Skip the navigation

N.C. State researchers devise tool that detects Android malware

Researchers from North Carolina State University have found a way to monitor for Android malware with very low overhead

By Joab Jackson
March 7, 2014 01:00 PM ET

IDG News Service - With smartphones and tablets increasingly at risk from malware, researchers from North Carolina State University have devised a new and potentially better way to detect it on Android devices.

The tool they have developed, called Practical Root Exploit Containment (PREC), is trained to uncover aberrant code written in the C programming language, the language in which they say most malicious Android code is written.

PREC looks for root exploits, in which a program gains system administration access rights to the entire device, which a malicious hacker can use with ill intent.

The researchers detailed their work, captured in the paper "PREC: Practical Root Exploit Containment for Android Devices," at the Association for Computing Machinery's Conference on Data and Application Security and Privacy, which was held this week in San Antonio, Texas.

PREC uses a well-known technique for identifying malicious code, called anomaly detection. Anomaly detection compares the expected behavior of an application with how it actually behaves when it is running on a device, in terms of the system calls it makes.

PREC is unique in that it can identify calls made to native C code from a Java program, and check to see if such actions fit into the application's profile for typical usage. The bulk of software programs for Android are written in Java, which other experimental anomaly detectors have focused on.

"We've observed that most all of the existing exploits are coming from C code," said Helen Gu, an associate professor of computer science at NCSU who was involved in the work. "It's hard, if not impossible, to launch exploits in Java code, because it has to go through the virtual machine."

With this approach, PREC has been able to reduce the number of false identifications by an order of magnitude, compared to other anomaly detectors. Focusing on native C code gives PREC a more accurate model of how attacks would differ from standard operations.

The researchers tested a prototype against 150 Android apps, of which 140 were benign and 10 contained root exploits. The experiments were run on a Google Galaxy Nexus and on an emulator. PREC was able to identify all of the root exploits with a minimum number of false alarms.

What the researchers hope to do is convince app stores, such as the Google Play Store, to create a database describing the typical performance characteristics of all their apps. They could use PREC to build these assessments. Then when a user downloads a new app, the Android device can also download the PREC execution profile for that application, and use that profile to monitor for any unusual activity coming from the app.

Reprinted with permission from IDG.net. Story copyright 2014 International Data Group. All rights reserved.
Our Commenting Policies
Internet of Things: Get the latest!
Internet of Things

Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!