Significant Permission Identification for Machine-Learning-Based Android Malware Detection

Li, Jin; Sun, Lichao; Yan, Qiben; Li, Zhiqiang; Srisa-an, Witawas; Ye, Heng

doi:10.1109/tii.2017.2789219

Cited by 496 publications

(274 citation statements)

References 24 publications

Supporting

Mentioning

267

Contrasting

Unclassified

Order By: Relevance

“…[26][27][28] This algorithm is context-sensitive and flow-sensitive-based analysis algorithm. It basically performs two major steps: 1) Identify at each "echo" location what is being written; 2) Determine the call order of each "echo" function.…”

Section: Http Response Estimationmentioning

confidence: 99%

A client‐server JavaScript code rewriting‐based framework to detect the XSS worms from online social network

Gupta

Chaudhary

2018

Concurrency and Computation

View full text Add to dashboard Cite

This article presents a client-server JavaScript code rewriting-based framework that protects and preserves the privacy of online users against XSS worms on Online Social Network (OSN). The server-side generates an estimation graph which is explored for extracting the JavaScript code and shifts such code in a separate file. This shifting is done for completely isolating the untrusted JavaScript code and data. The client-side performs runtime monitoring of the dynamic JavaScript code to recognize the tainted flow of untrusted JavaScript variables. The context of such dynamic tainted variables is determined, for performing the string analysis to examine whether it may be considered as vulnerable point or not. Finally, decoding operation is performed on the obfuscated malicious JavaScript code and the JavaScript code embedded in the parameter values of HTTP request. If match is found, then XSS attack vector is present. Otherwise, it is not. The authors have developed their prototype on the Java development framework and have estimated the malicious script alleviation capability of this proposed work on tested web applications (Humhub, Elgg, WordPress, Joomla, Drupal). INTRODUCTIONToday, many OSNs have tens of millions of active users. One of the popular OSN is Facebook with greater than 1 billion vigorous users. 1 Social networking is not limited to informal use; however, it is too used for formal purposes. The user on these networks stores the pool of information (personal/professional), therefore, hackers are paying more attention toward these sites. Hackers can make use of this accessible information for their malicious activities. 2-7 To offer online users with enhanced services, the OSNs utilize the capabilities of JavaScript or related contemporary platforms of programming language. The support for such language platforms provides fertile platform for JS worm injection vulnerabilities. The injection of such worms gives rise to Cross-Site Scripting (XSS) attacks on web applications. 8-12 Such vulnerabilities are present in web applications because of the incorrectly validated user input. Furthermore, extenuating all possible JS worm injections is infeasible due to the size and intricacy of modern web application and the various ways that browsers call upon their JS engines. Initially, when XSS was exploited due to the injection of JS worm, it was classified in 2 categories: stored XSS and non-persistent XSS. Later on, a third category of XSS, ie, DOM-based XSS, was defined in 2005. Figure 1 shows the statistics of 2016 by white hat 13 that this attack is a noteworthy concern on each platform of different languages exploited by contemporary platforms of the web.Galán et al 14 proposed a multi-agent system for the scanning of websites in an automated manner to discover the occurrence of XSS vulnerabilities exploitable by stored XSS attack. Likarish et al 15 proposed a method that generates a robust database of scripts (including benign and malicious script code) and extracts the features of web page for classifyi...

show abstract

Section: Http Response Estimationmentioning

confidence: 99%

A client‐server JavaScript code rewriting‐based framework to detect the XSS worms from online social network

Gupta

Chaudhary

2018

Concurrency and Computation

View full text Add to dashboard Cite

show abstract

“…Li et al proposed a malware detection system based on permission usage analysis by significant permission identification technique. 3 levels of pruning by mining the permission data are developed to identify the most significant permissions [56]. These recently proposed techniques can be incorporated with vehicular networks to mitigate intruder attacks.…”

Section: Attacks Related Tomentioning

confidence: 99%

Lightweight Cryptographic Techniques for Automotive Cybersecurity

Jadoon

Wang

et al. 2018

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

A new integration of wireless communication technologies into the automobile industry has instigated a momentous research interest in the field of Vehicular Ad Hoc Network (VANET) security. Intelligent Transportation Systems (ITS) are set up, aiming to offer promising applications for efficient and safe communication for future automotive technology. Vehicular networks are unique in terms of characteristics, challenges, architecture, and applications. Consequently, security requirements related to vehicular networks are more complex as compared to mobile networks and conventional wireless networks. This article presents a survey about developments in vehicular networks from the perspective of lightweight cryptographic protocols and privacy preserving algorithms. Unique characteristics of vehicular networks are presented which make the embedded security applications computationally hard as well as memory constrained. The current study also deals with the fundamental security requirements, essential for vehicular communication. Furthermore, awareness of security threats and their cryptographic solutions in terms of future automotive industry are discussed. In addition, asymmetric, symmetric, and lightweight cryptographic solutions are summarized. These strategies can be enhanced or incorporated all in all to meet the security perquisites of future cars security.

show abstract

“…8 This model allows structural matching to identify similar binary code. 15 For semantic-based methods, Pewny et al introduced an approach to transform instruction sequence into a set of equation representing memory operations. 9 Kong and Yan presented an automated malware classification framework, where the graph distance is computed based on FCG matching, and converted FCG matching to discrete optimization problem with relaxed constraint.…”

Section: Related Workmentioning

confidence: 99%

Toward efficient and accurate function‐call graph matching of binary codes

Huang

Tang

Wang

et al. 2018

Concurrency and Computation

View full text Add to dashboard Cite

Reverse engineering, software plagiarism detection, and malware analysis have always been important issues in software and security fields. For a binary code, the function-call graph (FCG) reflects its capability, structure, and intrinsic relations, which motivates us to study FCG matching and its applications in those problems systematically. In this work, we propose an FCG matching algorithm based on Hungarian algorithm that solves the maximum weight matching problem in polynomial time and makes matching between graphs of large scale possible. Also, optimizations including node pairs pruning and forward matching are proposed to improve the efficiency and accuracy of FCG matching algorithm. Finally, a series of experiments are conducted to show that FCG matching is an effective method and has huge application potentiality in software and security analysis. KEYWORDSfunction-call graph, graph matching, Hungarian algorithm, reverse engineering, software security INTRODUCTIONGraph matching aims at finding a bijective mapping that matches nodes from different graphs. Graph matching has been widely used in various fields such as pattern recognition, computer vision, and bioinformatics. For the binary code of a program, function-call graph (FCG) is a graph that depicts the invocation of functions. It reflects the structure and some internal features of the program. FCG is less susceptible to instruction-level obfuscation employed in malicious codes to evade detection. 1 Because common obfuscation of binary codes such as instruction reordering, equivalent instruction sequence substitution and branch inversion will not cause significant changes to FCG. For this reason, FCG matching of binary codes is a promising method for some important issues in software and security fields, like reverse engineering, software plagiarism detection, malware homology analysis, and malware classification and clustering, which are illustrated in Figure 1, respectively. a) Reverse engineering: Supposing we have analyzed program P by reverse engineering, the reverse analysis of its successor or close-related program P ′ could be easier by leveraging of the result of program P. Graph matching maps the functions in program P ′ to the similar reversed-functions in program P automatically, and therefore, it reduces the overall workloads of reverse engineering significantly. b) Software plagiarism detection: By the use of FCG matching from protected software to suspicious software, pairs of functions with high similarity could be revealed as the plagiarized parts.c) Malware homology analysis: Discovering the isomorphic subgraphs through FCG matching helps determine the homologous malware samples that are developed by same author or share same code fragments. d) Malware classification and clustering: Distance between malware samples can be well defined according to the results of FCG matching. Such distance can be used by typical classification or clustering algorithms to classify or cluster a set of unknown malware samples.So far, most of fast alg...

show abstract

Significant Permission Identification for Machine-Learning-Based Android Malware Detection

Cited by 496 publications

References 24 publications

A client‐server JavaScript code rewriting‐based framework to detect the XSS worms from online social network

A client‐server JavaScript code rewriting‐based framework to detect the XSS worms from online social network

Lightweight Cryptographic Techniques for Automotive Cybersecurity

Toward efficient and accurate function‐call graph matching of binary codes

Contact Info

Product

Resources

About