DroidLight: Lightweight Anomaly-based Intrusion Detection System for Smartphone Devices
DroidLight: Lightweight Anomaly-based Intrusion Detection System for Smartphone Devices
复制标题
DOI：
10.1145/3369740.3369796
复制
发表时间：
2020-01
期刊：
影响因子：
--
通讯作者：
Sakil Barbhuiya;P. Kilpatrick;Dimitrios S. Nikolopoulos
中科院分区：
文献类型：
--
作者：
Sakil Barbhuiya;P. Kilpatrick;Dimitrios S. Nikolopoulos
随着市场上智能手机应用程序的增长，智能手机恶意软件攻击也在增加。研究人员提出了使用各种方法检测恶意软件攻击的技术，其中广泛包括基于签名和异常的入侵检测系统（IDS）。基于异常的IDS通常需要使用从运行良性和恶意软件应用程序中收集的数据集来训练机器学习模型。这可能导致在检测零日恶意软件（即先前未看到或记录的恶意软件）时检测准确度较低。在本文中，我们提出了DroidLight，一个轻量级的IDS，可以检测零日恶意软件的效率和有效性。我们为DroidLight设计了一种基于单类分类和概率分布分析的算法。对于每个智能手机应用程序，分类模型学习其正常的CPU利用率和网络流量模式。如果存在与正常模式的任何显著偏离，则模型标记入侵警报。通过部署三款自主研发的恶意软件，我们对DroidLight进行了真实的评估，即在真实的用户与真实的设备进行交互的情况下进行评估，评估结果表明DroidLight可以检测到智能手机恶意软件，准确率从93.3%到100%，而对设备资源的总开销仅为1.5%。
Smartphone malware attacks are increasing alongside the growth of smartphone applications in the market. Researchers have proposed techniques to detect malware attacks using various approaches, which broadly include signature and anomaly-based intrusion detection systems (IDSs). Anomaly-based IDSs usually require training machine learning models with datasets collected from running both benign and malware applications. This may result in low detection accuracy when detecting zero-day malwares, i.e. those not previously seen or recorded. In this paper, we propose DroidLight, a lightweight IDS which can detect zero-day malware efficiently and effectively. We designed an algorithm for DroidLight that is based on one class classification and probability distribution analysis. For each smartphone application, the classification model learns its normal CPU utilisation and network traffic pattern. The model flags an intrusion alert if there is any significant deviation from the normal pattern. By deploying three self-developed malwares we performed realistic evaluation of DroidLight, i.e. the evaluation was performed on a real device while a real user was interacting with it. Evaluation results demonstrate that DroidLight can detect smartphone malwares with accuracy ranging from 93.3% to 100% while imposing only 1.5% total overhead on device resources.