On-device anomaly detection for resource-limited systems
On-device anomaly detection for resource-limited systems
复制标题
针对资源有限系统的设备端异常检测
DOI：
--
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
Mario Couture
中科院分区：
文献类型：
--
作者：
Maroua Ben Attia;C. Talhi;A. Hamou;B. Khosravifar;Vincent Turpaud;Mario Couture
随着智能手机等小型嵌入式系统的快速发展，移动的恶意软件变得越来越复杂和危险。针对Android智能手机的一个重要攻击媒介是重新包装合法应用程序以注入恶意活动，其中这种重新包装可以在智能手机上安装应用程序之前或之后执行。为了检测由注入的恶意活动引起的应用程序的行为偏差，通常应用复杂的异常检测算法，然而它们需要超出这些小规模设备的能力的系统资源预算。本文重点研究了设备上异常检测算法的可用性，并提出了一个基于Android设备的检测框架。所提出的解决方案允许使用远程服务器，而不完全依赖于它。实验结果允许建立资源消耗配置文件的研究异常检测算法，从而提供可靠的测量，帮助定义检测精度和资源消耗之间的权衡。
As small-scale embedded systems such as Smartphones rapidly evolve, mobile malwares grow increasingly more sophisticated and dangerous. An important attack vector targeting Android Smartphone is repackaging legitimate applications to inject malicious activities, where such repackaging can be performed before or after the installation of applications on the Smartphone. To detect the behaviour deviation of applications caused by the injected malicious activities, complex anomaly detection algorithms are usually applied, however they require a system resources budget that is beyond the capacities of these small-scale devices. This paper focuses on the usability of on-device anomaly detection algorithms and proposes a detection framework for Android-based devices. The proposed solution allows using a remote server without relying entirely on it. The experimental results allow building resources consumption profiles of the studied anomaly detections algorithms and thus, provide reliable measurements that help define trade-offs between detection accuracy and resource consumption.