Nội dung được dịch bởi AI, chỉ mang tính chất tham khảo
Phân tích về phần mềm quảng cáo trên Android
Tóm tắt
Hầu hết các ứng dụng trên điện thoại thông minh Android đều miễn phí, điều này dẫn đến việc hiển thị quảng cáo khi ứng dụng được sử dụng để tạo doanh thu. Hàng tỷ đô la bị mất hàng năm do phần mềm quảng cáo thực hiện gian lận quảng cáo. Trong nghiên cứu này, chúng tôi đề xuất và phân tích một phương pháp dựa trên học máy để phát hiện phần mềm quảng cáo trên Android dựa trên các đặc điểm tĩnh và động. Chúng tôi thu thập các đặc điểm tĩnh từ tệp manifest, trong khi các đặc điểm động được lấy từ lưu lượng mạng. Sử dụng các đặc điểm này, chúng tôi phân loại các ứng dụng Android thành phần mềm quảng cáo hoặc không và phân loại thêm từng mẫu phần mềm quảng cáo vào một gia đình cụ thể. Chúng tôi áp dụng nhiều kỹ thuật học máy khác nhau, bao gồm mạng nơ-ron, rừng ngẫu nhiên, AdaBoost và máy vectơ hỗ trợ. Chúng tôi chứng minh rằng sự kết hợp của các đặc điểm tĩnh và động là hiệu quả nhất, và chúng tôi nhận thấy rằng, một cách trớ trêu, vấn đề phân loại phần mềm quảng cáo đa lớp còn dễ hơn so với vấn đề phát hiện nhị phân.
Từ khóa
#Android #phần mềm quảng cáo #học máy #phân loại #đặc điểm tĩnh #đặc điểm độngTài liệu tham khảo
Android for all: Android architecture. https://letsknowaboutandroid.wordpress.com/about/, June 2013
Android.spy.277.origin, dr. web. https://vms.drweb.com/virus/?_is=1&i=8020079&lng=en, 2016
Arora, A., Peddoju, S.K.: Minimizing network traffic features for android mobile malware detection. In: Proceedings of the 18th International Conference on Distributed Computing and Networking, ICDCN ’17, pp. 32:1–32:10. ACM (2017)
Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K.: Drebin: Effective and explainable detection of android malware in your pocket. In: 21st Annual Network and Distributed System Security Symposium, NDSS 2014. The Internet Society (2014)
Bluestacks. https://www.bluestacks.com, 2018
Bradley, A.P.: The use of the area under the roc curve in the evaluation of machine learning algorithms. Pattern Recognit. 30(7), 1145–1159 (1997)
Cimpanu, C.: CopyCat adware infects Zygote Android core process, bleepingcomputer. https://www.bleepingcomputer.com/news/security/copycat-adware-infects-zygote-android-core-process/, 2017
Crussell, J., Stevens, R., Chen, H.: Madfraud: investigating ad fraud in Android applications. In: Proceedings of the 12th Annual International Conference on Mobile Systems, Applications, and Services, pp. 123–134. ACM (2014)
Daswani, N., Stoppelman, M.: The anatomy of Clickbot.A. In: Proceedings of the First Conference on Hot Topics in Understanding Botnets, HotBots ’07, pp. 11–31. USENIX Association, Berkeley (2007)
Enck, W., Gilbert, P., Han, S., Tendulkar, V., Chun, B.-G., Cox, L.P., Jung, J., McDaniel, P., Sheth, A.N.: TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones. ACM Trans. Comput. Syst. 32(2), 5 (2014)
Geater, J.: How to remove Android:Hamob-D. https://www.solvusoft.com/en/malware/potentially-unwanted-application/android-hamob-d/
GhostClicker adware is a phantomlike Android click fraud. TrendLabs Security Intelligence Blog. http://blog.trendmicro.com/trendlabs-security-intelligence/ghostclicker-adware-is-a-phantomlike-android-click-fraud/, August (2017)
Grace, M., Zhou, Y., Zhang, Q., Zou, S., Jiang, X.: Riskranker. In: Proceedings of the 10th International Conference on Mobile Systems, Applications, and Services, MobiSys’12 (2012)
Grace, M.C., Zhou, W., Jiang, X., Sadeghi, A.-R.: Unsafe exposure analysis of mobile in-app advertisements. In: Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks, pp. 101–112. ACM (2012)
How the CopyCat malware infected Android devices around the world. CheckPoint Blog. https://blog.checkpoint.com/2017/07/06/how-the-copycat-malware-infected-android-devices-around-the-world/, July (2017)
HummingBad—a persistent mobile chain attack. CheckPoint Blog. https://blog.checkpoint.com/2016/02/04/hummingbad-a-persistent-mobile-chain-attack/, March (2017)
Kapratwar, A., Troia, F.D., Stamp, M.: Static and dynamic analysis of android malware. In: Proceedings of the 3rd International Conference on Information Systems Security and Privacy (2017)
Lashkari, A.H., Gil, G.D., Mamun, M.S.I., Ghorbani, A.A.: Characterization of Tor traffic using time based features. In: Proceedings of the 3rd International Conference on Information Systems Security and Privacy (2017)
Lashkari, A.H., Kadir, A.F.A., Gonzalez, H., Mbah, K.F., Ghorbani, A.A.: Towards a network-based framework for android malware detection and characterization. In: Proceeding of the 15th International Conference on Privacy, Security and Trust, PST’17 (2017)
Liu, B., Nath, S., Govindan, R., Liu, J.: DECAF: Detecting and characterizing ad fraud in mobile apps. In: Proceedings of the 11th USENIX Conference on Networked Systems Design and Implementation, NSDI’14, pp. 57–70. USENIX Association (2014)
Metwally, A., Agrawal, D., El Abbadi, A.: Detectives: detecting coalition hit inflation attacks in advertising networks streams. In: Proceedings of the 16th international conference on World Wide Web, pp. 241–250. ACM (2007)
Miller, B., Pearce, P., Grier, C., Kreibich, C., Paxson, V.: What’s clicking what? Techniques and innovations of today’s clickbots. In: Proceedings of the 8th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA’11, pp. 164–183. Springer (2011)
Monkeyrunner (2018). https://developer.android.com/studio/test/monkeyrunner/. Accessed 7 Dec 2018
Moonsamy, V., Rong, J., Liu, S.: Mining permission patterns for contrasting clean and malicious Android applications. Future Gener. Comput. Syst. 36, 122–132 (2014)
Naked Security: The Google Play adware apps that just won’t die. https://nakedsecurity.sophos.com/2017/06/16/the-google-play-adware-apps-that-just-wont-die/, June (2017)
Plisson, F.: Choosing the right features—feature importance and selection (2018). https://www.fabienplisson.com/tag/recursive-feature-elimination//. Accessed 7 Dec 2018
Rahul, R.K., Anjali, T., Menon, V.K., Soman, K.P.: Deep learning for network flow analysis and malware classification. In: Communications in Computer and Information Science Security in Computing and Communications: Proceedings of the 5th International Symposium on Security in Computing and Communications, SSCC 2017, pp. 226–235 (2017)
Sampi: Chinese programmatic ads—6 most common types of ad fraud in China. https://sampi.co/6-most-common-types-ad-fraud-in-china/
Sharma, D.: Android malware detection using decision trees and network traffic. Int. J. Comput. Sci. Inf. Technol. 7(4), 1970–1974 (2016)
Sizmek: Impressions that inspire. https://www.sizmek.com/media/filer_public/eb/13/eb13ee88-972e-441a-a879-8e641609b4c2/casestudy_060514_fraud.pdf
Stamp, M.: Introduction to Machine Learning with Applications in Information Security. Chapman and Hall/CRC, Boca Raton (2017)
Statista: Distribution of free and paid Android apps 2017. https://www.statista.com/statistics/266211/distribution-of-free-and-paid-android-apps/, January (2018)
Statista: Multilayer perceptrons. http://www.helsinki.fi/~ahonkela/dippa/node41.html, January (2018)
Styk, M.: Github: Martinstyk/apkanalyzer. https://github.com/MartinStyk/ApkAnalyzer
The Judy malware — possibly the largest malware campaign found on Google Play. CheckPoint Blog. https://blog.checkpoint.com/2017/05/25/judy-malware-possibly-largest-malware-campaign-found-google-play/, May (2017)
Tomita, M.: Marketo: 7 reasons digital advertising wins. https://blog.marketo.com/2015/11/join-the-big-league-7-reason-to-go-digital-with-your-advertising.html, September (2016)
VirusTotal (2018). https://www.virustotal.com/#/home/upload. Accessed 7 Dec 2018
Wang, T.L.: Blackhat: AI based antivirus: Detecting android malware variants with a deep learning system. https://www.blackhat.com/docs/eu-16/materials/eu-16-Wang-AI-Based-Antivirus-Can-Alphaav-Win-The-Battle-In-Which-Man-Has-Failed.pdf
Wang, W., Zhu, M., Zeng, X., Ye, X., Sheng, Y.: Malware traffic classification using convolutional neural network for representation learning. In: 2017 International Conference on Information Networking (ICOIN), pp. 712–717 (2017)
Whatis.com: What is ad fraud? http://whatis.techtarget.com/definition/ad-fraud
Whatis.com: What is adware? https://searchsecurity.techtarget.com/definition/adware
Wireshark (2018). https://www.wireshark.org. Accessed 7 Dec 2018
Yan, L.-K., Yin, H.: DroidScope: Seamlessly reconstructing the OS and Dalvik semantic views for dynamic Android malware analysis. In: USENIX Security Symposium, pp. 569–584 (2012)
Zhang, L., Guan, Y.: Detecting click fraud in pay-per-click streams of online advertising networks. In: The 28th International Conference on Distributed Computing Systems, ICDCS’08, pp. 77–84. IEEE (2008)