1. Authors:Jon Oberheide, Kaushik Veeraraghavan, Evan Cooke, Jason Flinn, Farnam Jahanian Electrical Engineering and Electrical Engineering and Computer Science University of Michigan Ann Arbor Source: Proc. of MobiVirt, Breckenridge, CO, June 2008 Presenter: Hsin-Ruey, Tsai

2.  Introduction  Approach  Evaluation  Improvement

3.  Security vendors have marketed mobile- specific versions of antivirus software.  When complexity of mobile platforms and threats increase, the functionality can have significant power and resource overhead. BandwidthPower

4.  Better detection of malicious software  Reduced on-device recourse consumption  Reduced on-device software complexity

5.  Introduction  Approach  Evaluation  Improvement

6. Trapped Cache Compare If no Network service Analyze ID (After a file be analyzed) Local cache Network cache Other uses

7.  Network service: Movie detection capabilities to a network service allows the use of multiple antivirus engines in parallel by hosting them in virtualized containers.

8.  Mobile Agent: The file identifier algorithms and communications protocol with the network service Hook the execve syscall and file system operations to acquire and process candidate files before permitting their access.  Mobile-Specific Behavioral Engine: Emulate or run real operating systems and applications at runtime.

9.  SMS Spam Filtering It can be much more accurate in a network-centric deployment model through the aggregation of data from a large corpus of users.  Phishing Detection  Centralized Blacklists

10.  Introduction  Approach  Evaluation  Improvement

11.  For each experiment, we provide results for three cache states for our mobile agent (MA): CL+CR: cold local, cold remote; CL+WR: cold local, warm remote; and WL+WR: warm local, warm remote.  Computational Resources

12.  Power Consumption

13.  Disconnected operation  Privacy