Abstract
SafeGuard is proposed as a solution to monitor behaviors of smartphone applications in real-time and detect and block any malicious behaviors. This solution consists of a server that manages and deploys the blocking rules and the device solution that monitors various applications in Android devices. The proposed scheme provides users with real-time malware information such as spyware detected by the SafeGuard library upon suspicious API call within the Android platform. Except for use of Rootkit at the kernel level, the scheme can detect behaviors that use the API from the platform or caused by a combination of those APIs. The database that determines any malicious behaviors can be periodically updated to block various malicious behaviors by using preemptive responses different from existing anti-virus products. For this purpose, the behaviors of smartphone applications are classified and are defined for monitoring. The architecture to apply them is also proposed in the Android framework and the proposed scheme is applied in the Android smartphone environment to verify its stability and feasibility through measuring the overhead in the environment.
Original language | English |
---|---|
Pages (from-to) | 18153-18173 |
Number of pages | 21 |
Journal | Multimedia Tools and Applications |
Volume | 76 |
Issue number | 17 |
DOIs | |
Publication status | Published - 2017 Sept 1 |
Bibliographical note
Funding Information:This work was supported by the ICT R&D program of MSIP/IITP. [R0101-15-0195(10043959), Development of EAL 4 level military fusion security solution for protecting against unauthorized accesses and ensuring a trusted execution environment in mobile devices
Publisher Copyright:
© 2016, Springer Science+Business Media New York.
Keywords
- Android malware detection
- Android platform
- Behavior detection
- Mobile multimedia application
- Mobile security
ASJC Scopus subject areas
- Software
- Media Technology
- Hardware and Architecture
- Computer Networks and Communications