以SVM為基礎之手機惡意封包偵測系統

譚庚倫 ； 江清泉

《TANET2016 臺灣網際網路研討會》 2016 (2016/11) Pp. 942-947-168

https://doi.org/10.6679/TANET.2016.168

摘要

近年來，智慧型手機蓬勃發展其作業系統以Android和IOS為主。智慧型手機的使用越來越普遍，使用者逐漸將個人的資訊存入手機中，例如:聯絡資訊、E-mail帳號密碼、個人電子錢包等相關資訊。因為上述的原因，使得駭客將目標由電腦端轉向手機端。駭客藉由入侵手機的方式蒐集使用者許多個人隱私資訊。然而Android系統可以不用透過官方認證而進一步安裝第三方的app，並且惡意app可以透過使用者給予的權限蒐集個人相關資訊並且傳輸至駭客伺服器，或者執行從駭客伺服器傳來的惡意程式碼。本研究提出一套監測手機惡意封包系統，以Agent-based概念設計。由手機下載監測網路app，app將手機的網路封包存至pcap檔並傳輸至伺服器，用SVM(Support Vector Machine)分析封包是否有惡意行為，而分析結果可透過手機應用程式瀏覽。本研究提出一個Android 智慧型手機惡意偵測系統，藉由本系統可判斷出在手機上執行的app 是否有惡意行為。透過agent app收集裝置上的網路行為，例如GET封包所攜帶的參數、POST封包裡的json data，將這些資料存入pcap檔裡，以HTTPS方式傳輸至伺服器。伺服器利用libpcap，將pcap檔裡的GET封包和POST截取出來並且做為特徵向量，然後用SVM分類演算法來判斷是否有惡意行為。本系統會將這些判斷出來的資訊存入至資料庫，提供往後使用者可以查詢。可以透過本系統的app來查看目前手機上是否有執行惡意的app，若有偵測到惡意行為，此app會跳出通知來提醒使用者。

關鍵字

Android ； 惡意偵測 ； SVM ； 建模

並列摘要

Smart phones have become very popular and mobile's systems almost are Android or IOS. People store the personal data and sensitive data into their smart phones such as account number, password number and contact. Because of above reason, the hackers change the targets form PC to smart phones. Android allows smart phones to install the third-party apps which are not authenticated by Google. Malware apps will ask users for permissions. If the users allow the permissions, the malware apps can steal the sensitive data and send the data to hacker's server. Then the hackers will response malware codes or commands to user's phones and execute them. This research proposes a android malware detecting system by monitoring network packets and using the concept of agent. The agent app collect the network packets and store into the pcap file which is uploaded into the server. The server uses libpcap to extract the GET features and POST features, then the features are stored into database. The research uses SVM classifier algorithm to analyze the features. The SVM will create a model from the train data to analyze the test data. If the pcap file has malware features, server will send a Google Cloud Message to agent app and agent app notifies the user. The contribution of this research is developing a malware detecting system for Android to protect the user's sensitive data. The infrastructure and malware features are valuable for researchers to work on Android security and improve development of industry and researches.

並列關鍵字

Smart phone network packet ； modeling ； Android malware ； SVM