Earticle

The number of mobile applications on Android platform has largely increased in recent years. The security problems, as one of the outcomes induced by the popularity of Android, become more and more critical. Malicious repackaged applications (MRAs) perform malicious behaviors through malware developers embedding malicious codes into the benign origin applications (BOAs), which threat the security of users’ finance and privacy. In this paper, a method based on API calls monitoring is proposed to effectively detect MRAs. We discuss the characteristics of behaviors and analyze the differences in API calls between MRAs and their BOAs. A MRA detection model is established, which builds up the super-sphere for each BOA via a SVDD algorithm. The model can detect the abnormal behaviors of MRAs which deviate the normal behaviors of corresponding BOAs. Experiments are carried out on imitated and real MRAs, where the results demonstrate the effectiveness of our method for detecting the singly and multiply contaminated BOAs.

This thesis presents an improved algorithm of v-SVDD that detects outliers in documents. The existing algorithms produce a virtual modulation vector with all elements of a power set of a feature vector from a document, and the virtual modulation vector may include vectors that do not reflect true characteristics of the document. To address the issue, this study proposes an enhanced version of the v-SVDD algorithm that produces a more precise virtual modulation vector. Test results run by this new algorithm in this paper show excellent precision in detecting leakage of tampered documents.