RT Conference Proceedings
T1 TriFlow: Triaging Android Applications using Speculative Information Flows
A1 Mirzaei, Omid
A1 Suarez-Tangil, Guillermo
A1 Estévez Tapiador, Juan Manuel
A1 Fuentes García-Romero de Tejada, José María de
AB Information flows in Android can be effectively used to give an informative summary of an application’s behavior, showing how and for what purpose apps use specific pieces of information. This has been shown to be extremely useful to characterize risky behaviors and, ultimately, to identify unwanted or malicious applications in Android.   However,  identifying  information  flows  in  an  application is computationally highly expensive and, with more than one million apps in the Google Play market, it is critical to prioritize applications that are likely to pose a risk. In this work, we develop a triage mechanism to rank applications considering their potential risk.  Our approach, called TRIFLOW, relies on static features that are quick to obtain. TRIFLOW combines a probabilistic model to predict the existence of information flows with a metric of how significant a flow is in benign and malicious apps.  Based on this, TRIFLOW provides a score for each application that can be used to prioritize analysis.  TRIFLOW also provides an explanatory report of the associated risk.  We evaluate our tool with a representative dataset of benign and malicious Android apps.  Our results show that it can predict the presence of information flows very accurately and that the overall triage mechanism enables significant resource saving.
PB ACM
SN 978-1-4503-4944-4
YR 2017
FD 2017-04-02
LK https://hdl.handle.net/10016/26107
UL https://hdl.handle.net/10016/26107
LA eng
NO This work was supported by the MINECO grants TIN2013-46469-R and TIN2016-79095-C2-2-R, and by the CAM grant S2013/ICE-3095.
DS e-Archivo
RD 30 jun. 2024