Tap-Wave-Rub: lightweight malware prevention for smartphones using intuitive human gestures

We introduce a lightweight permission enforcement approach - Tap-Wave-Rub (TWR) - for smartphone malware prevention. TWR is based on simple human gestures (implicit or explicit) that are very quick and intuitive but less likely to be exhibited in users' daily activities. Presence or absence of such gestures, prior to accessing an application, can effectively inform the OS whether the access request is benign or malicious. In this paper, we focus on the design of an accelerometer-based phone tapping detection mechanism. This implicit tapping detection mechanism is geared to prevent malicious access to NFC services, where a user is usually required to tap her phone with another device. We present a variety of novel experiments to evaluate the proposed mechanism. Our results suggest that our approach could be very effective for malware prevention, with quite low false positives and false negatives, while imposing no additional burden on the users. As part of the TWR framework, we also briefly explore explicit gestures (finger tapping, rubbing or hand waving based on proximity sensor), which could be used to protect services which do not have a unique implicit gesture associated with them.