| With the rapid increasing of computing power, handheld mobile devices equipped with intelligent operating system gradually blend in our lives, becoming an important part of daily activities. Those handheld mobile devices often store a large of private information, such as contacts, SMS, e-mails, files, which covers all aspects of people’s life and work. As the widespread popularity of smart phones and explosive growth of malicious applications, the security of smart phones is facing many challenges.Android malware often abuses system resources to realize malicious intents. It is urgent to develop a tool to analyze the resource usage behavior inside an app. Traditional system-call based behavior analysis techniques meet problems when applied to Android due to Android’s special permission model. In Android’s permission model, resources are no longer mainly protected by Linux Kernel. Instead, system resources are protected by system services and accessed through Android APIs.To address this problem, this dissertation proposes SysTracker which is a system-call based resource usage monitoring technique for Android. By recovering the API information from a pile of system calls, SysTracker could precisely monitor the (sensitive) resource use behaviors from the outside of an application. SysTracker is suitable for any version of Android platform because it doesnot need to modify the application or Android system.SysTracker intercepts and captures the system calls of Android application by using ptrace, and parses the necessary information of the system calls. Then SysTracker use automated testing tools on a set of applications to build the system call to API maps. Finally SysTracker transfers the system calls to corresponding API and permission by searching the pre-build map to identify the resource use behaviors.SysTracker is showed to correctly identify99.2%API s in a large-scale experiment. SysTracker is also used to analyze real Android apps and the result shows that SysTracker could greatly reduce the analysis burden and clearly figure the resource usage behavior inside an app. |
