Propagation, detection and containment of mobile malware

摘要: Today's enterprise systems and networks are frequent targets of malicious attacks, such as worms, viruses, spyware intrusions that can disrupt, or even disable critical services. Recent trends suggest by combining a payload with worms delivery mechanism, programs potentially be used for industrial espionage identity theft. The problem is compounded further the increasing convergence wired, wireless cellular networks, since virus writers now write malware crossover from one network segment to another, exploiting services vulnerabilities specific each network. This dissertation makes four primary contributions. First, it builds more accurate propagation models emerging hybrid (i.e., use multiple vectors Bluetooth, Email, Peer-to-Peer, Instant Messaging, etc.), addressing key factors heterogeneity nodes, user mobility within Second, develops proactive containment framework based on group-behavior hosts against agents in an setting. majority today's anti-virus solutions reactive, i.e., these activated only after activity has been detected at node In contrast, potential closing vulnerable ahead infection, thereby halting spread malware. Third, we study (1) current-generation mobile viruses target SMS/MMS messaging Bluetooth handsets, corresponding exploits, (2) their impact large SMS provider using real-life data. Finally, propose new behavioral approach detecting targeting handsets. Our concept generalized patterns instead traditional signature-based detection. methods not scalable deployment devices due limited resources available typical Further, demonstrate compact footprint, but also detect classes combine some features existing