Uncovering the Face of Android Ransomware: Characterization and Real-Time Detection
Uncovering the Face of Android Ransomware: Characterization and Real-Time Detection
复制标题
揭开 Android 勒索软件的面纱：特征描述和实时检测
DOI：
10.1109/tifs.2017.2787905
复制
发表时间：
2018-05-01
影响因子：
6.8
通讯作者：
Ahn, Gail-Joon
中科院分区：
文献类型：
--
作者：
Chen, Jing;Wang, Chiheng;Ahn, Gail-Joon
近年来，我们目睹了勒索软件的急剧增加，特别是在包括Android在内的流行移动平台上。勒索软件通过控制受害者的设备或文件来勒索一笔钱。鉴于它们的快速增长，迫切需要制定有效的对策。然而，研究界仍然受到缺乏全面数据集的限制，并且对野外的移动勒索软件没有深刻的理解。本文以Android平台为研究对象，对现有的Android勒索软件进行特征分析。具体来说，我们已经收集了2721个勒索软件样本，涵盖了大多数现有的Android勒索软件家族。基于这些样本，我们从时间轴和恶意特征等几个方面对它们进行了系统的表征。此外，现有反病毒工具的检测结果相当令人失望，这显然需要定制反移动勒索软件解决方案。为了检测通过加密数据敲诈用户的勒索软件，我们提出了一种新的实时检测系统，称为ransomprobe。ransomprobe通过分析相关活动的用户界面小部件和用户手指移动的坐标，可以推断出文件加密操作是否由用户发起。实验结果表明，ransomprobe能够有效检测加密勒索软件，具有较高的准确率和良好的运行性能。
In recent years, we witnessed a drastic increase of ransomware, especially on popular mobile platforms including Android. Ransomware extorts victims for a sum of money by taking control of their devices or files. In light of their rapid growth, there is a pressing need to develop effective countermeasure solutions. However, the research community is still constrained by the lack of a comprehensive data set, and there exists no insightful understanding of mobile ransomware in the wild. In this paper, we focus on the Android platform and aim to characterize existing Android ransomware. Specifically, we have managed to collect 2,721 ransomware samples that cover the majority of existing Android ransomware families. Based on these samples, we systematically characterize them from several aspects, including timeline and malicious features. In addition, the detection results of existing anti-virus tools are rather disappointing, which clearly calls for customized anti-mobile-ransomware solutions. To detect ransomware that extorts users by encrypting data, we propose a novel real-time detection system, called RansomProber. By analyzing the user interface widgets of related activities and the coordinates of users’ finger movements, RansomProber can infer whether the file encryption operations are initiated by users. The experimental results show that RansomProber can effectively detect encrypting ransomware with high accuracy and acceptable runtime performance.