Ming­shen Sun, Min Zheng, John C.S. Lui, and Xux­ian Jiang
The 30th An­nual Com­puter Se­cu­rity Ap­pli­ca­tions Con­fer­ence, ACSAC '14.

Ar­chi­tec­ture of Pa­tronus.

Avail­abil­ity:

Ab­stract. An­droid has a dom­i­nat­ing share in the mo­bile mar­ket and there is a sig­nif­i­cant rise of mo­bile mal­ware tar­get­ing An­droid de­vices. An­droid mal­ware ac­counted for 97% of all mo­bile threats in 2013. To pro­tect smart­phones and pre­vent pri­vacy leak­age, com­pa­nies have im­ple­mented var­i­ous host-based in­tru­sion pre­ven­tion sys­tems (HIPS) on their An­droid de­vices. In this paper, we first an­a­lyze the im­ple­men­ta­tions, strengths and weak­nesses of three pop­u­lar HIPS ar­chi­tec­tures. We demon­strate a se­vere loop­hole and weak­ness of an ex­ist­ing pop­u­lar HIPS prod­uct in which hack­ers can read­ily ex­ploit. Then we pre­sent a de­sign and im­ple­men­ta­tion of a se­cure and ex­ten­si­ble HIPS plat­form—"Pa­tronus." Pa­tronus not only pro­vides in­tru­sion pre­ven­tion with­out the need to mod­ify the An­droid sys­tem, it can also dy­nam­i­cally de­tect ex­ist­ing mal­ware based on run­time in­for­ma­tion. We pro­pose a two-phase dy­namic de­tec­tion al­go­rithm for de­tect­ing run­ning mal­ware. Our ex­per­i­ments show that Pa­tronus can pre­vent the in­tru­sive be­hav­iors ef­fi­ciently and de­tect mal­ware ac­cu­rately with a very low per­for­mance over­head and power con­sump­tion.

Bib­TeX Record:

@inproceedings{sun2014design,
  author = {Sun, Mingshen and Zheng, Min and Lui, John C.S. and Jiang, Xuxian},
  title = {Design and Implementation of an Android Host-based Intrusion Prevention System},
  booktitle = {Proceedings of the 30th Annual Computer Security Applications Conference},
  series = {ACSAC '14},
  year = {2014},
  isbn = {978-1-4503-3005-3},
  location = {New Orleans, Louisiana, USA},
  pages = {226--235},
  numpages = {10},
  url = {http://doi.acm.org/10.1145/2664243.2664245},
  doi = {10.1145/2664243.2664245},
  acmid = {2664245},
  publisher = {ACM},
  address = {New York, NY, USA},
}