See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/233780221

Intrusion Detection on Smartphones

Article · November 2012

Source: arXiv

CITATIONS READS
11 5,381

2 authors, including:

Abdulhamit Subasi
University of Turku
334 PUBLICATIONS 14,530 CITATIONS

SEE PROFILE

All content following this page was uploaded by Abdulhamit Subasi on 28 February 2014.

The user has requested enhancement of the downloaded file.

 Intrusion Detection on Smartphones
Muhamed Halilovic Abdulhamit Subasi
International Burch University International Burch University
Faculty of Engineering and Information Technologies, Faculty of Engineering and Information Technologies,
Department of Information Technologies, Sarajevo, Bosnia and Herzegovina
Sarajevo, Bosnia and Herzegovina [email protected]
[email protected]

Abstract – Smartphone technology is more and more nodes where the communication between nodes is
becoming the predominant communication tool for realized via wireless links. Due to mobility of nodes the
people across the world. People use their smartphones topology of MANETs is often changing. Due to their
to keep their contact data, to browse the internet, to inherent vulnerabilities, such as resource constrains,
exchange messages, to keep notes, carry their personal uncontrollable environment, and dynamic network
files and documents, etc. Users while browsing are also topology, wireless ad hoc networks are subject to a
capable of shopping online, thus provoking a need to variety of attacks [1].
type their credit card numbers and security codes. As Major problem with the intrusion detection systems
the smartphones are becoming widespread so do the
that were developed for mobile-ware computer
security threats and vulnerabilities facing this
technologies is a problem of CPU and memory and their
technology. Recent news and articles indicate huge
increase in malware and viruses for operating systems consumption, because smartphones and other mobile
employed on smartphones (primarily Android and devices have limited energy resources. The other major
iOS). Major limitations of smartphone technology are problem is that most other protection systems such as
its processing power and its scarce energy source since antivirus need to continually update their virus signatures
smartphones rely on battery usage. Since smartphones from the central repository and since updating of phone
are devices which change their network location as the antivirus signatures is energy-expensive it is more likely
user moves between different places, intrusion that the attackers may try to use newer kinds of attacks to
detection systems for smartphone technology are most compromise smartphones.
often classified as IDSs designed for mobile ad-hoc Dikinson states that the antivirus companies take time
networks. The aim of this research is to give a brief to update their signature repositories, and when the new
overview of IDS technology, give an overview of major kind of malware is created and placed onto the network,
machine learning and pattern recognition algorithms hackers have substantial amount of time to perform their
used in IDS technologies, give an overview of security attacks before malware signatures are updated across
models of iOS and Android and propose a new host- different machines [2].
based IDS model for smartphones and create proof-of- Other problem is that since there are many kinds of
concept application for Android platform for the newly machines certain attacks can target specific kinds of
proposed model. operating systems and machines which might not be a
Keywords: IDS, SVM, Android, iOS;
priority for certain antivirus and security companies that
serve updates to their customers. Often, smartphones fall
I. INTRODUCTION
into this category. Because of all these problems there is a
need for more general approach to solving these issues.
Smartphone’s operate in so called mobile ad-hoc
One of the major ways this can be achieved is by
networks or MANETS. Unlike to the infrastructure
utilization of machine learning and design pattern
architecture, wireless ad hoc networks consist of group of
algorithms, use of mathematical and statistical models
mobile nodes or peers which are capable of
which when applied are capable of detecting the malware
communicating with each other without a physical access
which isn’t discovered previously and which doesn’t have
point. Topology of ad-hoc network is dynamic and is
to be within the repositories of the known malware.
designed as a random graph. Other important aspects
The majority of work that deals with mobile IDS
include the spacing of the nodes and their self-organizing
systems deals with host based IDS in which methods of
abilities. Wireless medium is used to transmit data
anomaly or rule-based are utilized and used to extract and
between different stations. Several different physical
perform analysis of the features and then make decisions
layers of architecture are defined to support the wireless
on the state of the device. The extraction is done locally
medium access for mobile ad hoc networks to operate
efficiently. MANETS are basically a system of mobile
and the analysis is done either locally or on a remote 3) Secure interpose communication
server. 4) Application signing
Any smartphone IDS that would require high amount 5) Application defined and user granted
of computation on the device would lower the user permissions
experience, consume power resources, so the IDS that At the level of the operating system the Android
would truly be functional and protective for the user is platform provides the security of the Linux kernel as well
extremely challenging to design and would have to be as secure process communication (IPC) facility which
done on as lowest level OS as possible, carefully enables secure communication between applications
programming for evasion of memory leaks, etc. running in different processes. Application send-box
constraints even the native code. This ensures that if
II. ANDROID SECURITY OVERVIEW malicious application happens to get installed on the
system it will be prevented from harming the system itself
The following Android security overview is primarily and harming other applications.
based on official Android documentation. 1 The Linux provides the Android with the following
The main building blocks of Android device are security features:
Android hardware, Android operating system, and 1) User based permission model
Android application runtime. The Android runs on all 2) Process-based isolation
kinds of different hardware configurations. These include 3) Extensible mechanism for secure IPC
smartphones, tablets, set-up boxes. 4) The ability to remove potentially unsecure part
The Android operating system is composed of the core of the kernel.
which is build on top of Linux kernel. All the resources of Each application which is installed on the Android OS
the Android such as camera function, GPS-data, blue- behaves as a unique user. The Android assigns each user
tooth functions, telephony functions, network application unique ID and runs it as a separate user in a
connections, are all accessed through the operating separate process.
system. The app signing enables the users to uniquely identify
The Android application runtime is created in Java the author of the application and gives them ability to
programming language and is run in Dalvik virtual update their application without having to cope with
machine. However, many applications as well as Android complicated interfaces and permissions. When the
core services and applications are native applications or developer creates the application he has to sign it. If there
integrate native libraries. is an attempt to install an unsigned application the Google
Dalvik as well as native applications all run inside of Play store will reject it as well as the packages installed
the same security environment which is contained within on the Android device. This creates the mutual trust
the applications sandbox. Every application has its own between the Google and the developer. The application
part of the file system where its private data including can uniquely be identified and its developer and the
database and files can be written. The Android developers can be accountable for the behaviour of their
applications extend the Android core operating system applications and developers can be assure that the
and two main sources for applications are pre-installed application which is being sold or installed on users
applications and user-installed applications. Pre-installed devices is really theirs.
applications include apps such as phone, email, calendar, Application signing is the first step in placing the
browser and contacts. These are the key device application in application sandbox. The different
capabilities and are available to the user as well as other applications run under different user IDs and the signed
applications. Pre-installed applications can also be user certificate defines which user’s id is associated with
developed by OEM-specific device. which application. The app signing makes sure that one
The user installed applications are the third-party application cannot access any other application except
applications created by other developers. The Google Play through well defined IPC.
Android web store contains hundreds of thousands of Upon the installation of the APK file the package
applications. Google also provides number of cloud-base manager checks the APK for proper signature, and for the
services which can be accessed through the Android proper signing of the app included in the APK. If the
device. certificate matches the key used to sign any other APK on
Android provides the following key security features: the device the the APK has the option to specify in its
1) Robust Security at the OS level manifest that it will share UID with the similarly signed
2) Mandatory application sandbox for all APKs. The application can be signed by the third party or
applications. can be self-signed. The developers can generate a self-
signing certificate without external assistance or
1
Official Android documentation: permission (and this is the main difference with Apple’s
http://source.android.com/tech/security/index.html iOS). The applications do not have to be signed by the
central authority (iOS applications do). The central 4) Applications security – methods/techniques used
authority verification is currently not mandatory for to secure operating system and isolate individual
Android operating system. applications while they are running.
iOS puts each application in a sandbox at the install
III. IOS SECURITY OVERVIEW time and this includes its preference and its data. A
sandbox is a set of fine-grained controls which limit the
The iOS Security overview is primarily based on official apps access to resources of other applications such as
Apple documentation. 2 files, preferences, network resources, hardware and etc.
The iOS architecture at the highest level acts as an Upon its installation an application receives its own
intermediary between and underlying hardware and the sandbox directory which serves as a home for the app and
applications that appear on the screen. The apps that its data.
developer creates rarely talk directly to the underlying The main function of the sandbox model is to prevent
hardware. The interface between the application and the malicious application from damaging other applications
hardware are the system interfaces which protect the and their data. This means that application itself which
hardware from changes by the application. does contain code which can result in a security breach
This also makes it possible to easily create apps which may result in a damage of only that specific application.
work consistently on devices with different hardware The sandbox prevents the hijacked app from affecting
capabilities. other applications and other parts of the system. This
The implementation of iOS technologies can be viewed approach considers an environment in which the code is
as a set of layers which are shown in Figure 13, layers of understood not to be trusted by default and is because of
iOS. The lowest layer is the system and it contains the that isolated from processes and resources available to the
most fundamental services and technologies upon which operating systems. The apples Sandbox limits the number
applications rely. of CPU cycles an application can use as well as the
More sophisticated services and technologies are amount of memory application can use. It also restricts
placed on higher layers. Even though the lower layer apps from accessing files from outside its dedicated home
frameworks are available to the developers, developers directory.
should mostly stick with the higher level frameworks. Classes for interfacing with the camera, GPS and other
Besides having a built in security framework iOS also resources on the devices are provided by the Apple, and
gives an option to use an explicit security framework, restrictions are placed on applications from accessing
security dot framework that can be utilize to guarantee the many of the components directly. Besides this the binary
security of the data application manages. This framework code which is running on the device must be signed by
provides interfaces for managing certificates, public and Apple’s central authority and this was incorporated by the
private keys and trust policies. It includes the generation Apple into its security model from the beginning.
of cryptographically secured pseudorandom numbers. It Apple signs the application and this is the only way an
also supports the storage of certificates and cryptographic application is permitted to run under the iOS. The reason
keys in the keychain which is as we previously mentioned for this is to make sure the applications haven’t been
secure repository for user data. The common crypto modified from their original binary. The Apple also tests
library provides additional support for symmetric the integrity of an application in order to check whether
encryption HMAC, and digests. The digests feature there was unsigned code injected into the application.
provides functions that are essentially compatible with Another part of application security incorporated into
those in the OpenSSL library, which is not available in Apples devices is the encrypted key-chain which provides
iOS. central facility for storage and retrieval of network
J. Zdziarski states that iOS operating system passwords, networking credentials and other information.
incorporates four layers of security for its users and their The Apples security framework facilitates low level
data protection and these include [3] : functionality for reading and writing the data to and from
1) Device Security – methods/techniques to protect the keychain and performing encryption and decryption.
the device from unauthorized usage; The data within the key-chain is logically zoned so that
2) Data Security – methods/techniques to protect the application cannot access the encrypted data stored by
data on the device, even in case when device is different applications[3]. Apple’s Common Crypto
stolen; architecture provides cryptographic APIs to the
3) Network Security – encryption techniques used developers who would like to make use of encryption in
to encrypt data that is being sent over a network their applications.

IV. IDS ON SMARTPHONES – RELATED

2
Official Apple documentation: WORK
http://developer.apple.com/library/ios/#documentation
 Samfat and Molva propose architecture for mobile per-process basis and to allocate or find processes that
networks - IDAMN and they use anomaly detection could possibly exhaust the energy source [12].
methods as well as rule-based methods. There are three Jacoby and Davis demonstrate IDS B-BID whose
levels of detection; Location based detection (user located primary focus is detecting the attacks on battery source.
at two different locations at the same time), traffic This IDS monitors the devices electrical current and
anomaly detection (extremely low or extremely high evaluates the correlation with the known signatures and
levels network traffic), and the detection of anomalous patterns. In order to detect attacks the electrical current is
behaviour of specific mobile phone user[4]. measured and if the anomaly is detected all kinds of data
Artificial neural networks were utilized in order to such as network activity, CPU usage process count is
detect anomalous behaviour of fraud in the usage of collected and tested against known attack signatures.
operator services, for example registration with the false Additional feature is to send this data to the network
identity and using the phone to hide tariff destinations. 16 administrator [13].
distinct features representing standard mean deviation of Miettinen presented a hybrid host-and-network based
the total duration and number of long and short term IDS, because of the claim that alone, these system are not
national and international calls were used for this kind of sufficient, the engine on the server filters the received
detection [5]. alarms according to correlation rules stored in the
A collaborative proxy-based system for smartphones knowledge base and sends the results to the security
called Smartsiren was presented by Cheng and others[6]. monitoring GUI for the administrator to analyze [14].
By analyzing of communication activities of the Hwang evaluated the effectiveness of keystroke
smartphones they tried to detect abnormal behaviours on a dynamics-based authentication (KDA) on mobile devices.
single device as well as system-wide. Smartsiren is Their empirical evaluation focuses on a short four digit
composed of backend proxy that communicates with pin numbers and the results show only 4% of false alert
light-weight agents on the protected devices. The rate [15].
information is collected and then sent to the proxy who The most recent research on this topic is the KBTA
then uses this to analyze it and if abnormal behaviour is framework[16]. A new kind of host-based IDS for
detected the alert is sent. smartphones is proposed in which detection is achieved
Schmidt et all utilize a Symbian monitoring client for by continual monitoring of mobile device and looking for
the smartphone based on Symbian OS, which collects and malicious temporal behaviour. The framework itself relies
forwards collected features to anomaly detection server on a lightweight agent in terms of CPU, memory and
RADS[7]. This data is then processed in order to power consumption. This agent continuously samples
distinguish between normal and abnormal behaviour. The different features on the device, performs the analysis of
results show that top applications used by phone users the gathered data and then infers the state of the device.
modify and affect the monitored features in various ways. The reason why this approach is unique is because of the
Intrusion detection systems that detect attacks which use of temporal framework which utilizes the behavioural
deplete the devices energy and basically reduce the patterns registered over time. This is then used to discover
quality of service to the user were analyzed by several previously unknown malware based on these patterns.
papers [8], [9]. This framework also requires that the interpretation of
Another study demonstrates a malware detection the gathered data should be context sensitive and that it
framework which tracks and analyzes and detects threats should be analyzed within given context rather then pure
which affect power supply and energy of the device. The classification based on signature or methods that were
frameworks main activities surround sampling of power used in previous work.
consumption by the applications generating power Oher major IDS proposed is Andromaly [17]. It is host-
signatures which are then used to detect malware by based and it continually monitors various features and
measuring how similar are these power signatures and events obtained from mobile device and then applies
using χ2 distance measure. Basic experiments applied to machine learning anomaly detectors to classify the
HP iPAQ device which has a windows mobile OS on it, collected data as normal-benign, or abnormal-malicious.
showed 99% of classifying mobile malware [10]. The classifiers that were examined include k-means,
Battery sensing intrusion detection system (B-SIPS) for logistic regression, histograms, decision trees, Bayesian
mobile devices was developed by Buennemeyer et al. It networks, naive Bayes. The evaluation is typically split
deals with detecting abnormal current changes. B-SIPS into two phases – training and testing. In the first phase a
relies on the SNORT IDS which provides a signature training set of benign and malicious features is provided
based detection of attack [11]. to the system in a form of feature vector. These features
One study used linear regression model to estimate are both collected during normal operations of the system,
power consumption, and the model is based on reflecting benign behaviour and when malware is active
parameters CPU-Load and disc access and its main on the system, thus providing vectors for malicious
objective is to determine the amount of energy used on a
behaviours in order for the classifier to be properly f) Tracking users Geo-location and user movement
trained. (GPS);
One other major approach proposed is cloud-based IDS The above categories can be analyzed separately and
for smartphones[18]. It consists of a cloud-based service dealt with as three different subsystems in the IDS for
which would allow users to install a light-weight agent on smarpthones.
their smartphones and register to an online cloud-service
by specifying their operating system, applications AmoxID - Network policies and conceptual model
installed on their phone and other relevant information Smartphone is a device to be carried as user moves
about their device. Afterwards, this specific smartphone is between different locations. When moving between
emulated in a virtual machine on the cloud using a proxy different locations user enters different types of network.
which duplicates the incoming traffic to the device and At home he uses his own wireless network within his
then forwards the traffic to the emulation platform, where household. At work user is within his company’s network.
detection and forensic analysis is preformed. On the outside user connects to outside networks.
Different networks have different threats lurking around
PROPOSED MODEL - AMOXID and some networks have Network IDS employed (such as
company’s network). Users of smartphones are
This model proposes categorization of threats into three sometimes given smartphones by their companies which
main categories: 1 – Threats to user’s experience; 2 – require them to follow policies and which additionally
Cost generating threats; 3 – Privacy infringing threats. need to protect their employee’s phones, because not
Threats to user's experience revolve around user’s protecting their employees would mean not protecting
general experience and enjoyment while using the companies data. We introduce the concept of setting
smartphone and they include: different policies and IDS operating with different levels
a) Malware that drains the battery will decrease the of alertness depending upon which network is user
smartphone live-time and will necessitate often connected to.
recharging which will become burdensome on This paper has primary goal of giving a conceptual
the user. model of possible IDS designed for mobile devices. The
b) Malware which attacks and eats up memory will results achieved on the chosen vector parameters for the
slow down the speed and responsiveness of the SVM could only be valid if tested on different
applications and the user experience will suffer. smartphone devices running same operating system with
Threats that generate cost include: different processing and memory power. Multi-core
a) Outgoing phone calls (within user's telephone systems, GB-RAM memories are available only to an
network, in roaming mode, long distance calls) expensive palette of phones so the performance of the
b) Outgoing SMS messages IDS on these systems would produce better results and
c) Unauthorized connection to GPRS internet while higher accuracy of classification. All of these will be left
the user is in the roaming mode or while the user for future work and will be tested in future papers and
is in a foreign country, all of which can generate work on this issue.
extremely large costs. Our model primarily The proof of concept IDS proposed and developed for
focuses on this kind threats and extractions of Android is named AmoxID. The conceptual model is
feature that are related to generating of cost. given in Figure 1.
d) Other cost that can be generated is in case of This model proposes system of policies where
online shopping where user’s credit card data is depending on the user’s current network, different policy
compromised, which is then used or sold on a level is applied and detection mechanism is on higher
black market causing financial damage to the alert in public networks, while home and work networks
user. This overlaps with privacy infringing are to be considered safer and there is a possibility of
threats. integration with Network IDS of the company or IDS that
Privacy infringing threats include the following: user sets up at his own household network.
a) Logging of keystrokes. This can be of importance to companies who are
b) Recording user’s voice conversations; issuing phones to their employees. If company sends
c) Copying users documents such as images and confidential emails and gives confidential data to
text notes; employees that are accessing this through the smartphone,
d) Logging and copying SMS messages, phone call it is important that this information stays protected.
logs, user's phone book; Specially designed policies for employee’s smartphones
e) Watching user’s activity on the internet, such as that are issued to employees can be configured to include
which websites he is visiting, his accounts pre-built IDS which would enforce different policies
passwords and other Internet activity; depending on the user’s current network. If the user
happens to be outside of company’s network, different
policies are applied which protect access to company’s 1) 1.call_ntinlst_inn: Number of outgoing calls
data on the phone. When inside the company’s network, toward numbers outside contact list within user’s
the installed IDS could be maintained by the network telephone network provider.
administrator. IDS would interact with IDS on the server 2) 2.call_ntinlst_outn: Number of outgoing calls
such as SNORT which could then utilize higher toward numbers outside contact list outside
processing and memory power to analyze logs on the user’s telephone network provider.
employee’s smartphone. All of this can also be designed 3) 3.call_inlst_inn: number of outgoing calls
in a way not to diminish users overal experience and toward numbers that are inside of contact list
without much effort on the user's side. inside user’s telephone network provider.
Other thing that should be taken into consideration is 4) 4.call_inlst_outn: Number of outgoing calls
the fact that there is higher chance for power source of the towards numbers that are inside of contact list
user's smartphone being available when the user is within outside user’s telephone network provider.
his home or work environment. 5) 5.sms_ntinlst_inn: Number of SMS going
This paper proposes three types of policies to be towards numbers outside of contact list within
enforced depending on te users current network. user’s telephone network provider.
1.Home Network, 2.Work Network, 3.Public Network 6) 6.sms_ntinlst_outn: Number of SMS going
(inside of user’s telephone network provider or outside) towards numbers outside of contact list outside
user’s telephone network provider.
Features that could are tracked and based on which we 7) 7.sms_inlst_inn: Number of SMS going towards
create vectors for SVM in this version of AmoxID IDS numbers inside of contact list within user’s
are as follows: telephone network provider.

Figure 1: AmoxID – Conceptual Model

 8) 8.sms_inlst_outn: Number of SMS going include 1 - user-experience threats, 2 - cost generating
towards numbers inside of contact list outside threats, 3 – privacy-infringing threats.
user’s telephone network provider. The future work will involve thorough testing of
9) 9.gprs_inn: Connection to GPRS within user’s AmoxID on different devices with Android operating
telephone network provider. system and consequent results will be published in
10) 10.gprs_outn: Connection to GPRS outside relevant academic literature.
user’s telephone network provider.
REFERENCES
The screenshots of AmoxID application developed for
this purpose are given below: [1] J. A. Zubairi, Cyber Security Standards, Practices and
Industrial Applications: Systems and Methodologies.
Information Science Reference, 2011.
[2] J. DICKINSON, The new anti-virus formula. Messaging News
Press, 2005.
[3] J. Zdziarski, Hacking and Securing iOS Applications. 2012.
[4] D. Samfat and R. Molva, “IDAMN: an intrusion detection
architecture for mobile networks,” Selected Areas in
Communications, IEEE Journal on, vol. 15, no. 7, pp. 1373–
1380, 1997.
[5] Y. Moreau, H. Verrelst, and J. Vandewalle, “Detection of
mobile phone fraud using supervised neural networks: A first
prototype,” Artificial Neural Networks—ICANN’97, pp. 1065–
1070, 1997.
[6] J. Cheng, S. H. . Wong, H. Yang, and S. Lu, “Smartsiren: virus
detection and alert for smartphones,” in Proceedings of the 5th
international conference on Mobile systems, applications and
services, 2007, pp. 258–271.
[7] A. D. Schmidt, F. Peters, F. Lamour, C. Scheel, S. A. Çamtepe,
and Ş. Albayrak, “Monitoring smartphones for anomaly
detection,” Mobile Networks and Applications, vol. 14, no. 1, pp.
92–106, 2009.
[8] T. Martin, M. Hsiao, D. Ha, and J. Krishnaswami, “Denial-of-
service attacks on battery-powered mobile computers,” in
Pervasive Computing and Communications, 2004. PerCom
2004. Proceedings of the Second IEEE Annual Conference on,
2004, pp. 309–318.
[9] R. Racic, D. Ma, and H. Chen, “Exploiting MMS vulnerabilities
to stealthily exhaust mobile phone’s battery,” in Securecomm
and Workshops, 2006, 2006, pp. 1–10.
[10] H. Kim, J. Smith, and K. G. Shin, “Detecting energy-greedy
anomalies and mobile malware variants,” in Proceeding of the
6th international conference on Mobile systems, applications,
and services, 2008, pp. 239–252.
[11] T. K. Buennemeyer, T. M. Nelson, L. M. Clagett, J. P. Dunning,
R. C. Marchany, and J. G. Tront, “Mobile device profiling and
intrusion detection using smart batteries,” in Hawaii
International Conference on System Sciences, Proceedings of
the 41st Annual, 2008, pp. 296–296.
[12] D. C. Nash, T. L. Martin, D. S. Ha, and M. S. Hsiao, “Towards
an intrusion detection system for battery exhaustion attacks on
mobile computing devices,” in Pervasive Computing and
Figure 2: AmoxID – Android Application Communications Workshops, 2005. PerCom 2005 Workshops.
Third IEEE International Conference on, 2005, pp. 141–145.
[13] G. A. Jacoby and N. J. Davis, “Battery-based intrusion
V. CONCLUSIONS AND FUTURE WORK detection,” in Global Telecommunications Conference, 2004.
GLOBECOM’04. IEEE, 2004, vol. 4, pp. 2250–2255.
[14] M. Miettinen, P. Halonen, and K. Hatonen, “Host-based
This paper has given a brief overview of Intrusion intrusion detection for advanced mobile devices,” in Advanced
Detection Systems used in various contexts of computer Information Networking and Applications, 2006. AINA 2006.
devices security with special focus on smartphones. We 20th International Conference on, 2006, vol. 2, pp. 72–76.
[15] S. Hwang, S. Cho, and S. Park, “Keystroke dynamics-based
have proposed a model based on SVM classification and authentication for mobile devices,” Computers & Security, vol.
proposed enforcement of different policies based on the 28, no. 1–2, pp. 85–93, 2009.
type of Network the user happens to connect to. We have [16] A. Shabtai, U. Kanonov, and Y. Elovici, “Intrusion detection for
categorized threats on mobile devices into three major mobile devices using the knowledge-based, temporal abstraction
method,” Journal of Systems and Software, vol. 83, no. 8, pp.
categories which can be addressed separately. These 1524–1537, 2010.
 [17] A. Shabtai, U. Kanonov, Y. Elovici, C. Glezer, and Y. Weiss, [18] A. Houmansadr, S. A. Zonouz, and R. Berthier, “A cloud-based
“‘Andromaly’: a behavioral malware detection framework for intrusion detection and response system for mobile phones,” in
android devices,” Journal of Intelligent Information Systems, pp. Proceedings of the 2011 IEEE/IFIP 41st International
1–30, 2012. Conference on Dependable Systems and Networks Workshops,
2011, pp. 31–32.

View publication stats