| Smartphones have developed rapidly in the last decade. Due to their remarkable performance and rich applications, more and more daily routine can be done by them instead of personal computers, such as sending email, online payment, etc. So smartphones have more opportunities to see users'private information, which makes them more likely to be the targets of malwares.In this paper, we study smartphones'characteristics and threats they face. Then an anormaly detection method is proposed. It is based on system behavior analysis and implemented on Android. The method works as follows: First, the system behavior is abstracted and defined. Then, smartphones'system behaviors are monitored and extracted periodically by an agent. They are analyzed by a classification algorithm based on Self-organization Maps. Finally, the anomaly is found out (if it exists) and handled according to the result of the analysis.Our main work and contributions in this paper are as follows:(1) A multi-algorithm supported, dynamic scalable anomaly detection frame work is proposed. By concluding and studying the existing anomaly detection technologies for computers and smartphones, anomaly detection is abstracted as two steps: behavior extraction and behavior analysis. Then a framework which has a client-server architecture is proposed to manage the two steps. The framework can manage several anomaly detection processes simultaneously and can add or remove anomaly detection algorithms dynamically. So we can do comprehensive analysis using multiple algorithms and compare the result between different algorithms, which is useful for algorithm design.(2) An anomaly detection algorithm based on system behavior analysis is proposed. First, we study the difference of extracting and analyzing between an application and the entire system and define the system as the object of the algorithm. Then, we simulate and monitor the behavior of existing malwares on Android and several items of system information are chosen to be defined as system behavior. Finally, according to the characteristics of those chosen information, an algorithm based on SOMs is proposed.(3) Concluding the extracting method of Android system behavior. The extracting method of Android system behavior is concluded. For the items of information that we cannot get through APIs provided by Android system, we give the methods to extract their approximations. |
