• Journal of Convergence for Information Technology
• /
• 제12권3호
• /
• pp.17-24
• /
• 2022

Mobile malicious apps are increasing rapidly, and Android, which accounts for most of the global mobile OS market, is becoming a major target of mobile cyber security threats. Therefore, in order to cope with rapidly evolving malicious apps, there is a need for detection techniques of malicious apps using machine learning, one of artificial intelligence implementation technologies. In this paper, we propose a selected feature method using feature selection and feature extraction that can improve the detection performance of malicious apps. In the feature selection process, the detection performance improved according to the number of features, and the API showed relatively better detection performance than the permission. Also combining the two characteristics showed high precision of over 93% on average, confirming that the appropriate combination of characteristics could improve the detection performance.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 한국컴퓨터정보학회 2019년도 제59차 동계학술대회논문집 27권1호
• /
• pp.297-298
• /
• 2019

본 논문에서는 드론용 오픈 소스 API를 이용하여 셀프 카메라 촬영이 가능한 드론용 앱을 설계한다. 특히, 딥러닝 기반의 YOLO 객체 탐지 기술을 적용하여 배경 속에서 사람을 탐지하여 개인 및 단체 사진 촬영이 가능하도록 설계한다. 개발하는 셀프 카메라 앱은 기체의 자동 회전 및 선회 기반 연속 촬영 기능을 포함하여 다양한 형태의 인물 사진 촬영이 가능하다. 개발된 앱 기술을 기반으로 선회 및 회전을 통한 경비 구역의 침입자 촬영을 위한 시스템 및 드론 제어 기술에 활용하고자 한다.

• Smart Media Journal
• /
• 제12권5호
• /
• pp.58-64
• /
• 2023

In Logic Bomb, the conditions of branch statements that trigger malicious behavior cannot be detected in advance, making Android malicious app analysis difficult. Various studies have been conducted to detect potentially suspicious branch statements that can be logic bombs and triggers, but suspicious branch statements cannot be properly detected in apps that contain information determined at runtime, such as reflection. In this paper, we propose a tool that can detect suspicious branch statements even when reflection is used in Android apps. It works through recording app execution logs and analyzing the recorded log). The proposed tool can check the relationship between the called method and the branch statement by recording and analyzing the user-defined methods, Java APIs called and method information called through reflection, and branch information in the log while the Android app is running. Experimental results show that suspicious branch statements can be detected even in apps where reflection is used.

• Proceedings of the Korean Information Science Society Conference
• /
• 한국정보과학회 2011년도 한국컴퓨터종합학술대회논문집 Vol.38 No.1(A)
• /
• pp.305-308
• /
• 2011

최근 스마트폰 사용자의 급격한 증가와 앱스토어를 통한 새로운 스마트폰용 앱의 수익 모델은 스마트폰 용 앱 시장의 폭발적인 성장을 가져왔다. 이에 따라 스마트의 악성 앱에 의한 위협 역시 매우 커지고 있다. 특히 기기의 특성상 스마트폰은 사용자의 개인정보나 인증서 같은 민감한 데이터가 많고, 문자 메시지 및 통화 서비스와 같은 과금을 유발하는 기능이 많으므로 실제 피해가 발생할 경우 그 피해는 매우 클 것으로 예상된다. 실제 이런 다양한 악성 앱들이 이미 발견되고 있으므로 스마트 폰 보안에 대한 연구는 매우 시급하다고 할 수 있다. 이에 따라 본 논문에서는 스마트폰 환경에서, 최소한의 CPU 부하로 악성 앱을 탐지하는 시스템을 제안함으로써 스마트폰에서의 새로운 보안 대책을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• 제30권3호
• /
• pp.357-367
• /
• 2020

According to Symantec's 2018 internet security threat report, The number of new mobile malware variants increased by 54 percent in 2017, as compared to 2016. And last year, there were an average of 24,000 malicious mobile applications blocked each day. Existing signature-based technologies of malware detection have limitations. So, malware detection technique through machine learning is being researched to detect malware variant. However, even in the case of applying machine learning, if the proper features of the malware are not properly selected, the machine learning cannot be shown correctly. We are focusing on feature selection method to find the features of malware variant in this research.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• 제40권4호
• /
• pp.700-708
• /
• 2015

A software birthmark is the set of characteristics of a program which can be used to identify the program. Many researchers have studied on detecting theft of java programs using some birthmarks. In case of Android apps, code obfuscation techniques are used to protect the apps against reverse-engineering and tampering. However, attackers can also use the obfuscation techniques in order to conceal a stolen program. A birthmark (feature) of an app can be alterable by code obfuscations. Therefore, it is necessary to detect Android app theft based on the birthmark which is resilient to code obfuscation. In this paper, we propose an effective Android app birthmark and app theft detection through the proposed birthmark. By analyzing some obfuscation tools, we have first selected parameter and the return types of methods as an adequate birthmark. Then, we have measured similarity of target apps using the birthmarks extracted from the apps, where some target apps are not obfuscated and the others obfuscated. The measurement results show that our proposed birthmark is effective for detecting Android app theft even though the apps are obfuscated.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 한국정보통신학회 2022년도 춘계학술대회
• /
• pp.374-376
• /
• 2022

The Malware App Analysis Tool is a system that analyzes Android-based apps by the AI-based algorithm defined in the tool and detects whether malware code is included. Currently, as the spred of smartphones is activated, crimes using malware apps have increased, and accordingly, security for malware apps is required. Android operating systems used in smartphones have a share of more than 70% and are open-source-based, so not only will there be many vulnerabilities and malware, but also more damage to malware apps, increasing demand for tools to detect and analyze malware apps. However, this paper is proposed because there are many difficulties in designing and developing a malware app analysis tool because the security functional requirements for the malware app analysis tool are not clearly specified. Through the developed protection profile, technology can be improved based on the design and development of malware app analysis tools, safety can be secured by minimizing damage to malware apps, and furthermore, trust in malware app analysis tools can be guaranted through common criteria.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 한국정보통신학회 2022년도 춘계학술대회
• /
• pp.377-380
• /
• 2022

An application called an app can be downloaded and used on mobile devices. Among them, Android-based apps have the disadvantage of being implemented on an open source basis and can be exploited by anyone, but unlike iOS, which discloses only a small part of the source code, Android is implemented as an open source, so it can analyze the code. However, since anyone can participate in changing the source code of open source-based Android apps, the number of malicious codes increases and types are bound to vary. Malicious codes that increase exponentially in a short period of time are difficult for humans to detect one by one, so it is efficient to use a technique to detect malicious codes using AI. Most of the existing malicious app detection methods are to extract Features and detect malicious apps. Therefore, three ways to select the optimal feature to be used for learning after feature extraction are proposed. Finally, in the step of modeling with optimal features, ensemble techniques are used in addition to a single model. Ensemble techniques have already shown results beyond the performance of a single model, as has been shown in several studies. Therefore, this paper presents a plan to select the optimal feature and implement a learning model for Android app-based malicious code detection.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 한국컴퓨터정보학회 2018년도 제57차 동계학술대회논문집 26권1호
• /
• pp.79-80
• /
• 2018

안드로이드 운영체제는 앱을 설치하거나 실행할 때 사용자가 해당 앱이 요청하는 권한들을 승인하도록 하고 있으나, 일반적인 사용자들은 이를 주의 깊게 확인하지 않고 승인하는 경우가 많으며, 과도한 권한들을 요구하는 앱의 실행은 프라이버시 침해 문제로 이어질 수 있다. 본 논문에서는 제공하는 기능들에 비해 과도한 권한들을 요구하는 안드로이드 앱들을 탐지하는 모델을 제안한다. 먼저 손전등, 다이어리, 지불(페이) 및 채팅 앱 207개를 대상으로 요구하는 권한들을 조사하여 정리하였다. 조사 결과를 기준으로 설치 또는 실행하려는 앱이 어느 정도의 권한들을 요구하는지 가늠할 수 있다. 설치된 앱들의 요구 권한들을 조회할 수 있는 앱 프로토타입을 개발하였으며, 향후 모델의 구체화 및 검증을 거쳐, 프로토타입에 적용할 계획이다.

• Review of KIISC
• /
• 제29권1호
• /
• pp.26-33
• /
• 2019

안드로이드 모바일 환경에서 사용되는 애플리케이션은 사용자에게 여러 권한을 요구하며, 특정한 기능을 수행한다. 공격자는 정상적인 애플리케이션으로 가장한 악성 애플리케이션을 사용자가 다운로드 하도록 유도하여 금융정보 및 개인정보를 탈취할 수 있다. 기존의 모바일 백신은 시그니처(signature) 기반의 악성 애플리케이션 탐지 방법을 사용하기 때문에 정상 애플리케이션으로 가장한 악성 애플리케이션의 탐지가 어려운 측면이 있다. 따라서, 본 논문에서는 안드로이드 악성 애플리케이션 탐지율 향상을 위한 특성(feature)을 연구 및 분석하고, 여러 기계학습 모델을 적용하여 최종적으로는 기존의 모바일 백신으로는 탐지가 어려운 악성 애플리케이션까지 탐지가 가능한 기계학습 모델을 제안하였다.