• Home

  • Technology

  • Web-based Security Analysis Tool for Android Applications
1
WebVbased Security Analysis Tool for Android Applications Computer Science DepartmentP Metropolitan College Nebiyu FelekeP Tandhy SimanjuntakP Wenjie ShiP Yuting ZhangP Lou Chitkushev naberraP tandhyP wjshiP danazhP [email protected] OnNgoing Work Architecture Our Tool Other WebNbased Analysis Tools Motivation www.idc.com www.kaspersky.com Every fifth AndroidVbased device with Kaspersky solutions was attacked by malware during reported period www.kaspersky.com Anubis A web portal of android applications security Application Security Analysis based on Category Proposed Work Implicit Open omponents in Finance and Medical Applications A framework to analyze the security of android applications through static analysis Propose and implement a number of metrics complementary to those in many existing webNbased analysis tools: Identify Root Exploit and Malicious Domain Identify Hidden File and Code Loading Identify Open Components Identify Dangerous Permissions Combination Identify ReNDelegation Identify Over Privilege Analysis Tool Page Search Tool Page Application Security Evolution Analysis Identify and classify applications with similar functionality based on applicationsE descriptions using keyword analysis Investigate the association between keywords and other security metrics such as permissions Perform both individual and collective analysis ReNdelegation Open Components OverNprivilege Dangerous Permissions Combination Hidden Files Malicious Domains Root Exploit Code Loading Types of Metrics Changed Proposed Work Identify more security metrics that can be used for evolution analysis, including those used in other existing tools Investigate the possible security evolution patterns of applications Distribution of Added Vulnerabilities Distribution of Deleted Vulnerabilities Investigate the possible security patterns of applications with similar functionality Number of Types of Metrics Changed Percentage of Dataset Metrics include: Details of Three Metrics Type of Metrics Percentage of Dataset Number of Added Vulnerabilities Percentage of Applicable Dataset Percentage of Applicable Dataset Number of Deleted Vulnerabilities Total Downloaded Applications based on Category Percentage of Root Exploit Applications based on Category Total Number Category Total Percentage Category Total Percentage Percentage of Total Over Privilege Applications based on Category Category Investigate possible update attacks, particularly through anomaly detection

Web-based Security Analysis Tool for Android Applications

Embed Size (px)

DESCRIPTION

a web-based security analysis tool for android applications poster session at Advanced Cyber Security Center Annual Conference 2014, Boston, Nov 5th, 2014.

Citation preview

Page 1: Web-based Security Analysis Tool for Android Applications

WebVbasedhSecurityhAnalysishToolhforhAndroidhApplicationsComputerhSciencehDepartmentPhMetropolitanhCollege

NebiyuhFelekePhTandhyhSimanjuntakPhWenjiehShiPhYutinghZhangPhLouhChitkushevhhnaberraPhtandhyPhwjshiPhdanazhPhltc@bu.edu

OnNgoingIWork

Architecture

OurITool

OtherIWebNbasedIAnalysisITools

Motivation

www.idc.com

www.kaspersky.com

EveryhfifthhAndroidVbasedhdevicehwithhKasperskyhsolutionshwashattackedhbyhmalwarehduringhreportedhperiod

www.kaspersky.com

Anubis

AIwebIportalIofIandroidIapplicationsIsecurity

ApplicationISecurityIAnalysisIbasedIonICategory

ProposedIWork

ImplicitIOpenIomponentsIinIFinanceIandIMedicalIApplications

AIframeworkItoIanalyzeItheIsecurityIofIandroidIapplicationsIthroughIstaticIanalysis

ProposeIandIimplementIaInumberIofImetricsIcomplementaryItoIthoseIinImanyIexistingIwebNbasedIanalysisItools:

IdentifyIRootIExploitIandIMaliciousIDomain

IdentifyIHiddenIFileIandICodeILoading

IdentifyIOpenIComponents

IdentifyIDangerousIPermissionsICombinationI

IdentifyIReNDelegation

IdentifyIOverIPrivilege

AnalysishToolhPage

SearchhToolhPage

ApplicationISecurityIEvolutionIAnalysis

IdentifyIandIclassifyIapplicationsIwithIsimilarfunctionalityIbasedIonIapplicationsEIdescriptionsIusingIkeywordIanalysis

InvestigateItheIassociationIbetweenIkeywordsIandotherIsecurityImetricsIsuchIasIpermissions

PerformIbothIindividualIandIcollectiveIanalysis

ReNdelegationOpenIComponentsOverNprivilegeDangerousIPermissionsICombinationHiddenIFilesMaliciousIDomainsRootIExploitCodeILoading

TypesIofIMetricsIChangedI

ProposedIWorkIdentifyImoreIsecurityImetricsIthatIcanIbeusedIforIevolutionIanalysis,IincludingIthoseusedIinIotherIexistingItools

InvestigateItheIpossibleIsecurityIevolutionpatternsIofIapplications

DistributionhofhAddedhVulnerabilities DistributionhofhDeletedhVulnerabilities

InvestigateItheIpossibleIsecurityIpatternsIofIapplicationsIwithIsimilarIfunctionality

NumberIofITypesIofIMetricsIChangedI

Per

cen

tage

IofI

Dat

aset

I

MetricsIinclude:

DetailsIofIThreeIMetricsI

TypeIofIMetricsI

Per

cen

tage

IofI

Dat

aset

I

NumberIofIAddedIVulnerabilitiesI

Per

cen

tage

IofI

Ap

plic

able

IDat

aset

I

Per

cen

tage

IofI

Ap

plic

able

IDat

aset

I

NumberIofIDeletedIVulnerabilitiesI

TotalIDownloadedIApplicationsIbasedIonICategory

IPercentageIofIRootIExploitIApplicationsIbasedIonICategory

Tota

lINu

mb

erI

Category

Tota

lIPer

cen

tage

I

Category

Tota

lIPer

cen

tage

I

PercentageIofITotalIOverIPrivilegeIApplicationsIbasedIonICategory

Category

InvestigateIpossibleIupdateIattacks,particularlyIthroughIanomalyIdetection

Building Android Applications

Building Android Applications

Documents
Developing Android applications in Windows · Developing Android applications in Windows Below you will find information about the components needed for developing Android applications

Developing Android applications in Windows · Developing Android applications in Windows Below you will find information about the components needed for developing Android applications

Documents
Securing Android Applications Dario Incalza - OWASP Android Applications @h4oxer 12. Securing Android Applications ... Debugger (GDB)

Securing Android Applications Dario Incalza - OWASP Android Applications @h4oxer 12. Securing Android Applications ... Debugger (GDB)

Documents
AAGILE Android Applications

AAGILE Android Applications

Documents
[ Utility ] Android Tool V1

[ Utility ] Android Tool V1

Documents
Pentesting Android Applications

Pentesting Android Applications

Technology
Tuning Android Applications Ver04

Tuning Android Applications Ver04

Documents
Android push-applications-android

Android push-applications-android

Technology
FALCAAppium is an open source automation tool for running scripts and testing native applications, mobile-web applications and hybrid applications on Android or iOS using a webdriver

FALCAAppium is an open source automation tool for running scripts and testing native applications, mobile-web applications and hybrid applications on Android or iOS using a webdriver

Documents
Android and it’s applications

Android and it’s applications

Technology
Android talks #08 decompiling android applications

Android talks #08 decompiling android applications

Software
Detection of Malicious Android Mobile Applications Based ... · B. Existing Crowdroid System . Existing . Crowdroid [6] system used . Strace. tool which can be run on Android based

Detection of Malicious Android Mobile Applications Based ... · B. Existing Crowdroid System . Existing . Crowdroid [6] system used . Strace. tool which can be run on Android based

Documents
Creating Android Applications

Creating Android Applications

Documents
Securing Android Applications

Securing Android Applications

Technology
android - developing applications

android - developing applications

Documents
Android adb command line tool

Android adb command line tool

Education
Cross compiling android applications

Cross compiling android applications

Education
Android Talks #05 - UI optimization of Android applications

Android Talks #05 - UI optimization of Android applications

Technology
Android Editing applications

Android Editing applications

Education
Chp4 - Applications Android

Chp4 - Applications Android

Technology
Developing Secure Mobile Applications For Android€¦ · DEVELOPING SECURE MOBILE APPLICATIONS FOR ANDROID An introduction to making secure Android applications Jesse Burns . AndroidSecurityPaper@isecpartners.com

Developing Secure Mobile Applications For Android€¦ · DEVELOPING SECURE MOBILE APPLICATIONS FOR ANDROID An introduction to making secure Android applications Jesse Burns . [email protected]

Documents
45 android applications

45 android applications

Documents
ANDROID AND ANDROID APPLICATIONS - University of Colorado Boulder

ANDROID AND ANDROID APPLICATIONS - University of Colorado Boulder

Documents
ANDROID AND ANDROID APPLICATIONS

ANDROID AND ANDROID APPLICATIONS

Documents
Android Applications Security

Android Applications Security

Technology
On-Device Bug Reporting for Android Applicationsdenys/pubs/MobileSoft'17-OBBR-Tool... · On-Device Bug Reporting for Android Applications ... put and GUI information capable of being

On-Device Bug Reporting for Android Applicationsdenys/pubs/MobileSoft'17-OBBR-Tool... · On-Device Bug Reporting for Android Applications ... put and GUI information capable of being

Documents
A Prototype of Comparison Tool for Android Applications Based on Difference of API Calling Sequences

A Prototype of Comparison Tool for Android Applications Based on Difference of API Calling Sequences

Documents
Android 101 Writing And Publishing Android Applications

Android 101 Writing And Publishing Android Applications

Technology
Running Android Applications on BlackBerry 10developer.blackberry.com/android/files/webinars/BlackBerry_Runtime... · Running Android Applications on BlackBerry 10 developer.blackberry.com/android

Running Android Applications on BlackBerry 10developer.blackberry.com/android/files/webinars/BlackBerry_Runtime... · Running Android Applications on BlackBerry 10 developer.blackberry.com/android

Documents
Android Security - Common Security Pitfalls in Android Applications

Android Security - Common Security Pitfalls in Android Applications

Technology