Effective Android Malware Mitigation Framework using Ownership based Protection and Machine Learning Techniques

Abstract

Android provides a highly flexible development environment with various forms of collaboration mechanisms between applications. Recent advancements in context-aware technologies demand apps to use PendingIntent (PI), which allows an app, a.k.a., the sender, to delegate a task, e.g., making a phone call, to a third-party app, a.k.a., the receiver, such that the receiver can execute the task with the same Android permissions held by the sender at some future time. While convenient, this feature may potentially lead to serious attacks in case the receiver app happens to be malicious, e.g., denial-of-service or disruption. Between 2020 and 2022, approximately 91 CVEs on PI vulnerabilities were reported, with 4 recent attacks just reported in late 2022. newlineTo address these issues, our research introduces StickyMutent, a security-enhanced authorization framework aimed to detect and protect against emerging PI-based attacks. StickyMutent implements a novel approach to dynamically verify not only that both sender and receiver are free from exploit codes, but also that the receiver app holds a superset of the permissions held by the sender app at runtime, thereby avoiding excess privileges that can lead to the occurrence of the aforementioned attacks. newlineWe performed an exploratory analysis using 23922 apps, and found out that 6355 apps create vulnerable PI (i.e. PI with empty base Intent), 260 apps leak the vulnerable PI implicitly. 715 apps use protected broadcast to communicate with other apps, and 3454 apps use implicit Intent for communication with other apps. We have evaluated StickyMutent on 83 benchmark apps, and our results show that StickyMutent can effectively (F1-score: 90% for intra-application analysis, and 95% for inter-application analysis) prevent PI-based attacks with negligible performance overhead (and#8764;0.005%). newlineAdditionally, we extend our proposed framework with a novel clustering technique that uses Mahalanobis distance metrics rather than Euclidean metrics to classify the apps based on their vulnerabilities