The Company You Keep: Mobile Malware Infection Rates and Inexpensive Risk Indicators

Hien Thi Thu Truong, Eemil Lagerspetz, Petteri Nurmi, Adam J. Oliner, Sasu Tarkoma, N. Asokan, Sourav Bhattacharya

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review

Abstract

There is little information from independent sources in the public domain about mobile malware infection rates. The only previous independent estimate (0.0009%) [11], was based on indirect measurements obtained from domain-name resolution traces. In this paper, we present the first independent study of malware infection rates and associated risk factors using data collected directly from over 55,000 Android devices. We find that the malware infection rates in Android devices estimated using two malware datasets (0.28% and 0.26%), though small, are significantly higher than the previous independent estimate. Based on the hypothesis that some application stores have a greater density of malicious applications and that advertising within applications and cross-promotional deals may act as infection vectors, we investigate whether the set of applications used on a device can serve as an indicator for infection of that device. Our analysis indicates that, while not an accurate indicator of infection by itself, the application set does serve as an inexpensive method for identifying the pool of devices on which more expensive monitoring and analysis mechanisms should be deployed. Using our two malware datasets we show that this indicator performs up to about five times better at identifying infected devices than the baseline of random checks. Such indicators can be used, for example, in the search for new or previously undetected malware. It is therefore a technique that can complement standard malware scanning. Our analysis also demonstrates a marginally significant difference in battery use between infected and clean devices.
Original languageEnglish
Title of host publicationWWW '14 : Proceedings of the 23rd international conference on World wide web
Number of pages12
Place of PublicationNew York
PublisherACM
Publication date2014
Pages39-50
ISBN (Print)978-1-4503-2744-2
DOIs
Publication statusPublished - 2014
MoE publication typeA4 Article in conference proceedings
EventInternational World Wide Web Conference - Seoul, Korea, Republic of
Duration: 7 Apr 201411 Apr 2014
Conference number: (WWW 2014)

Fields of Science

  • 113 Computer and information sciences

Cite this