Android App Malicious Behavior Detection Based on User Intention

Security-sensitive behaviors in Android applications (apps for short) may or may not be malicious. We propose that a fundamental difference between malicious and benign behaviors is that their corresponding user intentions are different, i.e., whether there is an association between the app behavior and user intention. The user knows and wants this behavior to happen. Based on this discovery, we first design and realize IBdroid, which can precisely monitor user inter-faces, user actions and security-sensitive behaviors of apps. Then the user intention features, which can perceive the correlations between user intention and app behavior from time, process, semantic and data perspectives, are extracted from the records obtained by IBdroid. Finally, an approach using user intention features is proposed to differentiate benign and malicious behaviors. In our evaluations, we correctly identify 333 out of 354 security-sensitive behaviors, achieving 96.43% precision and 91.53% recall, the experimental result demonstrates that our approach can effectively and accurately detect and block malicious behaviors of Android apps.