Defending Mobile Phones from Proximity Malware

Abstract

Abstract-As mobile phones increasingly become the target of propagating malware, their use of direct pair-wise communication mechanisms, such as Bluetooth and WiFi, pose considerable challenges to malware detection and mitigation. Unlike malware that propagates using the network, where the provider can employ centralized defenses, proximity malware can propagate in an entirely distributed fashion. In this paper we consider the dynamics of mobile phone malware that propagates by proximity contact, and we evaluate potential defenses against it. Defending against proximity malware is particularly challenging since it is difficult to piece together global dynamics from just pair-wise device interactions. Whereas traditional network defenses depend upon observing aggregated network activity to detect correlated or anomalous behavior, proximity malware detection must begin at the device. As a result, we explore three strategies for detecting and mitigating proximity malware that span the spectrum from simple local detection to a globally coordinated defense. Using insight from a combination of real-world traces, analytic epidemic models, and synthetic mobility models, we simulate proximity malware propagation and defense at the scale of a university campus. We find that local proximity-based dissemination of signatures can limit malware propagation. Globally coordinated strategies with broadcast dissemination are substantially more effective, but rely upon more demanding infrastructure within the provider.

Exploiting temporal complex network metrics in mobile malware containment

“…State-of-the-art solutions on mobile malware containment have ignored two important temporal properties: firstly, the time order, frequency and duration of contacts; and secondly, the time of day a malicious message starts to spread and the delay of a patch [26], [27]. Instead, we argue that the temporal dimension is of key importance in devising effective solutions to this problem.…”

“…However, this only captures potentially long-distance relationships and misses important opportunistic contacts that Bluetooth worms can exploit. In [27] Zyba et al evaluate the spreading of a patch via short-range radio transmission; this work is based on a random mobility model and assumes homogeneous mixing and degree distribution over time. As we have shown, mobile phone contact networks are driven by periodic human schedules and so the models proposed in this paper could be considered as an over-simplification of real situations.…”

A Novel Approach to Trojan Horse Detection in Mobile Phones Messaging and Bluetooth Services

“…Although Bluetooth technology provides levels of security based on the identification of the devices involved, the number of vulnerabilities via Bluetooth has increased considerably. The dynamics of mobile phone malware that propagates by proximity contact is considered in [7][8] where strategies for detecting and mitigating proximity malware from a simple local detection to a globally coordinated defence are studied. In [9], combination of four detection schemes is proposed, called SMS-Watchdog, which builds normal social behaviour profiles for each SMS user and then uses them to detect SMS anomalies in an online and streaming fashion.…”

Virus propagation power of the dynamic network

“…But in a large-scale dynamic network, immunization strategy should cover 80% of nodes by stochastic immunization strategy or the whole topology should be known using a special immunization strategy [13,14]. Through local strategies, once a node finds itself infected, it sends an antivirus message to others immediately and the virus can be cleared accordingly [23][24][25][26].…”

“…Zyba et al [23] presents an ideal scheme to restrain virus propagation through which a node can detect a virus locally. Once the virus has been found, the infected node immediately cuts off the communication or sends an antivirus message to adjacent nodes.…”