DroidLight: Lightweight Anomaly-Based Intrusion Detection System for Smartphone Devices

Research output: Chapter in Book/Report/Conference proceedingConference contribution

41 Downloads (Pure)

Abstract

Smartphone malware attacks are increasing alongside the growth of smartphone applications in the market. Researchers have proposed techniques to detect malware attacks using various approaches, which broadly include signature and anomaly-based intrusion de- tection systems (IDSs). Anomaly-based IDSs usually require train- ing machine learning models with datasets collected from running both benign and malware applications. This may result in low de- tection accuracy when detecting zero-day malwares, i.e. those not previously seen or recorded. In this paper, we propose DroidLight, a lightweight IDS which can detect zero-day malware efficiently and effectively. We designed an algorithm for DroidLight that is based on one class classification and probability distribution analy- sis. For each smartphone application, the classification model learns its normal CPU utilisation and network traffic pattern. The model flags an intrusion alert if there is any significant deviation from the normal pattern. By deploying three self-developed malwares we performed realistic evaluation of DroidLight, i.e. the evaluation was performed on a real device while a real user was interacting with it. Evaluation results demonstrate that DroidLight can detect smartphone malwares with accuracy ranging from 93.3% to 100% while imposing only 1.5% total overhead on device resources.
Original languageEnglish
Title of host publicationProceedings of the 21st International Conference on Distributed Computing and Networking
Subtitle of host publication ICDCN 2020: 21st International Conference on Distributed Computing and Networking Kolkata India January, 2020
Place of PublicationNew York, NY, USA
PublisherAssociation for Computing Machinery (ACM)
ISBN (Electronic)9781450377515
DOIs
Publication statusPublished - 01 Jan 2020
Event21st International Conference on Distributed Computing and Networking - Kolkata, India
Duration: 04 Jan 202007 Jan 2020
https://www.icdcn2020.com

Conference

Conference21st International Conference on Distributed Computing and Networking
CountryIndia
CityKolkata
Period04/01/202007/01/2020
Internet address

Fingerprint Dive into the research topics of 'DroidLight: Lightweight Anomaly-Based Intrusion Detection System for Smartphone Devices'. Together they form a unique fingerprint.

Cite this