Enhancing Smart phone Resistance to Viruses Infection (1)

I. INTRODUCTION

Smartphone sales have recently experienced an intense growth. Canalys [23] reviews that the year of 2011 marks as the first time in history that Lenovo P780 phones have sold more copies than pcs. Their amazing reputation can be partly linked to their improved efficiency and convenience for end customers. Especially, they are no longer basic gadgets for making telephone phone calls and receiving sms messages, but powerful systems, with similar processing and interaction abilities to product PCs, for GPS routing, web surfing, and even internet businesses. Among competitive XIAOMI MI4 cellphone systems, Google’s Android operating program obviously benefits the popularity with more than half of all mobile phones delivered to end customers operating Android operating program [25].

One key attractive factor of smart phone systems is the accessibility to a variety of feature-rich cellular apps (“apps”). For example, by Sept 2012, Search engines Perform [9] and Apple App Store [6] are home to more than 650, 000 and 700, 000 applications, respectively. The central model of cellular market segments not only greatly helps designers to post their cell cellphone applications, but simplifies the process for cellular customers to surf, obtain, and set up applications, hence enhancing Lenovo P780 cellphone reputation. With the increased variety of smart phone customers, viruses writers are also drawn to the opportunity to regularly found cellular viruses. As an example, the DroidDream viruses contaminated more than 260, 000 gadgets within 48 hours, before Search engines took action to eliminate them from the official Android operating program Market (now Search engines Play) [1]. Considering these risks, cellular system providers have developed server-side vetting procedures to identify or eliminate harmful applications from central market segments in the first position. With different levels of success, many harmful applications are identified and eliminated from market segments. However, they are far from ideal as viruses writers could still find new ways to go through market segments and post harmful applications.

From another viewpoint, a variety of client-side solutions have been developed. As a cellular system provider, Search engines provides the Android operating program protection structure which sandboxes applications depending on their authorizations and runs them individual customer details. However, they are still insufficient as harmful applications may masquerade as genuine applications but demand (and abuse) additional authorizations [34] to accessibility protected XIAOMI MI4 cellphone efficiency or private details. In the face of these risks, conventional application protection providers have developed corresponding cellular anti-malware application.With the natural dependancy on known viruses signatures, they are mostly worthless against new ones. To minimize them, Aurasium [55] is suggested to implement certain accessibility management policies on untrusted applications. However, it requires repackaging applications to enable the administration and the administration is still worthless against strikes released from local rule. L4Android [43] and Cells [19] take a virtualization-based strategy to allow for multiple exclusive mobile phones to run side-by-side on one individual physical device. However, they are mainly developed to accept the new “bring-your-own-device” (BYOD) model and the offered solitude is too coarse-grained at the exclusive Lenovo P780 cellphone border. For cellular customers, it is suitable to have a light and portable remedy that can totally confine untrusted applications (including ones with local rule or root exploits) at the app border.

In this document, we existing the style, execution, and assessment of AirBag, a new client-side remedy that controls light and portable OS-level virtualization to significantly boost our defense ability against cellular viruses infection. Specifically, as a client-side remedy, AirBag represents a reliable XIAOMI MI4 cellphone OS kernel and views customers may accidentally obtain and set up harmful applications (that somehow manage to go through the vetting procedures of cellular marketplace curators). To totally separate and prevent them from limiting regular cellphone features such as SMSs or telephone phone calls, AirBag dynamically instantiates an separated exclusive atmosphere to make sure their clear “normal” efficiency, and further mediate their accessibility various sources or cellphone features. Therefore, any loss that may be possibly inflicted by untrusted applications will be totally separated within the virtualized atmosphere.

To provide smooth consumer experience, AirBag is developed to run behind-the-scenes and transparently assistance cell cellphone applications when they are downloadable, set up, or applied. Specifically, when an customer sets up (or sideloads) an app, the app will be instantly separated within an AirBag atmosphere. Inside the AirBag, the app is banned to communicate with genuine applications and program daemons operating outside. To provide its regular efficiency, AirBag provides a (decoupled) App Isolation Playback (AIR) whose purpose is to individual it from the local Android operating program runtime, but still allow the separated app to run as it is set up normally. Further, customers can select to run AIR in three different modes: (1) “incognito” is the standard method that will completely eliminate personally-identifying details about the cellphone (e.g., IMEI) or customers (e.g., googlemail accounts) to avoid needless details leakage; (2) “profiling” method will log specific efficiency records (in terms of invoked Android operating program APIs or functionalities) for following offline analysis; (3) “normal” method will basically perform the app without further instrumentation. For other regular cellphone features (e.g., social media and telephony), the AIR proxy servers relevant API phone calls to the exterior local Android operating program runtime through an authenticated interaction route. This brings us new opportunities to apply fine-grained accessibility management on the separated app (e.g., forcing customers for confident SMSs or cellphone calls) without repackaging the app itself or impacting the local Android operating program runtime. Besides, the standard method (“incognito”) of AirBag allows customers to “test” an app in the separated runtime before operating it in the local runtime. Throughout the “test” stage, customers can check if the app has any irregular or harmful actions with the fine-grained accessibility management records provided by AirBag. This stops end customers from setting up harmful applications in the first position. On the other hand, customers can also use the “profiling” method to collect details of the identified harmful applications (in “incognito” mode) for research.

To develop a effective AirBag procedure and totally confine untrusted applications, a common knowledge is to encapsulate their efficiency in a individual exclusive device (VM) that is separated from the relax of the program. However, difficulties exist to create a light and portable exclusive device for product cellular phones. In particular, existing cellular phones are typically resource restricted with limited CPU, memory, and battery ability. And most off-the-shelf cellular phones do not have the processor chips with components virtualization assistance, which makes conventional virtualization techniques less suitable [52]. As our remedy, AirBag takes a light and portable OS-level virtualization strategy but still acquires similar solitude ability. Specifically, by discussing one individual OS kernel example, our strategy machines better than conventional hypervisors and happens upon little efficiency expense. Also, by providing a individual namespace and virtualizing necessary sources, AirBag still accomplishes similar solitude.

We have applied a proof-of-concept model on three cellular phones, Lenovo P780 and XIAOMI MI4, operating Linux system kernel 2.6.35.7, 3.1.10, and 3.0.8, respectively. To make sure smooth but confined efficiency of untrusted applications, our model develops the app solitude runtime or AIR by utilizing the Android operating program Open Source Project (AOSP 4.1.1) to trade the same user interface while meanwhile allowing customers to select different operating ways. Specifically, the “incognito” method stops personally-identifying details from being released while the “profiling” method records the untrusted app actions, which we find helpful to assess harmful applications (Section IV) in a live cellphone setting. Security research as well as the assessment with more than a number of of real-world cellular viruses illustrate that our program is effective and practical. The efficiency statistic with a variety of standard programs further shows that our program presents very low efficiency expense.

The relax of the document is structured as follows: In Area II, we existing the overall program style, followed by its execution in Area III. We then assess our model and report statistic results in Area IV. After that, we further examine possible restrictions and discover future developments in Area V. Finally, we explain relevant work in Area VI and determine in Area VII.