1. Securing Android-based Devices T+91 KB-IDS - Prototype Knowledge-based Temporal Abstraction Host- based Intrusion Detection System for Android Version 1.0Team members: Uri Kanonov, Elad Ankry, Eliya Rahamim May 11 th 2009Academic Advisor: Dr. Yuval Elovici Technical Advisor: Asaf Shabtai

2. Global system architecture Securing Android-based Devices T+92 Graphical User Interface Feature Manager Loggers Communication layer Threat Weighting Unit Application Level Operating System Scheduling Memory Keyboard Network Hardware Power SQLite Feature Extractors Configuration Manager KBTA… Processors Alert Handler Agent Service Processor Manager NetProtect Linux Kernel Application Framework

3. KBTA-Processor Implemented  Ontology  Loading  Storage  Handled Elements  Primitives  Events  State  Context  Computation  KBTA-Service (Incremental Abstraction)  Monitoring  Alerts definition  Loading from XML  Storage  Monitoring Abstractions  Communication with the TWU Securing Android-based Devices T+93

4. KBTA-Processor Remaining  Handled Elements  Trend  Pattern  Context destruction  Processor setting screen  Sending of monitored elements to NetProtect Securing Android-based Devices T+94

5. Overview of the KBTA Algorithm Securing Android-based Devices T+95 Knowledge (KBTA Security ontology) Four inference mechanisms: - Temporal Context Forming - Contemporaneous Abstraction - Temporal Interpolation - Temporal Pattern Matching Higher Level Meaningful Temporal Information: - Contexts - Abstractions (Trends, States) - Temporal Patterns Time-Stamped Raw Data: - Primitive Parameters - Events

6. Securing Android-based Devices T+96 Perm_Camera Many_Apps_With_Camera_Permission Camera_Usage Camera Camera_Abuse Demonstration Scenario #1 Amount of non- system applications with the Camera permission Amount of pictures taken in the last 2 minutes Primitive Legen d Context State Alert

7. Securing Android-based Devices T+97 Running _Processes Amount_of_Processes_High Garbage_Collections High_CPU_Usage Garbage_Collections_Level Minor_Page_Faults Minor_Page_Faults_Level Context_Switches_Level Context_Switches CPU_Usage System_Load_level Abnormal System Load Demonstration Scenario #2