1. KB-IDS Application Design Document1 KB-IDS – Application Design Document Knowledge-based Temporal Abstraction Host- based Intrusion Detection System for Android Version 1.0Team members: Uri Kanonov, Elad Ankry, Eliya Rahamim May 18 th 2009Academic Advisor: Dr. Yuval Elovici Technical Advisor: Asaf Shabtai

2. Overview  Detailed system architecture  Brief overview of the system requirements  Main classes – Agent  Overview of the KBTA algorithm  Main classes – KBTA Processor  Overview of User Interface  Tasks List  Questions? KB-IDS Application Design Document2

3. Global architecture KB-IDS Application Design Document3 Graphical User Interface Threat Weighting Unit SQLite KBTA … Processors Service NetProtect Control Center Agent

4. Primary system requirements Functional Non-Functional  Agent  Feature extraction  Sending of extracted features to processors and Control Center  Receive alerts from the Threat Weighting Unit  KBTA Processor  Processing according to the KBTA algorithm  Producing threat assessments  Threat Weighting Unit  Threat assessment weighting  Sending of assessments to the Agent  Overall CPU usage should be under 10% (must be lightweight) KB-IDS Application Design Document4

5. Agent - main classes KB-IDS Application Design Document5 Feature Manager SQLite Linux Kernel Application Framework Graphical User Interface Agent Service Processor Manager Configuration Manager Alert Handler Threat Weighting Unit Feature Extractor Monitored Data Processor KBTA Processors NetProtect Control Center

6. Overview of the KBTA Algorithm Securing Android-based Devices T+96 Knowledge (KBTA Security ontology) Four inference mechanisms: - Temporal Context Forming - Contemporaneous Abstraction - Temporal Interpolation - Temporal Pattern Matching Higher Level Meaningful Temporal Information: - Contexts - Abstractions (Trends, States) - Temporal Patterns Time-Stamped Raw Data: - Primitive Parameters - Events

7. Overview of the KBTA Algorithm Ontology ontology; InstanceContainer instances; incrementalKBTA(List primitives, List events){ instances.add(primitives); instances.add(events); while (instances.hasNew()){ createContexts(instances, ontology); createAbstractions(instances, ontology); interpolateAbstractions(instances, ontology); } createPatterns(instances, ontology); } Ontology ontology; InstanceContainer instances; incrementalKBTA(List primitives, List events){ instances.add(primitives); instances.add(events); while (instances.hasNew()){ createContexts(instances, ontology); createAbstractions(instances, ontology); interpolateAbstractions(instances, ontology); } createPatterns(instances, ontology); } Securing Android-based Devices T+97

8. 8 Overview of the KBTA Algorithm Example Scenario Apps_With_Permission_Camera Many_Apps_With_Camera_Permission Camera_Usage Pictures_Taken Camera_Abuse Amount of non- system applications with the Camera permission Amount of pictures taken in the last 2 minutes Primitive Legen d Context State Alert

9. KBTA-Processor- Main Classes KB-IDS Application Design Document9 Service Agent Threat Weighting Unit KBTA-Processor NetProtect Control Center Ontology Instance Container Pattern State Trend Context Primitive Event Threat Assessor Threat Assessment

10. Overview of User Interface Securing Android-based Devices T+910 Main screen Settings screen Alert screen

11. Overview of User Interface Securing Android-based Devices T+911 Alert description Alert handled

12. Task List  KBTA  Context Destructions 19/05/09 - 21/05/09  Trend 21/05/09 - 25/05/09  Pattern 25/04/09 - 01/06/09  Settings Screen 01/06/09 - 06/06/09  Sending elements to NetProtect 06/06/09 - 08/06/09  Testing 08/06/09 - 23/06/09 Securing Android-based Devices T+912

13. End Questions? KB-IDS Application Design Document13