Search

Smartphones are enriched by applications (apps) available through the mobile ecosystem. Various studies have reported that apps leaking sensitive user and device information are the primary target ...

Deduplication is a widely used technology to reduce the storage and communication cost for cloud storage services. For any cloud infrastructure, data confidentiality is one of the primary concerns. Data confidentiality can be achieved via user-side encryption. However, conventional encryption mechanism is at odds with deduplication. Developing a user-side encryption mechanism with deduplication is a vital research topic. Existing state-of-the-art solutions in security of deduplication are vulnerable to dictionary attacks and tag inconsistency anomaly. In this paper, we present SPARK, a novel approach for secure pseudorandom key-based encryption for deduplicated storage. SPARK achieves semantic security along with deduplication. Security analysis proves that SPARK is secure against dictionary attacks and tag inconsistency anomaly. As a proof of concept, we implement SPARK in realistic environment and demonstrate its efficiency and effectiveness.

Android, the dominant smart device Operating System (OS) has evolved into a robust smart device platform since its release in 2008. Naturally, cyber criminals leverage fragmentation among varied major release by employing novel attacks. Machine learning is extensively used in System Security. Shallow Learning classifiers tend to over-learn during the training time; hence, the model under performs due to dependence on training data during real evaluation. Deep learning has the potential to automate detection of newly discovered malware families that learn the generalization about malware and benign files to be able to detect unseen or zero-day malware attacks.

The performance of Computer system did not increase rapidly despite growing computing power. It depends on many other factors, but often it found rapidly degraded due to improper handling of resources like resource leakage, the flaw in programming, resource exhaustion or malicious attacks. These vulnerabilities became solemn when it affected hues number of users in the open-source cloud. This paper exhibits the degradations of virtual machines (VMs) availability in cloud-computing due to malicious attacks. Simulation result shows how orphaned VMs accumulate over time due to VM leakage and effected pool of resources. The paper describe some techniques applicable at multiple components of the cloud to identify and eliminate the orphaned VMs. Finally the experimental results show that how orphan control technique improved the availability of VMs even during various malicious attacks.

Pervasive growth of Internet of Things (IoT) is visible across the globe. The 2016 Dyn cyberattack exposed the critical fault-lines among smart networks. Security of IoT has become a critical concern. The danger exposed by infested Internet-connected Things not only affects the security of IoT but also threatens the complete Internet eco-system which can possibly exploit the vulnerable Things (smart devices) deployed as botnets. Mirai malware compromised the video surveillance devices and paralyzed Internet via distributed denial of service attacks. In the recent past, security attack vectors have evolved bothways, in terms of complexity and diversity. Hence, to identify and prevent or detect novel attacks, it is important to analyze techniques in IoT context. This survey classifies the IoT security threats and challenges for IoT networks by evaluating existing defense techniques. Our main focus is on network intrusion detection systems (NIDSs); hence, this paper reviews existing NIDS implementation tools and datasets as well as free and open-source network sniffing software. Then, it surveys, analyzes, and compares state-of-the-art NIDS proposals in the IoT context in terms of architecture, detection methodologies, validation strategies, treated threats, and algorithm deployments. The review deals with both traditional and machine learning (ML) NIDS techniques and discusses future directions. In this survey, our focus is on IoT NIDS deployed via ML since learning algorithms have a good success rate in security and privacy. The survey provides a comprehensive review of NIDSs deploying different aspects of learning techniques for IoT, unlike other top surveys targeting the traditional systems. We believe that, this paper will be useful for academia and industry research, first, to identify IoT threats and challenges, second, to implement their own NIDS and finally to propose new smart techniques in IoT context considering IoT limitations. Moreover, the survey will enable security individuals differentiate IoT NIDS from traditional ones.

In cloud computing resource allotment is one of the most demanding areas. Resources are attempt through fixed price model by the cloud provider and users, which is not much efficient and justified scenario. The optimal processing cost for each task by using resource bidding procedures which consider the impact of cost on long-term trade. Most of the existing resource allocation techniques focus on static task based allocation. The dynamic resource bidding price model based on auction is efficient and achieves optimal cost computation. The proposed dynamic model namely Double Auction Procurement Game for Resource Allocation (DAPGRA) uses winner determination scheme for cost computation to achieve optimal resource allocation for tasks. The technique takes into account requirements of both users and Cloud Service Providers (CSPs) and calculates the final cost, based on the trade information. Results show that proposed schemes/mechanisms outperform other existing schemes/mechanism.

Android is the most popular mobile platform. Increased Android user base has attracted attackers to target the open platform and developed applications. Openness and flexibility of Android has introduced new attack surfaces and vulnerabilities that can be exploited. In this paper, we present Android vulnerabilities and also discuss the exploitation methods on the vulnerabilities and their effect across different Android OS versions. Popularity of Android OS calls for assessment of the existing versions to be tested to identify vulnerabilities that may affect large number of devices.

The exponential adoption of Android applications (apps) among the users has attracted malware authors to evade the default emulator based dynamic analysis systems. The evolving Android malware behaves benign once it identifies Goldfish emulator, often used for app development and malware analysis. Once a malware identifies the Goldfish virtual device, it behaves benign or prevents malicious code execution. The exponential increase of such stealth malware necessitates a detection approach which coerces the malicious apps to reveal the hidden behavior. To detect malicious apps and characterize their association we propose MimeoDroid (enriched replica of real Android device), a modified virtual clone to coerce the malware to believe being executed on an actual device. We automate relevant feature extraction and classification of Processor, memory usage, Binder IPC transfers, network interaction, battery charging status and manifest permission(s) to detect malicious behavior using Tree based machine learning classifiers. MimeoDroid is a lightweight machine learning based malware analysis and characterization to detect malicious apps that would evade the existing analyzers.

The demeanor towards sensitive data is an important factor to differentiate malicious apps from benign apps in Android platform. In this work, we consider the data flow path from a data source to a data sink, where ‘source’ is a non-constant data that marks the beginning of the path, and ‘sink’ is the resource where the data reaches. To accurately identify the behavioral differences, we analyzed the data flow paths in 2800 benign apps against 15000 malicious apps. We assigned weights to each path which is the absolute difference between its use in benign and malicious samples. If a path is more used by malicious apps, then weight becomes negative otherwise positive. We assigned rankings according to the popularity of the path. If the benignity rank of a path is higher than its malignity rank, then it can be inferred that the path is more used by benign application. We cover all possible paths in an application based on context-sensitivity, flow-sensitivity, and object-sensitivity of data. We name our proposed solution FlowMine. FlowMine takes these rankings and weights as its contrivance and evaluates the behavior of any test application towards maliciousness or benignity. For evaluation purpose, we took 5000 benign and 10000 malware samples. To the best of our knowledge, FlowMine is the first approach that finds the degree of similarity of an unknown sample app with known benign and malware samples for the classification of app. Our prototype excelled and correctly classified 96% of all benign apps and 98% of all novel malware leaking sensitive data.

Popularity and growth of Android mobile devices has paved the way for exploiting popular apps using various Dalvik byte code transformation methods. Testing the antimalware techniques against obfuscation identifies the need of proposing effective detection methods. In this paper, we explore the resilience of anti-malware techniques against transformations for Android. The Proposed approach employs variable compression, native code wrapping and register renaming, in addition to already implemented transformations on Dalvik byte code. Evaluation results indicate low resilience of the antimalware detection engines against code obfuscation. Furthermore, we evaluate resilience of Androguard's code similarity and AndroSimilar's robust statistical feature signature against code obfuscated malware.

Smartphones have become pervasive due to the availability of office applications, Internet, games, vehicle guidance using location-based services apart from conventional services such as voice calls, SMSes, and multimedia services. Android devices have gained huge market share due to the open architecture of Android and the popularity of its application programming interface (APIs) in the developer community. Increased popularity of the Android devices and associated monetary benefits attracted the malware developers, resulting in big rise of the Android malware apps between 2010 and 2014. Academic researchers and commercial antimalware companies have realized that the conventional signature-based and static analysis methods are vulnerable. In particular, the prevalent stealth techniques, such as encryption, code transformation, and environment-aware approaches, are capable of generating variants of known malware. This has led to the use of behavior-, anomaly-, and dynamic-analysis-based methods. Since a single approach may be ineffective against the advanced techniques, multiple complementary approaches can be used in tandem for effective malware detection. The existing reviews extensively cover the smartphone OS security. However, we believe that the security of Android, with particular focus on malware growth, study of antianalysis techniques, and existing detection methodologies, needs an extensive coverage. In this survey, we discuss the Android security enforcement mechanisms, threats to the existing security enforcements and related issues, malware growth timeline between 2010 and 2014, and stealth techniques employed by the malware authors, in addition to the existing detection methods. This review gives an insight into the strengths and shortcomings of the known research methodologies and provides a platform, to the researchers and practitioners, toward proposing the next-generation Android security, analysis, and malware detection techniques.

Popularity of Android smart phone has led to exponential increase of sophisticated malware threats prompting the academia research, security researchers and Anti Virus (AV) industry to look for smart detection methods to protect user against malware app threat. Statistical signature methods play a vital role to stop the malware authors spreading malicious content through apps. In this research, we present DroidOLytics, a statistical signature approach that creates improbable feature signature to detect unseen malicious apps from third party and official android market. Statistical signature is robust against repackaged and code obfuscated malware, popular app obfuscation techniques. DroidOLytics is a syntactic approach that finds regions of statistical similarity with known malware to detect variants of known malware families.