Abstract
People-centric sensing (PCS) is an emerging paradigm of sensor network which turns daily used mobile devices (such as smartphones and PDAs) to sensors. It is promising but faces severe security problems. As smartphones are already and will keep up to be attractive targets to attackers, even more, with strong connectivity and homogeneous applications, all mobile devices in PCS will risk being infected by malware more rapidly. Even worse, attackers usually obfuscate their malwares in order to avoid simple (syntactic signature based) detection. Thus, more intelligent (behavioral signature based) detection is needed. But in the field of network security, the state-of-the-art behavioral signature—behavior graph—is too complicated to be used in mobile devices. This paper proposes a novel behavioral signature generation system—SimBehavior—to generate lightweight behavioral signature for malware detection in PCS. Generated lightweight behavioral signature is a bit like regex (regular expression) rules. And thus, unlike malware detection using behavior graph is NP-Complete, using our lightweight behavioral signature is efficient and very suitable for malware detection in PCS. Our experimental results show that SimBehavior can extract behavioral signatures effectively, and generated lightweight behavioral signatures can be used to detect new malware samples in PCS efficiently and effectively.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
References
Johnson, P., Kapadia, A., Kotz, D., & Triandopoulos, N. (2007). People-centric urban sensing: Security challenges for the new paradigm. Dartmouth Computer Science Technical Report TR2007-586.
Felt, A. P., Finifter, M., Chin, E., et al. (2011). A survey of mobile malware in the wild. In First workshop on security and privacy in smartphones and mobile devices (CCS-SPSM’11). Chicago, Illinois, USA.
Symantec Corporation (2012). Internet Security Threat Report-2011 Trends Volume 17. Available: http://www.symantec.com/threatreport/
Symantec Corporation (2013). Internet Security Threat Report-2012 Trends Volume 18. Available: http://www.symantec.com/threatreport/
Rastogi, V., Chen, Y., & Jiang, X. (2013). DroidChameleon: Evaluating android anti-malware against transformation attacks. Short Paper. In Proceedings of the 8th ACM symposium on information, computer and communications Security (ASIACCS).
You, I., & Yim, K. (2010). Malware obfuscation techniques: A brief survey. In 2010 International conference on broadband, wireless computing, communication and applications.
Forrest, S., Longstaff, T. A., & Hofmeyr, S. A. (1996). A sense of self for unix processes. In Proceedings of the 1996 IEEE symposium on security and privacy.
Christodorescu, M., Jha, S., & Kruegel, C. (2007). Mining specifications of malicious behavior. In Proceedings of the 6th joint meeting of the European software engineering conference and the ACM SIGSOFT symposium on the foundations of software engineering.
Clemens, K., Paolo, M. C., Christopher, K., et al. (2009). Effective and efficient malware detection at the end host. In USENIX Security’09.
Fredrikson, M., Christodorescu, M., & Jha, S. (2011). Dynamic behavior matching: A complexity analysis and new approximation algorithms. In 23rd international conference on Automated deduction, LNAI 6803 (pp. 252–267).
Hoglund, G., & Butler, J. (2005). Rootkits: subverting the Windows kernel. Reading, MA: Addison-Wesley Professional.
Lanzi, A., Balzarotti, D., Kruegel, C. et al. (2010). AccessMiner: Using system-centric models for malware protection. In CCS’10.
Wikipedia. System call [Online]. Available: http://en.wikipedia.org/wiki/System_call, September, 2012
Srivastava, A., Lanzi, A., & Giffin, J. (2008). System call API obfuscation (Extended Abstract). In RAID’08.
Fredrikson, M., Jha, S., Christodorescu, M. et al. (2010). Synthesizing near-optimal malware specifications from suspicious behaviors. In Proceedings of the 2010 IEEE symposium on security and privacy.
Mark Russinovich. Inside the Native API [Online]. Available: http://netcode.cz/img/83/nativeapi.html, September, 2012
Wikipedia. Handle (computing) [Online]. Available: http://en.wikipedia.org/wiki/Handle_(computing), September, 2012
Bayer, U., Habibi, I., & Balzarotti, D. (2009). A view on current malware behaviors. In 2nd USENIX workshop on large-scale exploits and emergent threats (LEET’09).
Dreger, H., Feldmann, A., Mai, M., Paxson, V., & Sommer, R. (2005). Dynamic application-layer protocol analysis for network intrusion detection. In 15th USENIX security symposium.
Wikipedia. Sequence alignment [Online]. Available: http://en.wikipedia.org/wiki/Sequence_alignment, May, 2013
Tang, Y., Xiao, B., & Lu, X. (2009). Using a bioinformatics approach to generate accurate exploit-based signatures for polymorphic worms. Computers & Security, 28, 827–842.
Needleman, S. B., & Wunsch, C. D. (1970). A general method applicable to the search for similarities in the amino acid sequence of two proteins. Journal of Molecular Biology, 48(3), 4430453.
Notredame, C., Higgins, D. G., & Heringa, J. (2000). T-coffee: A novel method for fast and accurate multiple sequence alignment. Journal of Molecular Biology, 302(1), 2050217.
Li, Z., Sanghi, M., Chen, Y., et al. (2006). Hamsa: Fast signature generation for zero-day polymorphic worms with provable attack resilience. In IEEE symposium on security and privacy 2006.
mwanalysis. [Online]. http://mwanalysis.org/
[Online]. http://code.google.com/p/wusstrace/
Acknowledgments
This work is supported by Program No. IRT 1012, the NSF of China Program No. 61202488, the Research Fund for the Doctoral Program of Higher Education of China No. 20124307120032, the NSF of China Program No. 61103194, the 863 Program of China Nos. 2009AA01A346 and 2011AA01A103, and the NSF of China Program No. 61003303. We appreciate anonymous reviewers for their valuable suggestions and comments.
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
About this article
Cite this article
Lu, H., Zhao, B., Su, J. et al. Generating Lightweight Behavioral Signature for Malware Detection in People-Centric Sensing. Wireless Pers Commun 75, 1591–1609 (2014). https://doi.org/10.1007/s11277-013-1400-9
Published:
Issue Date:
DOI: https://doi.org/10.1007/s11277-013-1400-9