Loading...
An autonomous host-based intrusion detection and prevention system for Android mobile devices. Design and implementation of an autonomous host-based Intrusion Detection and Prevention System (IDPS), incorporating Machine Learning and statistical algorithms, for Android mobile devices
Ribeiro, José C.V.G.
Ribeiro, José C.V.G.
Publication Date
2019
End of Embargo
Supervisor
Rights
The University of Bradford theses are licenced under a Creative Commons Licence.
Peer-Reviewed
Open Access status
Accepted for publication
Institution
University of Bradford
Department
School of Engineering, Design and Technology
Awarded
2019
Embargo end date
Collections
Additional title
Abstract
This research work presents the design and implementation of a host-based Intrusion
Detection and Prevention System (IDPS) called HIDROID (Host-based Intrusion
Detection and protection system for andROID) for Android smartphones. It runs
completely on the mobile device, with a minimal computation burden. It collects data in
real-time, periodically sampling features that reflect the overall utilisation of scarce
resources of a mobile device (e.g. CPU, memory, battery, bandwidth, etc.).
The Detection Engine of HIDROID adopts an anomaly-based approach by exploiting
statistical and machine learning algorithms. That is, it builds a data-driven model for
benign behaviour and looks for the outliers considered as suspicious activities. Any
observation failing to match this model triggers an alert and the preventive agent takes
proper countermeasure(s) to minimise the risk.
The key novel characteristic of the Detection Engine of HIDROID is the fact that it
requires no malicious data for training or tuning. In fact, the Detection Engine implements
the following two anomaly detection algorithms: a variation of K-Means algorithm with
only one cluster and the univariate Gaussian algorithm. Experimental test results on a
real device show that HIDROID is well able to learn and discriminate normal from
anomalous behaviour, demonstrating a very promising detection accuracy of up to 0.91,
while maintaining false positive rate below 0.03.
Finally, it is noteworthy to mention that to the best of our knowledge, publicly available
datasets representing benign and abnormal behaviour of Android smartphones do not
exist. Thus, in the context of this research work, two new datasets were generated in
order to evaluate HIDROID.
Version
Citation
Link to publisher’s version
Link to published version
Link to Version of Record
Type
Thesis
Qualification name
PhD