeepMag+: Sniffing Mobile Apps in Magnetic Field Through Deep Learning.

Test Method on Code Injection Vulnerabilities of Web Application

AirBag: Boosting Smartphone Resistance to Malware Infection.

Fast, Scalable Detection of "piggybacked" Mobile Applications

Exploiting ML algorithms for Efficient Detection and Prevention of JavaScript-XSS Attacks in Android Based Hybrid Applications

Malicious JavaScript Code Detection Based on Hybrid Analysis

A Survey on XSS Attack Detection and Prevention in Web Applications

ConvXSS: A deep learning-based smart ICT framework against code injection attacks for HTML5 web applications in sustainable smart city infrastructure

Study on the Application of Dalvik Injection Technique for the Detection of Malicious Programs in Android

A Large-scale Study on the Risks of the HTML5 WebAPI for Mobile Sensor-based Attacks

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

Enhancing the Browser-Side Context-Aware Sanitization of Suspicious HTML5 Code for Halting the DOM-Based XSS Vulnerabilities in Cloud

The Seven Deadly Sins of the HTML5 WebAPI

An Android Malware Detection Method Using Deep Learning Based on API Calls

Using HTML5 to Prevent Detection of Drive-by-Download Web Malware

A DETECTION FRAMEWORK OF CODE-HIDING EVASION TECHNIQUE BASED ON ANDROID SYSTEM

A deep learning approach for detecting malicious JavaScript code

SQL Injection Attack Detection and Prevention Techniques Using Deep Learning