1. Pablo Garaizar Sagarminaga Jaime Devesa Esteban Dr. Igor Santos

2.  Malware detection  Mobile Security  Spam Filtering 2

3.  PORTADA Definición ¿What is malware? 3

4.  Malware  Any executable explicitally designed to harm computers or computer networks 4

5.  Malware  There are several types of malware ▪ Viruses ▪ Worms ▪ Spyware ▪ Trojan horses ▪ Botnets 5

11.  Malware has changed 11

14.  In the begining, fame and glory  Now.. 14

17.  In the begining, fame and glory  Now, they seek money 17

18.  In the begining, fame and glory  Now, they seek money  Implies Changes ▪ A better hiding capability ▪ More and more malware 18

19.  Malware detection  Based on signatures 19

20. E8 0000000 call 0h 5B pop ebx 8D 4B 42 lea ecx, [ebx + 42h ] 51 push ecx 50 push eax 0F01 4C 24 FE sidt [esp - 02h] 5B pop ebx 83 C3 1C add ebx 1Ch FA cli 8B 2B mov ebp, [ebx]

21. E800 0000 005B 8D4B 4251 5050 0F01 4C24 FE5B 83C3 ACFA 8B2B

22.  Malware detection  Based on signatures  Signatures are stored in order to detect known malware 22

23. SIGNATURE DATABASE Signature1 Original Malware Implementation 1Implementation 2 New Implementation NO DETECTION! Signature 2

24. E8 0000000 call 0h 5B pop ebx 8D 4B 42 lea ecx, [ebx + 42h ] 51 push ecx 50 push eax 90nop 0F01 4C 24 FE sidt [esp - 02h] 5B pop ebx 83 C3 1C add ebx 1Ch FA cli 8B 2B mov ebp, [ebx]

25. E800 0000 005B 8D4B 4251 5050 9090 0F01 4C24 FE5B 83C3 ACFA 8B2B E800 0000 005B 8D4B 4251 5050 0F01 4C24 FE5B 83C3 ACFA 8B2B 9090 is not in the signature 9090

26.  Malware detection  Based on signatures  Signatures are stored in order to detect known malware  Unable to handle obfuscation! 26

27. 27 Malware Detection Knowledge-based malware variant detection Unknown malware detection Anomaly-based Machine-learning- based StaticDynamicHybrid StaticDynamicHybrid StaticDynamicHybrid

28.  PORTADA Definición ¿What is spam? 28

30. Monty Python Flying Circus

31. WHAT YOU GOT, THEN ? SPAM, EGG, SPAM, SPAM, BACON AND SPAM. SPAM, SPAM, SPAM, BAKED BEANS AND SPAM. ANYTHING WITHOUT SPAM? I DON’T LIKE SPAM!! UGH!

34. Identity Theft

37. 1. Training of the model 2. Classification of the new e- mails

38. t1t1 t2t2 t3t3 D1D1 D2D2 D 10 D3D3 D9D9 D4D4 D7D7 D8D8 D5D5 D 11 D6D6 Vector Space Model

39.  PORTADA Definición ¿What is malware in Android? 39

40. Mobile phones have evolved

41. In fact, now they call them smartphones

43. 1 millon of activations a day

44. Nokia 3410 Samsung Galaxy Nexus Cámara de fotos GPS Brújula digital WiFi Bluetooth microUSB NFC Aceleremeter Proximity Sensor Baromeer Giroscope Light Sensor

45. How do they manage security? and privacy?

46. Android Malware

47. “Andromaly”: a behavioral malware detection framework for android devices. Shabtai, A., Kanonov, U., Elovici, Y., Glezer, C., & Weiss, Y. (2012). Journal of Intelligent Information Systems, 1- 30.

48. TaintDroid: an information- flow tracking system for realtime privacy monitoring on smartphones Enck, W., Gilbert, P., Chun, B. G., Cox, L. P., Jung, J., McDaniel, P., & Sheth, A. N. (2010, October). In Proceedings of the 9th USENIX conference on Operating systems design and implementation (pp. 1-6).

49. Dissecting Android Malware: Characterization and Evolution Zhou, Y., & Jiang, X. In Security and Privacy (SP), 2012 IEEE Symposium on (pp. 95-109). IEEE.

50. “ So it is said that if you know your enemies and know yourself, you can win a hundred battles without a single loss.” Sun Tzu 孫子 – The Art of War