CRII: SaTC: Towards Non-Intrusive Detection of Resilient Mobile Malware and Botnet using Application Traffic Measurement

移动互联网经济的发展给人们和社会带来了许多好处，提供了无处不在的计算和通信。移动设备已经渗透到我们生活的几乎方方面面，因此存储了大量的个人数据。不幸的是，移动互联网的前景很容易被“智能”恶意软件和僵尸网络破坏，造成了一种不稳定的情况，即存储在移动设备上的敏感数据可能会通过移动互联网泄露给对手，或者大量受损的移动设备可能会发起拒绝服务攻击，以摧毁移动基础设施。该项目开发基于网络的非侵入性解决方案，以检测移动恶意软件和僵尸网络，并减轻它们的影响，以确保移动通信以可信的方式进行，尽管存在潜在的安全威胁。这项研究为了解移动恶意软件的传播机制和恶意意图提供了有价值的见解，并将启发移动应用程序网络行为分析的研究。该项目还通过创建新的移动安全课程项目和模块，拓宽学生对移动系统安全的看法，并指导下一代移动开发人员在设计移动协议和应用程序时考虑安全和隐私，从而产生了重要的教育影响。该项目解决了开发基于网络的移动恶意软件检测系统中的三个紧密交织的研究问题。第一部分通过识别恶意软件的网络相关应用程序接口(API)和设计新的输入来激活恶意软件的隐蔽网络行为来调查恶意软件流量收集。第二部分重点设计了一个基于网络的恶意软件检测系统，该系统根据恶意软件的网络行为识别潜在的恶意软件特征，进而提供对移动恶意软件的准确和唯一的识别。第三部分重点研究了基于群体行为的检测机制，用于从恶意僵尸网络中识别有组织的网络活动，这些恶意僵尸网络建立在恶意软件的协作之上。将开发一个本地试验台来评估所提出的技术和系统设计的性能，以确保所开发的技术适合在真实的移动系统中部署。该项目使用机器学习技术、统计工具和网络流量分析来支持移动网络中的安全通信。

The development of the mobile Internet economy has brought numerous benefits to people and society, with the promise of providing ubiquitous computing and communications. Mobile devices have penetrated almost every aspect of our lives and, as a result, are storing a large amount of personal data. Unfortunately, the promise of the mobile Internet is easily undermined by "smart" malware and botnets, creating a precarious situation in which sensitive data stored on mobile devices could be leaked to adversaries through the mobile Internet or a wealth of compromised mobile devices could launch a denial of service attack to destruct the mobile infrastructure. This project develops non-intrusive, network-based solutions to detect mobile malware and botnets and mitigate their impact to ensure that mobile communications are carried out in a trustworthy manner despite the potential security threats. The research offers valuable insights into mobile malware's spreading mechanisms and malicious intents and will inspire studies in network behavior analysis of mobile applications. The project also has an important educational impact via the creation of new mobile security course projects and modules, widening students' views of mobile system security, and guiding next-generation mobile developers to include security and privacy considerations in designing mobile protocols and apps. This project addresses three closely intertwined research issues in developing a network-based mobile malware detection system. The first part focuses on investigating malware traffic collection by identifying malware's network-related application program interfaces (APIs) and designing novel inputs to activate the malware's covert network behaviors. The second part focuses on designing a network-based malware detection system that identifies potential malware features based on their malicious network behaviors, which in turn will provide precise and unique identification of mobile malware. The third part focuses on the development of group behavior based detection mechanisms to identify organized network activities from malicious botnets that are built on the cooperation of malware. A local testbed will be developed to evaluate the performance of the proposed techniques and system designs, which aims to guarantee that the technologies developed are suitable for deployment in real mobile systems. The project uses machine learning techniques, statistical tools, and network traffic analysis to support secure communications in mobile networks.