Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Mining apps for abnormal usage of sensitive data

: Avdiienko, Vitalii; Kuznetsov, Konstantin; Gorla, Alessandra; Zeller, Andreas; Arzt, Steven; Rasthofer, Siegfried; Bodden, Eric


Institute of Electrical and Electronics Engineers -IEEE-; Association for Computing Machinery -ACM-; IEEE Computer Society, Technical Council on Software Engineering:
IEEE/ACM 37th IEEE International Conference on Software Engineering, ICSE 2015. Proceedings. Vol.1, Pt.1 : Florence, Italy, 16 - 24 May 2015
Piscataway, NJ: IEEE, 2015
ISBN: 978-1-4799-1935-2
ISBN: 978-1-4799-1934-5
International Conference on Software Engineering (ICSE) <37, 2015, Florence>
Conference Paper
Fraunhofer SIT ()

What is it that makes an app malicious? One important factor is that malicious apps treat sensitive data differently from benign apps. To capture such differences, we mined 2,866 benign Android applications for their data flow from sensitive sources, and compare these flows against those found in malicious apps. We find that (a) for every sensitive source, the data ends up in a small number of typical sinks; (b) these sinks differ considerably between benign and malicious apps; (c) these differences can be used to flag malicious apps due to their abnormal data flow; and (d) malicious apps can be identified by their abnormal data flow alone, without requiring known malware samples. In our evaluation, our MUDFLOW prototype correctly identified 86.4% of all novel malware, and 90.1% of novel malware leaking sensitive data.