a machine learning approach for classifying and
play

A Machine-learning Approach for Classifying and Categorizing - PowerPoint PPT Presentation

A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks Siegfried Rasthofer, Steven Arzt, Eric Bodden


  1. A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks Siegfried Rasthofer, Steven Arzt, Eric Bodden    

  2.  2   

  3. sources report potential privacy leaks code analysis code analysis sinks Dynamic Approaches: TaintDroid [OSDI’10], Aurasium [USENIX’12], “Dr. Android and Mr. Hide“[SPSM’12], etc. Static Approaches: ScanDroid [TR 09], DeD [SEC’11], CHEX [CCS’12], LeakMiner [WCSE’12], ScanDal [Most’12], AndroidLeaks [TRUST’12], SAAF [SAC’13], FlowDroid [PLDI’14], etc.  3   

  4. ...but wait  4   

  5. sources report potential privacy leaks code analysis sinks  5   

  6. Method TaintDroid SCanDroid DeD ? Location.getLongitude() Location.getLatitude() Browser.getAllBookmarks() SmsManager.sendTextMessage Log.d() URL.openConnection()  6   

  7. Extracting Sources/Sinks Cat. 1 ... Cat. 2 List of Android API Sources ... Cat. n GoogleGlass API Oracle SuSi Cat. 1 Cat. 2 List of Chromecast API Sinks ... Cat. n ...  7   

  8. Machine-Learning Approach  8   

  9. Feature-Database: Classification specific return-type „ getter “ returns a value modifier dataflow to return  9   

  10. Feature-Database: Classification Feature-Categories: ‣ Method name ‣ Method has parameters ‣ Method’s return type ‣ Parameter type ‣ Method modifiers ‣ Modifiers of declaring class ‣ Name of declaring class ‣ Dataflow to return value ‣ Dataflow from parameter to (abstract) sink  10   

  11. Feature-Database: Categorization ... SMS/MMS Location Calendar Contact ... SMS/MMS NFC Internet Bluetooth Email  11   

  12. Evaluation Ten-fold cross validation: training better T P Recall = T P + F N T P Precision = T P + F P  12   

  13. Evaluation Chromecast GoogleGlass Manual validation: ‣ Google Glass API: Precision: 98% and Recall: 100% ‣ Google Chromecast API: Precision and Recall: 100%  13   

  14. Evaluation  14   

  15. Top Source/Sink Methods in Android-Malware Method TaintDroid SCanDroid DeD BluetoothAdapter.getAddress() WifiInfo.getMacAddress() Locale.getCountry() WifiInfo.getSSID() GsmCellLocation.getCid() GsmCellLocation.getLac() Location.getLongitude() Location.getLatitude() Browser.getAllBookmarks() SmsManager.sendTextMessage Log.d() URL.openConnection()  15   

  16. Newly discovered sources by SuSi Previously known sources Android 4.2 API SuSi’s categorized sources 2 % SuSi’s categorized sinks 2 % 5 % 98 % Newly discovered sinks by SuSi Previously known sinks 92 % 1 % 99 %  16   

  17. Open-Source on GitHub: https://github.com/secure-software-engineering/SuSi Siegfried Rasthofer Secure Software Engineering Group (EC-SPRIDE) Email: siegfried.rasthofer@cased.de Blog: http://sse-blog.ec-spride.de  17   

Recommend


More recommend