Efficient Runtime Monitoring with Metric Temporal Logic: A Case Study in the Android Operating System

Abstract

Abstract. We present a design and an implementation of a security policy specification language based on metric linear-time temporal logic (MTL). MTL features temporal operators that are indexed by time intervals, allowing one to specify timing-dependent security policies. The design of the language is driven by the problem of runtime monitoring of applications in mobile devices. A main case the study is the privilege escalation attack in the Android operating system, where an app gains access to certain resource or functionalities that are not explicitly granted to it by the user, through indirect control flow. To capture these attacks, we extend MTL with recursive definitions, that are used to express call chains betwen apps. We then show how the metric operators of MTL, in combination with recursive definitions, can be used to specify policies to detect privilege escalation, under various fine grained constraints. We present a new algorithm, extending that of linear time temporal logic, for monitoring safety policies written in our specification language. The monitor does not need to store the entire history of events generated by the apps, something that is crucial for practical implementations. We modified the Android OS kernel to allow us to insert our generated monitors modularly. We have tested the modified OS on an actual device, and show that it is effective in detecting policy violations.

Almost event-rate independent monitoring

“…They show that past formulas can be converted to deterministic timed automata (DTA) and that there are future formulas that cannot be represented by a DTA. There exist trace-length independent monitors for ptLTL extended with counting quantifiers [19], and ptMTL extended with recursive definitions [26]. D'Angelo et al [14] propose an online algorithm for a stream processing language called LOLA that supports past and future references.…”

DroidEcho: an in-depth dissection of malicious behaviors in Android applications

“…Combining static analysis, model checking and runtime monitoring, they are able to detect the violation of contextual policies of Android applications. Gunadi and Tiu (Gunadi and Tiu 2013) propose a security policy specification language to describe privilege escalation on Android. The language is based on metric linear-time temporal logic (MTL) plus an extension of recursive definitions.…”

“…Android malware varies in many aspects such as attack targets, attack methods, and applied obfuscation techniques. For example, Android malware may steal users' sensitive information (Grace et al 2012;Arzt et al 2014a), elevate their privilege (Xing et al 2014;Gunadi and Tiu 2013), deplete device resources (Vekris et al 2012;Pathak et al 2012), and remote control users' devices (Zhou and Jiang 2012). Malware may accomplish attack missions either individually or collaboratively (Octeau et al 2013;Bosu et al 2017), perform attacks only once or periodically (Zhou and Jiang 2012), and be triggered by the installation or a broadcast message.…”

A comparison framework for runtime monitoring approaches

“…Examples include requirements monitoring ( Maiden, 2013;Robinson, 2006 ), monitoring of architectural properties ( Muccini et al, 2007 ), complex event processing ( Völz et al, 2011 ), and runtime verification ( Calinescu et al, 2012;, to name but a few. The desired runtime behavior is often formally expressed using temporal logic ( Viswanathan and Kim, 2005;Gunadi and Tiu, 2014;Bauer et al, 2006 ), or through the use of domain-specific (constraint) languages ( Robinson, 2006;Baresi and Guinea, 2013;Phan et al, 2008;Vierhauser et al, 2015 ). Defined constraints are checked based on events and data collected from systems at runtime, e.g., through instrumentation ( Mansouri-Samani and Sloman, 1993 ).…”