Abstract:Android is the most widely used mobile operating system with billions of users and devices. The popularity of Android apps have enticed malware writers to target them. Recently, Jamrozik et al. proposed an approach, named Boxmate, to mine sandboxes to protect Android users from malicious behaviors. In a nutshell, Boxmate analyzes the execution of an app, and collects a list of sensitive APIs that are invoked by that app in a monitoring phase. Then, it constructs a sandbox that can restrict accesses to sensitive APIs not called by the app. In such a way, malicious behaviors that are not observed in the monitoring phase - occurring, for example, due to malicious code injection during an attack - can be prevented. Nevertheless, Boxmate only focuses on a specific API type (i.e., sensitive APIs); it also ignores parameter values of many API methods and requested permissions during the execution of a target app. As a result, Boxmate is not able to detect malicious behaviors in many cases. In this work, we address the limitation of Jamrozik et al.'s work by considering input parameters of many different types of API methods for mining a more comprehensive sandbox. Given a benign app, we first extract a list of Android permissions that the app may request during its execution. Next, we leverage an automated test case generation tool, named Droidbot, to generate a rich set of GUI test cases for exploring behaviors of the app. During the execution of these test cases, we analyze the execution of four different types of API methods. Furthermore, we record input parameters to these API methods, and classify those into four different categories. We leverage the collected parameter values, and the list of requested permissions to create a sandbox that can protect users from malicious behaviors. Our experiments on 25 pairs of real benign and malicious apps show that our approach is more effective than the coarse-and fine-grained variants of Boxmate by 267.37% and 81.64% in terms of F-measure respectively.

Enhancement and Formal Verification of the ICC Mechanism with a Sandbox Approach in Android System

A comprehensive framework for inter-app ICC security analysis of Android apps

Uncovering Cross-Context Inconsistent Access Control Enforcement in Android.

Hybrid User-level Sandboxing of Third-party Android Apps.

Towards Mining Comprehensive Android Sandboxes.

AirBag: Boosting Smartphone Resistance to Malware Infection.

Security Code Smells in Android ICC

Towards a multilayered permission-based access control for extending Android security.

SIAT: A Systematic Inter-Component Communication Analysis Technology for Detecting Threats on Android

Enhancement of Permission Management for an ARM-Android Platform.

ON ACCESS CONTROL ENHANCEMENT MECHANISM FOR SENSITIVE DATA AND CAPACITIES IN ANDROID

A Comprehensive Evaluation of Android ICC Resolution Techniques

RAICC: Revealing Atypical Inter-Component Communication in Android Apps

Dependable Integrated Clinical System Architecture with Runtime Verification

Detecting and Defending Against Inter-App Permission Leaks in Android Apps

Invetter

A Framework for Formal Specification and Verification of Security Properties of the Android Permissions System

Independent Credible: Secure Communication Architecture of Android Devices Based on TrustZone

SecComp: Towards Practically Defending Against Component Hijacking in Android Applications

An Approach for the Identification of Information Leakage in Automotive Infotainment systems

Taming Information-Stealing Smartphone Applications (On Android)