...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Future generation computer systems >SneakLeak+: Large-scale klepto apps analysis
【24h】

SneakLeak+: Large-scale klepto apps analysis

机译：Sneakleak +：大规模的Klepto Apps分析

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

User data is touted as new oil in our times of digital economy. Colluding apps can pose a threat to leak private information in Android. In this paper, a technique is proposed to address the threat emanating from multiple colluding Android applications (apps). Android framework is not made to protect the data that is going outside an app. In such a scenario, individual app shall appear benign whereas conspiring apps, if present, can leak sensitive end-user data to other sinks. This phenomenon of intentional data leakage is termed as collusion, and involved apps are called colluding apps. Existing app analyzers focused on single app analysis which gets defeated by scattering leaking instructions across multiple apps. We present SneakLeak+, a model-checking based technique for detection of app collusion. The proposed method can analyze multiple apps simultaneously to identify the set of colluding apps. SneakLeak+ statically analyzes the reverse engineered intermediate code of each app, extract security relevant information, and represent the extracted information into a compact form suitable for formal verification. The formal analysis engine is used to verify the presence/absence of potential inter-app communication-based leakage. Since, official Android app repository, Google Play Store offer massive number of apps, volumetric analysis is crucial for purposeful contribution. To maintain scalability of the proposed method, we build an abstract model of the apps that represent only potential leaks. Currently, there is no standard app dataset available to verify efficacy and scalability of methods dealing with collusion detection. Hence, we developed 64 apps exhibiting collusion as our benchmark dataset, now, available as open-source. To demonstrate the efficacy and scalability of our proposal, we conduct a set of experiments on 11,000 apps from Google Play Store and benchmark datasets. Our experiments show that SneakLeak+ achieves highest precision (100%), highest recall (93.3%) and highest F-measure (0.97) as compared to existing state-of-art approaches. On an average, it will take around 142 min to analyze the entire device.
机译：在我们的数字经济中，用户数据被吹捧为新油。勾结应用程序可能会在Android中泄漏私人信息威胁。在本文中，提出了一种技术来解决来自多个勾结Android应用程序的威胁（应用程序）。 android框架不是为了保护应用程序外的数据。在这样的场景中，单个应用程序应出现良性，而是阴谋应用程序，如果存在，可以将敏感的最终用户数据泄漏到其他汇位。故意数据泄漏的这种现象被称为勾结，并且涉及的应用程序称为勾结应用程序。现有的应用分析仪专注于单个应用程序分析，通过跨多个应用程序分散泄漏指令来击败。我们呈现Sneakleak +，一种基于模型检查的技术，用于检测应用勾结。该方法可以同时分析多个应用程序以识别群组集合。 Sneakleak +静态分析每个应用的反向工程中间代码，提取安全相关信息，并将提取的信息代表到适合形式验证的紧凑表单中。正式的分析引擎用于验证基于潜在的应用间通信泄漏的存在/不存在。自从官方Android应用程序存储库以来，Google Play商店提供大量的应用程序，体积分析对于有目的的贡献至关重要。为了保持所提出的方法的可扩展性，我们构建了一个应用程序的抽象模型，该应用程序只表示潜在的泄漏。目前，没有标准的应用数据集可用于验证处理串行检测的方法的功效和可扩展性。因此，我们开发了64个应用程序，展示勾结为我们的基准数据集，现在可用作开源。为了展示我们提案的功效和可扩展性，我们在Google Play商店和基准数据集中开展了一组关于11,000个应用程序的实验。我们的实验表明，与现有的最先进方法相比，Sneakleak +达到最高精度（100％），最高召回（93.3％）和最高的F测量（0.97）。平均而言，它将需要大约142分钟来分析整个设备。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号