(Federated) Machine Learning for Risk Detection on Mobile Platforms

The importance of security and protection of private information on mobile devices has increased in recent years due to the widespread use of these devices. This lead to the intensive use of mobile platforms for security-critical tasks, such as online banking, mobile payments, healthcare applications or business-related activities. On another hand, mobile platforms became attractive attack targets, since they store and process a significant amount of security-critical information, such as authentication credentials, payment information, and access tokens.

While the protection of security-critical information in mobile apps is paramount to the security of mobile services, the often-used BYOD (Bring Your Own Device) paradigm makes the protection challenging. With BYOD, users may install arbitrary apps on their mobile devices, including malicious apps that can interfere with security-sensitive logic. On another hand, mobile service providers are limited in what defense mechanisms they can deploy for protection, since no additional requirements on underlying hardware can be assumed for interoperability reasons, and any OS-level protections are inapplicable, too, since those would void the warranty of mobile platform vendors. Hence, defenders need to resort to lightweight application-level defense strategies, such as application hardening, app-level monitoring and intrusion detection. This approach, however, typically relies on data collection and fingerprinting of platform features – an approach that is associated with privacy risks for users.

Project Goal. In this project, the goal is to build a lightweight framework for risk detection on mobile platforms, which applies machine learning (ML) and artificial intelligence (AI) methods for risk detection, while remaining privacy-friendly towards end-users. The examples of risks the project aims to address are co-installed malicious apps, jailbreaks, code injection, clickjaking/UI-redressing attacks, and device theft, to name some. The privacy friendliness is achieved through the application of a concept of so-called Federated Machine Learning (FML), which allows for the predictive ML models training directly on the devices, thereby eliminating the need for centralized collection and processing of user data. The central aggregation service in FML is only responsible for the collection of locally trained models and their integration into a global model, but not for the collection of end-user data. Once aggregated, the global model can be re-distributed among the clients, thus improving the precision of local models through the knowledge obtained on other platforms. This approach enables devices to learn models in collaboration while keeping all training data local.

Overall, the FML-based risk detection method provides the following advantages:

1. Secure: Since the user data is never collected by the service provider, there is no risk of server-side security breaches
2. Privacy-preserving: The solution is GDPR (General Data Protection Regulation) friendly since the collected data is never sent to the service provider
3. Precise: Privacy-preserving treatment of data enables collection of data in higher volumes, which results in larger datasets and more precise detection models
4. Adaptive: The model continues to evolve through iterations of aggregation and re-distribution cycles

The project is funded by KOBIL Security Systems GmbH, and is executed in cooperation with KOBIL and TU Darmstadt.

People involved: Prof. A. Dmitrienko, Christoph Sendner, Filip Roos, Lukas Nothhelfer

Publications

2022[ to top ]

FedCRI: Federated Mobile Cyber-Risk Intelligence. Fereidooni, Hossein; Dmitrienko, Alexandra; Madlener, Felix; Rieger, Phillip; Miettinen, Markus; Sadeghi, Ahmad-Reza; in The Network and Distributed System Security Symposium (NDSS) (2022).
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
@inproceedings{fereidooni2022fedcri, author = {Fereidooni, Hossein and Dmitrienko, Alexandra and Madlener, Felix and Rieger, Phillip and Miettinen, Markus and Sadeghi, Ahmad-Reza}, booktitle = {The Network and Distributed System Security Symposium (NDSS)}, keywords = {security}, title = {FedCRI: Federated Mobile Cyber-Risk Intelligence}, year = 2022 }

2021[ to top ]

RIP StrandHogg: A Practical StrandHogg Attack Detection Method on Android. Stang, Jasper; Dmitrienko, Alexandra; Roth, Sascha; in 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec) (2021).
- [ Abstract ]
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
StrandHogg vulnerabilities affect Android’s multitasking system and threaten up to 90% of Android platforms, which translates to millions of affected users. Existing countermeasures require modification of the OS, have usability drawbacks, or are limited to the detection of certain attack versions. In this work, we aim to develop a generic, efficient, and usability-friendly attack detection method, which does not require OS modifications and can be employed by apps installed on any vulnerable Android platform. To achieve our goal, we analyze StrandHogg attack techniques and develop two countermeasures, one using Machine Learning and the other one using ActivityCounter – a reliable attack indicator, which we could synthetically engineer. Our first approach achieves an average F1 score of 92% across all attack variations, while ActivityCounter shows superior performance and efficiently detects all attack versions without false positives. ActivityCounter is the first solution without practical limitations, which can be easily deployed in practice and protect millions of affected users.

@inproceedings{stang2021strandhogg, abstract = {StrandHogg vulnerabilities affect Android’s multitasking system and threaten up to 90% of Android platforms, which translates to millions of affected users. Existing countermeasures require modification of the OS, have usability drawbacks, or are limited to the detection of certain attack versions. In this work, we aim to develop a generic, efficient, and usability-friendly attack detection method, which does not require OS modifications and can be employed by apps installed on any vulnerable Android platform. To achieve our goal, we analyze StrandHogg attack techniques and develop two countermeasures, one using Machine Learning and the other one using ActivityCounter – a reliable attack indicator, which we could synthetically engineer. Our first approach achieves an average F1 score of 92% across all attack variations, while ActivityCounter shows superior performance and efficiently detects all attack versions without false positives. ActivityCounter is the first solution without practical limitations, which can be easily deployed in practice and protect millions of affected users.}, author = {Stang, Jasper and Dmitrienko, Alexandra and Roth, Sascha}, booktitle = {14th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec)}, keywords = {Android}, title = {RIP StrandHogg: A Practical StrandHogg Attack Detection Method on Android}, year = 2021 }

2020[ to top ]

Understanding UI attacks on Android. Jasper, Stang; Thesis; Bachelor Thesis. (2020, December).
- [ Abstract ]
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
In this thesis, we closely examine an important type of attack against Android smart- phones that exploit weaknesses in the user interface. In particular, we study, analyze and implement the “Keystroke Inference #3” attack from the “Cloak and Dagger” paper by Fratantonio et al. [1, 2], which enables an attacker to steal sensitive input such as pass- words. The attack takes advantage of a vulnerability that was subsequently patched on all newer Android versions. Yet, it still affects a significant user base that utilizes older devices. In this paper, we present the end-to-end attack implementation of the “Keystroke Inference #3” concept and elaborate on in-depth details. In order to make the attack fea- sible certain technical challenges needed to be solved, therefore our developed approaches are presented as well. After the evaluation of the results, we show that the implementa- tion is applicable to a wide range of Android versions. We then present our novel defense technique OverlayShifter, which fully prevents the attack while being independent of operating system modifications. Moreover, characteristics that facilitate the detection of the attack are discussed.

@mastersthesis{jasper2020understanding, abstract = {In this thesis, we closely examine an important type of attack against Android smart- phones that exploit weaknesses in the user interface. In particular, we study, analyze and implement the “Keystroke Inference #3” attack from the “Cloak and Dagger” paper by Fratantonio et al. [1, 2], which enables an attacker to steal sensitive input such as pass- words. The attack takes advantage of a vulnerability that was subsequently patched on all newer Android versions. Yet, it still affects a significant user base that utilizes older devices. In this paper, we present the end-to-end attack implementation of the “Keystroke Inference #3” concept and elaborate on in-depth details. In order to make the attack fea- sible certain technical challenges needed to be solved, therefore our developed approaches are presented as well. After the evaluation of the results, we show that the implementa- tion is applicable to a wide range of Android versions. We then present our novel defense technique OverlayShifter, which fully prevents the attack while being independent of operating system modifications. Moreover, characteristics that facilitate the detection of the attack are discussed.}, author = {Jasper, Stang}, keywords = {sssgroup}, month = 12, publisher = {Bachelor Thesis}, school = {University of Würzburg}, title = {Understanding UI attacks on Android}, type = {Bachelor Thesis}, year = 2020 }

Hubland Süd, Geb. M2

(Federated) Machine Learning for Risk Detection on Mobile Platforms

Publications

Hinweis zum Datenschutz

Hinweis zum Datenschutz

Bildnachweise