Mining apps for abnormal usage of sensitive data

摘要: What is it that makes an app malicious? One important factor malicious apps treat sensitive data differently from benign apps. To capture such differences, we mined 2,866 Android applications for their flow sources, and compare these flows against those found in We find (a) every source, the ends up a small number of typical sinks; (b) sinks differ considerably between apps; (c) differences can be used to flag due abnormal flow; (d) identified by alone, without requiring known malware samples. In our evaluation, mudflow prototype correctly 86.4% all novel malware, 90.1% leaking data.