a machine learning approach for classifying and
play

A Machine-learning Approach for Classifying and Categorizing - PowerPoint PPT Presentation

A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks Siegfried Rasthofer, Steven Arzt, Eric Bodden


  1. A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks Siegfried Rasthofer, Steven Arzt, Eric Bodden    

  2.  2   

  3. sources report potential privacy leaks code analysis code analysis sinks Dynamic Approaches: TaintDroid [OSDI’10], Aurasium [USENIX’12], “Dr. Android and Mr. Hide“[SPSM’12], etc. Static Approaches: ScanDroid [TR 09], DeD [SEC’11], CHEX [CCS’12], LeakMiner [WCSE’12], ScanDal [Most’12], AndroidLeaks [TRUST’12], SAAF [SAC’13], FlowDroid [PLDI’14], etc.  3   

  4. ...but wait  4   

  5. sources report potential privacy leaks code analysis sinks  5   

  6. Method TaintDroid SCanDroid DeD ? Location.getLongitude() Location.getLatitude() Browser.getAllBookmarks() SmsManager.sendTextMessage Log.d() URL.openConnection()  6   

  7. Extracting Sources/Sinks Cat. 1 ... Cat. 2 List of Android API Sources ... Cat. n GoogleGlass API Oracle SuSi Cat. 1 Cat. 2 List of Chromecast API Sinks ... Cat. n ...  7   

  8. Machine-Learning Approach  8   

  9. Feature-Database: Classification specific return-type „ getter “ returns a value modifier dataflow to return  9   

  10. Feature-Database: Classification Feature-Categories: ‣ Method name ‣ Method has parameters ‣ Method’s return type ‣ Parameter type ‣ Method modifiers ‣ Modifiers of declaring class ‣ Name of declaring class ‣ Dataflow to return value ‣ Dataflow from parameter to (abstract) sink  10   

  11. Feature-Database: Categorization ... SMS/MMS Location Calendar Contact ... SMS/MMS NFC Internet Bluetooth Email  11   

  12. Evaluation Ten-fold cross validation: training better T P Recall = T P + F N T P Precision = T P + F P  12   

  13. Evaluation Chromecast GoogleGlass Manual validation: ‣ Google Glass API: Precision: 98% and Recall: 100% ‣ Google Chromecast API: Precision and Recall: 100%  13   

  14. Evaluation  14   

  15. Top Source/Sink Methods in Android-Malware Method TaintDroid SCanDroid DeD BluetoothAdapter.getAddress() WifiInfo.getMacAddress() Locale.getCountry() WifiInfo.getSSID() GsmCellLocation.getCid() GsmCellLocation.getLac() Location.getLongitude() Location.getLatitude() Browser.getAllBookmarks() SmsManager.sendTextMessage Log.d() URL.openConnection()  15   

  16. Newly discovered sources by SuSi Previously known sources Android 4.2 API SuSi’s categorized sources 2 % SuSi’s categorized sinks 2 % 5 % 98 % Newly discovered sinks by SuSi Previously known sinks 92 % 1 % 99 %  16   

  17. Open-Source on GitHub: https://github.com/secure-software-engineering/SuSi Siegfried Rasthofer Secure Software Engineering Group (EC-SPRIDE) Email: siegfried.rasthofer@cased.de Blog: http://sse-blog.ec-spride.de  17   

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend