MR-Droid: A scalable and prioritized analysis of inter-app communication risks

Fang Liu; Haipeng Cai; Gang Wang; Danfeng Yao; Karim O. Elish; Barbara G. Ryder

doi:10.1109/SPW.2017.12

MR-Droid: A scalable and prioritized analysis of inter-app communication risks

Fang Liu
, Haipeng Cai
, Gang Wang
, Danfeng Yao
, Karim O. Elish
, Barbara G. Ryder

Department of Computer Science and Engineering

Virginia Polytechnic Institute and State University
Florida Polytechnic University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

31 Scopus citations

Abstract

Inter-Component Communication (ICC) enables useful interactions between mobile apps. However, misuse of ICC exposes users to serious threats, allowing malicious apps to access privileged user data via another app. Unfortunately, existing ICC analyses are largely insufficient in both accuracy and scalability. Most approaches rely on single-app ICC analysis which results in inaccurate and excessive alerts. A few recent works use pairwise app analysis, but are limited by small data sizes and scalability. In this paper, we present MR-Droid, a MapReduce-based computing framework for accurate and scalable inter-app ICC analysis in Android. MR-Droid extracts data-flow features between multiple communicating apps to build a large-scale ICC graph. We leverage the ICC graph to provide contexts for inter-app communications to produce precise alerts and prioritize risk assessments. This scheme requires quickly processing a large number of app-pairs, which is enabled by our MapReduce-based program analysis. Extensive experiments on 11,996 apps from 24 app categories (13 million pairs) demonstrate the effectiveness of our risk prioritization scheme. Our analyses also reveal new real-world hijacking attacks and collusive app pairs. Based on our findings, we provide practical recommendations for reducing inter-app communication risks.

Original language	English
Title of host publication	Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	189-198
Number of pages	10
ISBN (Electronic)	9781538619674
DOIs	https://doi.org/10.1109/SPW.2017.12
State	Published - Dec 19 2017
Event	12th IEEE Symposium on Security and Privacy Workshops, SPW 2017 - San Jose, United States Duration: May 25 2017 → …

Publication series

Name	Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017
Volume	2017-December

Conference

Conference	12th IEEE Symposium on Security and Privacy Workshops, SPW 2017
Country/Territory	United States
City	San Jose
Period	05/25/17 → …

Keywords

Android ICC
MapReduce
Risk Prioritization
Security Analysis

Access to Document

10.1109/SPW.2017.12

Cite this

Liu, F., Cai, H., Wang, G., Yao, D., Elish, K. O., & Ryder, B. G. (2017). MR-Droid: A scalable and prioritized analysis of inter-app communication risks. In Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017 (pp. 189-198). (Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017; Vol. 2017-December). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/SPW.2017.12

@inproceedings{6468296d72eb492d8582fc16a4c14760,

title = "MR-Droid: A scalable and prioritized analysis of inter-app communication risks",

abstract = "Inter-Component Communication (ICC) enables useful interactions between mobile apps. However, misuse of ICC exposes users to serious threats, allowing malicious apps to access privileged user data via another app. Unfortunately, existing ICC analyses are largely insufficient in both accuracy and scalability. Most approaches rely on single-app ICC analysis which results in inaccurate and excessive alerts. A few recent works use pairwise app analysis, but are limited by small data sizes and scalability. In this paper, we present MR-Droid, a MapReduce-based computing framework for accurate and scalable inter-app ICC analysis in Android. MR-Droid extracts data-flow features between multiple communicating apps to build a large-scale ICC graph. We leverage the ICC graph to provide contexts for inter-app communications to produce precise alerts and prioritize risk assessments. This scheme requires quickly processing a large number of app-pairs, which is enabled by our MapReduce-based program analysis. Extensive experiments on 11,996 apps from 24 app categories (13 million pairs) demonstrate the effectiveness of our risk prioritization scheme. Our analyses also reveal new real-world hijacking attacks and collusive app pairs. Based on our findings, we provide practical recommendations for reducing inter-app communication risks.",

keywords = "Android ICC, MapReduce, Risk Prioritization, Security Analysis",

author = "Fang Liu and Haipeng Cai and Gang Wang and Danfeng Yao and Elish, \{Karim O.\} and Ryder, \{Barbara G.\}",

note = "Publisher Copyright: {\textcopyright} 2017 IEEE.; 12th IEEE Symposium on Security and Privacy Workshops, SPW 2017 ; Conference date: 25-05-2017",

year = "2017",

month = dec,

day = "19",

doi = "10.1109/SPW.2017.12",

language = "English",

series = "Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "189--198",

booktitle = "Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017",

address = "United States",

}

Liu, F, Cai, H, Wang, G, Yao, D, Elish, KO & Ryder, BG 2017, MR-Droid: A scalable and prioritized analysis of inter-app communication risks. in Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017. Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017, vol. 2017-December, Institute of Electrical and Electronics Engineers Inc., pp. 189-198, 12th IEEE Symposium on Security and Privacy Workshops, SPW 2017, San Jose, United States, 05/25/17. https://doi.org/10.1109/SPW.2017.12

MR-Droid: A scalable and prioritized analysis of inter-app communication risks. / Liu, Fang; Cai, Haipeng; Wang, Gang et al.
Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017. Institute of Electrical and Electronics Engineers Inc., 2017. p. 189-198 (Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017; Vol. 2017-December).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - MR-Droid

T2 - 12th IEEE Symposium on Security and Privacy Workshops, SPW 2017

AU - Liu, Fang

AU - Cai, Haipeng

AU - Wang, Gang

AU - Yao, Danfeng

AU - Elish, Karim O.

AU - Ryder, Barbara G.

PY - 2017/12/19

Y1 - 2017/12/19

N2 - Inter-Component Communication (ICC) enables useful interactions between mobile apps. However, misuse of ICC exposes users to serious threats, allowing malicious apps to access privileged user data via another app. Unfortunately, existing ICC analyses are largely insufficient in both accuracy and scalability. Most approaches rely on single-app ICC analysis which results in inaccurate and excessive alerts. A few recent works use pairwise app analysis, but are limited by small data sizes and scalability. In this paper, we present MR-Droid, a MapReduce-based computing framework for accurate and scalable inter-app ICC analysis in Android. MR-Droid extracts data-flow features between multiple communicating apps to build a large-scale ICC graph. We leverage the ICC graph to provide contexts for inter-app communications to produce precise alerts and prioritize risk assessments. This scheme requires quickly processing a large number of app-pairs, which is enabled by our MapReduce-based program analysis. Extensive experiments on 11,996 apps from 24 app categories (13 million pairs) demonstrate the effectiveness of our risk prioritization scheme. Our analyses also reveal new real-world hijacking attacks and collusive app pairs. Based on our findings, we provide practical recommendations for reducing inter-app communication risks.

AB - Inter-Component Communication (ICC) enables useful interactions between mobile apps. However, misuse of ICC exposes users to serious threats, allowing malicious apps to access privileged user data via another app. Unfortunately, existing ICC analyses are largely insufficient in both accuracy and scalability. Most approaches rely on single-app ICC analysis which results in inaccurate and excessive alerts. A few recent works use pairwise app analysis, but are limited by small data sizes and scalability. In this paper, we present MR-Droid, a MapReduce-based computing framework for accurate and scalable inter-app ICC analysis in Android. MR-Droid extracts data-flow features between multiple communicating apps to build a large-scale ICC graph. We leverage the ICC graph to provide contexts for inter-app communications to produce precise alerts and prioritize risk assessments. This scheme requires quickly processing a large number of app-pairs, which is enabled by our MapReduce-based program analysis. Extensive experiments on 11,996 apps from 24 app categories (13 million pairs) demonstrate the effectiveness of our risk prioritization scheme. Our analyses also reveal new real-world hijacking attacks and collusive app pairs. Based on our findings, we provide practical recommendations for reducing inter-app communication risks.

KW - Android ICC

KW - MapReduce

KW - Risk Prioritization

KW - Security Analysis

UR - https://www.scopus.com/pages/publications/85025658766

U2 - 10.1109/SPW.2017.12

DO - 10.1109/SPW.2017.12

M3 - Conference contribution

AN - SCOPUS:85025658766

T3 - Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017

SP - 189

EP - 198

BT - Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 25 May 2017

ER -

Liu F, Cai H, Wang G, Yao D, Elish KO, Ryder BG. MR-Droid: A scalable and prioritized analysis of inter-app communication risks. In Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017. Institute of Electrical and Electronics Engineers Inc. 2017. p. 189-198. (Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017). doi: 10.1109/SPW.2017.12

MR-Droid: A scalable and prioritized analysis of inter-app communication risks

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this