A.C. Chen ADL M Zubair Rafique Muhammad Khurram Khan Khaled Alghathbar Muddassar Farooq The 8th FTRA International Conference on Secure and Trust Computing, data management, and Applications ( STA 2011 ) 1

A.C. Chen ADL Outline Introduction Malformed message detection framework Evaluation and experimental results Conclusion 2

A.C. Chen ADL Introduction Malformed message detection framework Evaluation and experimental results Conclusion 3

A.C. Chen ADL SMS Deliver Process 4 SMS_SUBMIT SMS_DELIVER BSC: Base Station Controller MSC: Mobile Switch Center GMSC: Gateway MSC IWMSC: Interworking MSC

A.C. Chen ADL Short Message Service ( SMS ) A message sent to and from a mobile phone are first sent to an intermediate component called the Short Message Service Center (SMSC) The SMS message exists in 2 formats SMS_SUBMIT: mobile phone to SMSC SMS_DELIVER: SMSC to mobile phone 5

A.C. Chen ADL GSM Modem The SMS received on a mobile phone is handled through the GSM modem Provides an interface with the GSM network and the application processor of a smart phone Controlled through standardized AT commands Apps Telephony Stack Modem AT commands AT Result Codes Responsible for cellular communications Responsible for the communication between application processor and the modem 6

A.C. Chen ADL Example: SMS_DELIVER ///AT Result Code + the length of SMS Complete SMS string in hex. 7

A.C. Chen ADL Malformed SMS attack Cause the application processor to reach an undefined state Significant processing delays Unauthorized access Denying legitimate users access … Apps Telephony Stack Modem However, malformed message detection in mobile phones has received little attention 8

A.C. Chen ADL In this Paper… A malformed message detection framework was proposed Automatically extracts novel syntactical features to detect a malformed SMS at the access layer of mobile phones 9

A.C. Chen ADL Introduction Malformed message detection framework Evaluation and experimental results Conclusion 10

A.C. Chen ADL Common Idea 11

A.C. Chen ADL SMS Detection Framework Message Analyzer Feature Extraction Feature Selection Classification 12

A.C. Chen ADL Message Analyzer Message dissection Transform incoming SMS messages into a format from which we can extract intelligent features Extracts the complete SMS message string i.e. the second line of AT Result code Feature Extraction Feature Selection Classification Message Analyzer 13

A.C. Chen ADL Extraction of String Features Mine features from an incoming SMS message Exploit the properties of a suffix tree Use a set of attribute strings to model the content of the incoming messagea set of attribute strings Entrenching function : Extracts the ( attribute, value ) pair from the suffix tree attribute: a feature string a value: the frequency of a from the nodes of the suffix tree Example 14 Feature Extraction Feature Selection Classification Message Analyzer

A.C. Chen ADL Raw Model Vectors 15 Feature Extraction Feature Selection Classification Message Analyzer

A.C. Chen ADL Feature Selection The high dimensionality of the raw model will result in large processing overheads Remove redundant features having low classification potential Not at the cost of a high false alarm rate 16 Message Analyzer Feature Extraction Classification Feature Selection

A.C. Chen ADL Selection Techniques Use 3 selection mechanisms to obtain 3 distinct model set of attributes Information Gain (IG) Gain Ratio (GR) Chi Squared (CH) 17 Message Analyzer Feature Extraction Classification Feature Selection

A.C. Chen ADL Distance/Divergence For a given vector of pairs, compute the deviation ( message score, distance ) of the vector Use 2 well-known distance measures to obtain the score Manhattan distance (md) Itakura-Saito Divergence (isd) 18 Message Analyzer Feature Extraction Feature Selection Classification

A.C. Chen ADL Classification Threshold value The largest distance score of a message in the training model Raise an alarm If the distance score of an incoming SMS is greater than the threshold value 19 Message Analyzer Feature Extraction Feature Selection Classification

A.C. Chen ADL Review Training is only required in the beginning 20 threshold message score

A.C. Chen ADL Introduction Malformed message detection framework Evaluation and experimental results Conclusion 21

A.C. Chen ADL Evaluation Collect real world dataset of SMS message ≥ 5000 benign datasets Developed modem terminal interface to collect more than 5000 real world benign SMS dataset ≥ 5000 malformed datasets SMS injection framework ( Mulliner, C., et al., 2009) 22

A.C. Chen ADL Experimental Goal To select the best feature selection technique and distance measure 3 feature selection modules Information Gain (IG) Gain Ratio (GR) Chi-squared (CH) 2 distance measures Manhattan distance (md) Itakura-Saito Divergence (isd) 23

A.C. Chen ADL Parameters and Definitions 24

A.C. Chen ADL Results: Receiver Operating Characteristic Curves ROC using Manhattan Distance ROC using Itakura-Saito Divergence 25

A.C. Chen ADL Results: Overheads  Training and Threshold calculation overheads in ( ms/100 SMS )  Testing overheads in ( ms/1 SMS ) using Information Gain, Gain Ratio and Chisquared for Manhattan distance and Itakura-Saito Divergence Average training time = 3.5s/100SMS Average detection time of a malformed message = 10ms Provides the best performance 26

A.C. Chen ADL Introduction Malformed message detection framework Evaluation and experimental results Conclusion 27

A.C. Chen ADL Conclusion A real time malformed message detection framework Tested on real datasets of SMS messages Successfully detects malformed messages with a detection accuracy of more than 98% The future research will focus on further optimizing and deploying it on real world mobile devices and smart phones 28

A.C. Chen ADL 29 Q & A

A.C. Chen ADL Example of a Suffix Tree Extract feature strings from an incoming message m= The set of attribute strings is thus generatedset of attribute strings 30 Feature Extraction Feature Selection Classification Message Analyzer

A.C. Chen ADL Example of Entrenching Function 31 Feature Extraction Feature Selection Classification Message Analyzer

A.C. Chen ADL The RIL in the context of Android's Telephony system architecture [ref ] [ref ] 32

A.C. Chen ADL Modules that implement telephony functionality 33