Monitoring smartphones for anomaly detection

ABSTRACT

In this paper we demonstrate how to monitor a smartphone running Symbian OS in order to extract features that describe the state of the device and can be used for anomaly detection. These features are sent to a remote server, because running a complex intrusion detection system (IDS) on this kind of mobile device still is not feasible, due to capability and hardware limitations. We give examples on how to compute some of the features and introduce the top ten applications used by mobile phone users basing on a study in 2005. The usage of these applications is recorded and visualized and for a first comparison, data results of the monitoring of a simple malware are given.

REFERENCES

• 1: Gregory D. Abowd , Liviu Iftode , Helena Mitchell, Guest Editors' Introduction: The Smart Phone--A First Platform for Pervasive Computing, IEEE Pervasive Computing, v.4 n.2, p.18-19, April 2005 [doi>10.1109/MPRV.2005.32]
• 2: Sahin Albayrak , Christian Scheel , Dragan Milosevic , Achim Muller, Combining Self-Organizing Map Algorithms for Robust and Scalable Intrusion Detection, Proceedings of the International Conference on Computational Intelligence for Modelling, Control and Automation and International Conference on Intelligent Agents, Web Technologies and Internet Commerce Vol-2 (CIMCA-IAWTIC'06), p.123-130, November 28-30, 2005
• 3: Bundesverband Informationswirtschaft Telekommunikation und neue Medien e.V.- BITKOM. Mehr Handys als Einwohner in Deutschland. http://www.bitkom.de/41015_40990.aspx (15. August 2007), 2006.
• 4: Canalys. EMEA Q3 2006 -- Highlights from the Canalys Research. http://www.canalys.com/pr/2006/r2006102.htm (15. August 2007), 2006.
• 5: Stephanie Forrest , Alan S. Perelson , Lawrence Allen , Rajesh Cherukuri, Self-Nonself Discrimination in a Computer, Proceedings of the 1994 IEEE Symposium on Security and Privacy, p.202, May 16-18, 1994
• 6: Alexander Gostev. Mobile Malware Evolution: An Overview, Part 1. http://www.viruslist.com/en/analysis?pubid=200119916 (15. August 2007), September 2006.
• 7: Marcus Gröber. Applications for Symbian. http://www.mgroeber.de/epoc.htm (15. August 2007).
• 8: Jazilah Jamaluddin, Nikoletta Zotou, Reuben Edwards, and Paul Coulton. Mobile Phone Vulnerabilities: A New Generation of Malware. In Proceedings of the 2004 IEEE International Symposium on Consumer Electronics, pages 199--202, September 2004.
• 9: Katja Luther, Rainer Bye, Tansu Alpcan, Sahin Albayrak, and Achim Müller. A Cooperative AIS Framework for Intrusion Detection. In Proceedings of the IEEE International Conference on Communications (ICC 2007), 2007.
• 10: Microsoft Corporation. Windows Mobile. http://www.microsoft.com/germany/windowsmobile/default.mspx (15. August 2007), 2007.
• 11: Nokia. Nokia E61. http://www.nokia.co.uk/A4221036 (15. August 2007), 2007.
• 12: George Roussos , Andy J. Marsh , Stavroula Maglavera, Enabling Pervasive Computing with Smart Phones, IEEE Pervasive Computing, v.4 n.2, p.20-27, April 2005 [doi>10.1109/MPRV.2005.30]
• 13: Eugene Spafford and Diego Zamboni. Data Collection Mechanisms for Intrusion Detection Systems. CERIAS Technical Report 2000--08, CERIAS, Purdue University, 1315 Recitation Building, West Lafayette, IN, June 2000.
• 14: Symbian Software Limited. Symbian OS - the mobile operating system. http://www.symbian.com (15. August 2007), 2007.
• 15: TNS Technology. Consumer Trends in Mobile Applications -- A TNS Technology Briefing for Technology Decision Makers. http://www.tns-global.com/ (15. May 2007), 2005.

INDEX TERMS

Keywords:
anomaly detection, mobile device, monitoring, smartphone