In this era of smartphones and tablets, increasing malware treats is a serious issue for all the gadgets users. Researchers from North Carolina State University have found a way to monitor for Android malware with very low overhead. They have devised a new and potentially better way to detect it on Android devices.
The tool that they have developed is called Practical Root Exploit Containment (PREC), it is trained to uncover aberrant code written in the C programming language, the language in which they say most malicious Android code is written. This Android malware detection tool, PREC looks for root exploits, in which a program gains system administration access rights to the entire device, which a malicious hacker can use with ill intent.
PREC uses a well-known technique for identifying malicious code, called anomaly detection. Anomaly detection compares the expected behavior of an application with how it actually behaves when it is running on a device, in terms of the system calls it makes. PREC, malware detection tool, is unique in that it can identify calls made to native C code from a Java program, and check to see if such actions fit into the application’s profile for typical usage. With this approach, PREC has been able to reduce the number of false identifications by an order of magnitude, compared to other anomaly detectors.
The researchers have tested a prototype on 150 Android apps, of which 140 were benevolent and 10 contained root exploits. The experiments were run on a Google Galaxy Nexus and on an emulator. This android malware detection tool was able to identify all of the root exploits with a minimum number of false alarms.
Researchers now hope to convince the app stores, such as the Google Play Store, to create a database describing the typical performance characteristics of all their apps. They could use PREC to build these assessments. Then when a user downloads a new app, the Android device can also download the PREC execution profile for that application, and use that profile to monitor for any unusual activity coming from the app.
While app marketplace operators such as Apple or Google already screen the apps submitted to their stores, malware programmers have learned how to bury their code within an app so it doesn’t execute until after the program has been downloaded, to overcome this researchers have come with PREC.
PREC is not the only Android malware detector based on anomaly detection, there is also, Crowdroid using crowd-sourcing model available to determine the routine app behavior. But those detectors require more processing power on the portable devices; compare to PREC, according to the NCSU researchers. Running PREC typically incurs about 3 percent overhead on the system, compared to the 15 to 30 percent overhead incurred by Crowdroid and Android.