AI Approaches for Mobile Devices Security

AI Approaches for Mobile Devices Security and Data Protection
(or How to put Smartness in MobileDevices Apps)

Mobile devices are becoming ubiquitous with an exponential growth in just ten years, Android being leader among the mobile OS. Google Play is the prime distribution ecosystem for Android apps with more than 2.2 million unique apps, and more than 65 billion downloads: with worldwide app store revenue exceeding 8.3 billion USD till 2015. Mobile devices (smartphone, tablets) have become ubiquitous, since they centralize sensitive user information, email accounts, contacts, and unite multiple sensors. The availability of rich information for financial incentive motivates cybercriminals to target the Android ecosystem. Cyber criminals are employing tailored malware to target such a vibrant ecosystem by gaining access to confidential and sensitive user information.

Since the mobile devices have access to sensitive information such as contact details, device location and digital wallets, information theft and monetary loss with premium rate SMS, data stealing and multiple apps collusion and threaten the mobile ecosystem. Recent studies back up such statements with respect to mobile marketplaces being abused to host malware or legitimate looking applications (apps) embedded inside malicious components

There is a paradigm shift from the situation where malware was developed just for fun, to a time when malware writer has financial motives of profit: a representative example being the recent spread of ransomware, asking for ransom being paid in bitcoins (hence, even non-traceable money transfers). Given the importance of the problem, significant research efforts have been invested in gaining a better understanding of the mobile malware phenomenon. However, due to the rate at which both market and mobile malware is growing, a significant research effort is still needed to fully understand and mitigate such attacks.

Our approach uses machine learning techniques to detect malware Android apps. We use a large dataset of benign and malicious apps and then, we explore them using retro-engineering tools to extract features and to build classifiers. This first approach, static analysis,  gives good accuracy of detection but is not sufficient since malware authors are using reflection and code obfuscation  to subvert their detection by static analyzers. Thus we developed a platform for dynamic analysis.  We use it to execute apps, and thus to observe and analyze their behavior and collect more features.