A Host and Network Based Intrusion Detection for Android Smartphones

Ariyapala, Kanishka; Giang, Hoang; Anh, Huynh Ngoc; Ng, Wee Keong; Conti, Mauro

doi:10.1109/waina.2016.35

Cited by 12 publications

(15 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The graph supports our assumption by showing the signicant deviation in the CPU utilisation pattern during the DDoS attack period. In the literature we note works such as [21], [22], [2], [15], [9], [16], [17] where deviations in smartphone resource utilisation are used as indicators of smartphone intrusions. For DroidLight, we use the OCC algorithm that is proposed by [10].…”

Section: Droidlight Approach To Intrusion Detectionmentioning

confidence: 99%

DroidLight

Barbhuiya

Kilpatrick

Nikolopoulos

2020

Proceedings of the 21st International Conference on Distributed Computing and Networking

View full text Add to dashboard Cite

Smartphone malware attacks are increasing alongside the growth of smartphone applications in the market. Researchers have proposed techniques to detect malware attacks using various approaches, which broadly include signature and anomaly-based intrusion detection systems (IDSs). Anomaly-based IDSs usually require training machine learning models with datasets collected from running both benign and malware applications. This may result in low detection accuracy when detecting zero-day malwares, i.e. those not previously seen or recorded. In this paper, we propose DroidLight, a lightweight IDS which can detect zero-day malware eciently and eectively. We designed an algorithm for DroidLight that is based on one class classication and probability distribution analysis. For each smartphone application, the classication model learns its normal CPU utilisation and network trac pattern. The model ags an intrusion alert if there is any signicant deviation from the normal pattern. By deploying three self-developed malwares we performed realistic evaluation of DroidLight, i.e. the evaluation was performed on a real device while a real user was interacting with it. Evaluation results demonstrate that DroidLight can detect smartphone malwares with accuracy ranging from 93.3% to 100% while imposing only 1.5% total overhead on device resources. CCS CONCEPTS• Security and privacy → Malware and its mitigation; Intrusion detection systems; Denial-of-service attacks; • Humancentered computing → Smartphones; • Computing methodologies → Classication and regression trees.

show abstract

Section: Droidlight Approach To Intrusion Detectionmentioning

confidence: 99%

DroidLight

Barbhuiya

Kilpatrick

Nikolopoulos

2020

Proceedings of the 21st International Conference on Distributed Computing and Networking

View full text Add to dashboard Cite

show abstract

“…FR1: Must be able to collect required security-related data in different situations and contexts [21]. FR2: Must be able to store collected data in a storage medium [22].…”

Section: A Requirements 1) Functional Requirements (Fr)mentioning

confidence: 99%

“…FR8: Must be flexible and scalable in data collection [25]. FR9: Must not cost too much computation resources, storage resources or other resources in collecting data in some scenarios [21]. FR10: Must be automatic and adaptive, with a certain degree of intelligence and learning ability in order to adapt to the changes of a network environment [11].…”

Section: A Requirements 1) Functional Requirements (Fr)mentioning

confidence: 99%

“…For example, increasing number of researchers use mobile terminals (e.g., smartphones and tablets) to collect data [68]- [70]. Ariyapala et al [21] utilized smartphone to design a system to detect network attacks and anomalies where the smartphone was used to capture the network traffic, network logs and the system logs. Boualouache et al [23] proposed to use smartphones as data collectors for their IoT data collection system.…”

Section: G: Mobile Terminalmentioning

confidence: 99%

See 1 more Smart Citation

A Survey on Network Security-Related Data Collection Technologies

et al. 2018

View full text Add to dashboard Cite

Security threats and economic loss caused by network attacks, intrusions, and vulnerabilities have motivated intensive studies on network security. Normally, data collected in a network system can reflect or can be used to detect security threats. We define these data as network security-related data. Studying and analyzing security-related data can help detect network attacks and intrusions, thus making it possible to further measure the security level of the whole network system. Obviously, the first step in detecting network attacks and intrusions is to collect security-related data. However, in the context of big data and 5G, there exist a number of challenges in collecting these security-related data. In this paper, we first briefly introduce network security-related data, including its definition and characteristics, and the applications of network data collection. We then provide the requirements and objectives for security-related data collection and present a taxonomy of data collection technologies. Moreover, we review existing collection nodes, collection tools, and collection mechanisms in terms of network data collection and analyze them based on the proposed requirements and objectives toward high quality security-related data collection. Finally, we discuss open research issues and conclude with suggestions for future research directions.INDEX TERMS Network security, security-related data, data collection technologies, large-scale heterogeneous networks.

show abstract

“…More recently, Ariyapala et al [5] combine host and network metrics to build an intrusion detection system for smartphones. The authors capture metrics such as CPU utilisation, energy consumption, running processes, user activity and network traffic.…”

Section: Related Workmentioning

confidence: 99%