Publication:
TriFlow: Triaging Android Applications using Speculative Information Flows

Simple item page
dc.affiliation.dptoUC3M. Departamento de Informáticaes
dc.affiliation.grupoinvUC3M. Grupo de Investigación: COSEC (Computer SECurity Lab)es
dc.contributor.authorMirzaei, Omid
dc.contributor.authorSuarez-Tangil, Guillermo
dc.contributor.authorEstévez Tapiador, Juan Manuel
dc.contributor.authorFuentes García-Romero de Tejada, José María de
dc.date.accessioned2018-03-15T16:35:46Z
dc.date.available2018-03-15T16:35:46Z
dc.date.issued2017-04-02
dc.description.abstractInformation flows in Android can be effectively used to give an informative summary of an application’s behavior, showing how and for what purpose apps use specific pieces of information. This has been shown to be extremely useful to characterize risky behaviors and, ultimately, to identify unwanted or malicious applications in Android. However, identifying information flows in an application is computationally highly expensive and, with more than one million apps in the Google Play market, it is critical to prioritize applications that are likely to pose a risk. In this work, we develop a triage mechanism to rank applications considering their potential risk. Our approach, called TRIFLOW, relies on static features that are quick to obtain. TRIFLOW combines a probabilistic model to predict the existence of information flows with a metric of how significant a flow is in benign and malicious apps. Based on this, TRIFLOW provides a score for each application that can be used to prioritize analysis. TRIFLOW also provides an explanatory report of the associated risk. We evaluate our tool with a representative dataset of benign and malicious Android apps. Our results show that it can predict the presence of information flows very accurately and that the overall triage mechanism enables significant resource saving.en
dc.description.sponsorshipThis work was supported by the MINECO grants TIN2013-46469-R and TIN2016-79095-C2-2-R, and by the CAM grant S2013/ICE-3095.en
dc.format.mimetypeapplication/pdf
dc.identifier.bibliographicCitationRamesh Karri, Ozgur Sinanoglu, Ahmad-Reza Sadeghi, Xun Yi. Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, AsiaCCS 2017, Abu Dhabi, United Arab Emirates, April 2-6, 2017. ACM, 640-651
dc.identifier.doihttp://dx.doi.org/10.1145/3052973.3053001
dc.identifier.isbn978-1-4503-4944-4
dc.identifier.publicationfirstpage640
dc.identifier.publicationlastpage651
dc.identifier.publicationtitleProceedings of the 2017 ACM on Asia Conference on Computer and Communications Security
dc.identifier.urihttps://hdl.handle.net/10016/26107
dc.identifier.uxxiCC/0000027270
dc.language.isoeng
dc.publisherACM
dc.relation.eventdate2017-04-02
dc.relation.eventplaceEmiratos Arabes Unidoses
dc.relation.eventtitleACM Asia Conference on Computer and Communications Security (ASIACCS) 2017
dc.relation.projectIDGobierno de España. TIN2013-46469-R/SPINY
dc.relation.projectIDComunidad de Madrid. S2013/ICE-3095/CIBERDINE
dc.rightsACM New York, NY, USA ©2017
dc.rights.accessRightsopen access
dc.subject.ecienciaInformáticaes
dc.subject.otherAndroid securityen
dc.subject.otherMalware analysisen
dc.subject.otherInformation flowen
dc.subject.otherApp triageen
dc.titleTriFlow: Triaging Android Applications using Speculative Information Flowsen
dc.typeconference proceedings*
dc.type.hasVersionAM*
dspace.entity.typePublication
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
triflow_asiaccs_2017_ps.pdf
Size:
1.33 MB
Format:
Adobe Portable Document Format
Download
Collections
DI - COSEC - Capítulos de Monografías