Mobile Security

Mobile malware has continued to grow at an alarming rate despite on-going mitigation efforts. This has been much more prevalent on Android due to being an open platform that is rapidly overtaking other competing platforms in the mobile smart devices market. Recently, a new generation of Android malware families has emerged with advanced evasion capabilities which make them much more difficult to detect using conventional methods. This paper proposes and investigates a parallel machine learning based classification approach for early detection of Android malware. Using real malware samples and benign applications, a composite classification model is developed from parallel combination of heterogeneous classifiers. The empirical evaluation of the model under different combination schemes demonstrates its efficacy and potential to improve detection accuracy. More importantly, by utilizing several classifiers with diverse characteristics, their strengths can be harnessed not only for enhanced Android malware detection but also quicker white box analysis by means of the more interpretable constituent classifiers.

Over the last years, there has been a real revolution of mobile devices, which has effectively translated into the exponential increase in internet access rates on a mobile device as opposed to accessing it on desktop systems. Given the growing importance of smartphones, it is important to assess the privacy and security risks of these devices in order to mitigate them. However, as we know, in modern mobile security architecture, applications represent the most critical elements. In this paper we review common mobile applications flaws involving network communications, data storage, user input handling and also exploring a number of vulnerabilities. While applications provide amazing features and benefits for users, they also represent the main attraction for cyber criminals. In order to have a true picture of the mobile security threat spectrum, this article presents the means of how mobile applications can impact systems security, stability and compromise personal data if they are...

This paper’s purpose is to identify and accentuate the dilemma faced by small- to medium-sized enterprises (SMEs) who use mobile devices as part of their mobility business strategy. While large enterprises have the resources to implement emerging security recommendations for mobile devices, such as smartphones and tablets, SMEs often lack the IT resources and capabilities needed. The SME mobile device business dilemma is to invest in more expensive maximum security technologies, invest in less expensive minimum security technologies with increased risk, or postpone the business mobility strategy in order to protect enterprise and customer data and information. This paper investigates mobile device security and the implications of security recommendations for SMEs.

In 2013, people will purchase 1.2 billion mobile devices, surpassing PC’s as the most common method for accessing the Internet. The leading two mobile device platforms, Android and iOS, both have security concerns surrounding their operating systems and application markets. The popularity of Bring Your Own Device (BYOD), where employees use their own devices for both personal and work situations, potentially brings insecure devices into the organization. While most IT professionals agree mobile devices pose major security risks, there is a major lack of mobile device security awareness and training programs in organizations. This paper reports the results of a survey of 131 college students entering the workforce, which demonstrates a lack of security awareness and the need for mobile device security awareness and training in organizations. This paper also reviews the major security concerns with mobile devices and makes some general security recommendations.

The increasing pace in the wireless communication taking momentum in the market of commercial application where a significant trade-off between user-experience and security demands exists. The Near Field Communication or NFC is one such communication trend which is effectively adopted by the user worldwide to make touchless operation using their mobile device. Although, it is claimed that NFC incorporates some of the standard encryption but existing researchers fails to prove that their electromagnetic signals are snot so difficult to compromise to result in collateral damage to user's resources. Thus, there exist research work towards strengthing security system, but there is yet to report on any standard security protocol or framework to ensure the highest resiliency. This paper provides a comprehensive visualization towards the effectiveness of existing research approaches to formulate the research trend and gap.

Wireless (Wi-Fi) networks based on IEEE 802.11 1 family of standards have been spreading its coverage last years and this trend is expected to grow. Every day more and more people use this type of networks to access Internet, company or other types of networks. Today's wireless networks are vulnerable in many ways (rogue access points, hijacking sessions, eavesdropping, illegal use, unauthorized access, denial of service attacks, floods, stealing data and other types of misuse and attacks etc). People are worried about unknowingly exposing their computers to illegal access through the air, from an undefined location. On wired networks the intruder can access by wire, but in wireless environments the intruder can access the network from anywhere in the neighborhood. At the present time there are IDS's but mostly deployed on wired networks, and based on rules and signatures of already known and analyzed intrusions. These systems can't answer the demand in environments where new intrusions are occurring every day due their legacy IDS's limitations. Intrusion detection agent presented in this paper is part of WIDSwireless intrusion detection system. WIDS Agent is software installed on mobile computer device. It detects intrusions and attacks by analyzing traffic and making conclusions and denies it. It works as standalone module or coupled (in contribution) with WIDS Sensor and Server that are also part of this system. Position of application is on personal computer (PC), including Pocket PC (PPC), other PDA devices and similar computerized and mobile devices. This system has capabilities such as: self learning, autonomy and decision, self-decision and self defense including alerting. This is multidimensional system in development which is intended to cover most of wireless networks specific vulnerabilities and intrusion. It should work in real-time and defend user i.e. his computer or system against majority of intrusions nevertheless of fact if they are already known or new kind of attacks. System is integrated in clients and performs local data collection and filtering, works as local detection engine cooperating with neighboring WIDS agents (cooperative detection engine). It provides local response and/or global response against intrusion. Also, this system works in the closest relationship with firewall software and devices, antivirus software, network management and other security tools.

Smartphones are the most popular personal electronic devices. They are used for all sorts of purposes, from managing bank accounts to playing games. As smartphone apps and services proliferate, the amount of sensitive data stored on or processed by handheld devices rise as well. This practice entails risks, such as violating users’ privacy, stealing users’ identities, etc. Particularly, stealing an unlocked device grants full access to sensitive data and applications. In this survey, we examine whether users adopt some basic practices to protect their sensitive personal data themselves, or is there a need to further strengthen their protection? Our statistical analysis assesses smartphone users’ security attitudes and practices among different age groups. Finally, we investigate the factors that affect the attitude of users with respect to their practices for the protection of personal data.The results of this study, show that while many smartphone users do take some security precau...

Deep web content cannot be indexed by search engine such as Google, Yahoo and Bing and darknet is lies within the deep web. Dark web has been intentionally hidden and it is not accessible through standard browser. Deep web can be accessed by anyone who has The Onion Router (TOR) browser. TOR is a virtual and encrypted tunnel which allows people to hide their identity and network traffic, and allow them to use internet anonymously. Dark web is virtually online market for anything, including but not limited to drugs, weapons, credit card data, forged documents, hire services for murder, narcotics and indecent pornography etc,. Because of these reasons, it is difficult for law enforcement agencies or digital forensic professionals to pinpoint the origin of traffic, location or ownership of any computer or person on the dark net. There has been lot of buzz around Bitcoin, TOR network and darknet, because most of the darknet sites carried out transactions through anonymous digital currency, pear to peer, distributed and Bitcoin which is based on cryptography principal. In this research paper, I proposed darknet forensics techniques, which is a combination of TOR browser and Bitcoin wallet forensics. I am also proposed and discussed different technique to retrieve evidences from TOR browser and Bitcoin wallet, which helps digital forensics professional to perform darknet forensics.

The research and communications for detecting mobile security threats with the best protection practices of applications have become essential goals nowadays due to the continuous discoveries of new vulnerabilities. The internet and web-based activities have been increased drastically in recent times by users of all categories. Users have extensively started involved in gaming, banking, frequent bill payment, entertainment, and other network and online activities that are requiring a large number of mobile phone protection and security mechanisms in response to advancements in full-stack applications and wireless networks. The goal of this paper is to uncover the best-applied practices in the domain of mobile security to protect smartphone devices. The main advantages of smartphones are small size with easiness in carrying anywhere and can be a replacement for computing devices in some ways for example emails. Unfortunately, the convenience of using smartphones to do the private task is the loophole cyber attackers need to gain access to personal data. Thus, this paper proposed eight best practices to protect and secure smart mobile phones.

Mobile devices pose interesting challenges and opportunities in the area of computer security. As the functionality of mobile devices increase so are the threats. Nowadays, smartphone users can email, video call, use social networking applications, download various applications, do online shopping and banking among others. Challenges arise because as mobile devices evolve toward fully functional computers, they become targets for exploits that are common for personal computers and potentially new exploits arising from the usage modes these devices offer.
This paper provides an insight into the recent major challenges and achievements in the security for mobile devices and applications. The paper explores the latest understanding and advances in the security and privacy for mobile devices applications. The paper contains ideas that have been gained through thorough literature review and cross-examining different researchers’ opinions.

The intrinsic vulnerabilities in the cyberspace and ever-escalating cyber-attacks tend to continuously threaten the national security, economy and daily life of citizens. More than fifty countries, around the world, have formulated their Cyber Security Strategies to address the grave concerns of national cyber security. A cyber security strategy is particularly aimed at securing the national cyberspace from malevolent cyber threat vectors, but owing to the varying threat landscape, considerable variations can be seen in the preventive, defensive and offensive measures and approaches adopted by each country. This research paper analyzes and compares National Cyber Security Strategies of twenty countries based on the documented legal, operational, technical and policy-related measures. The majority of the strategies have described the need of appointing an official body for leading the cyber security tasks at the national level and establishment of Computer Emergency Response Teams (CERT/CSIRT) to fight cyber-attacks targeting national cyberspace. However, disparity lies in the understanding of major key terms (particularly cyber security and cyberspace), characterization of the cyber threats, aims and description of cyber awareness and capacity building programs, legislative measures etc. Based on the comparison, the research specifies and recommends best practices for improving the state of national cyber security and resilience. The countries planning to develop or update their cyber security strategies can use this research study to their advantage.

https://sites.google.com/site/ijcsis/

E-government is one of the most rapidly evolving service domains in the contemporary information society. Many governments have already developed and provided e-government services to businesses and citizens. Nowadays actors in the government domain attempt to take the next step and exploit the latest wireless technologies in order to provide ubiquitous services for mobile users. However, this approach involves some hidden risks mainly due to the inherent insecurity of the air medium and the vulnerabilities of the wireless systems. Thus, in this paper we investigate the security gaps and considerations which should be taken into account for an m-government system. Also, the case of an m-government portal, which was designed to provide mG2B services for the agricultural sector, is presented. Furthermore, we describe the architectural aspects of this portal and provide some best practices for securing its transactions. Finally, we provide a list of security guidelines and policies, wh...

In era of technological advancement and globalization , mobile devices have become a necessity for us ,almost everyone has a mobile device or access to one. They have made the world accessible and communication convenient, all at the touch of a button. Various aspects of people's lives can be represented by an application on a mobile device. These applications range from the food order to schedule appointments. most of the commercial website services are now porting to mobile application , latest statistics show that there is more then 1.6 million apps available for android users and more then 1.5 million apps available for ios users .this evolution is bringing full range of new attacks on users based on mobile application vulnerabilities which is very different then comman web application attacks. Guideline/resources and Tools for Security testing of web application platform is widely available on internet. but there is very few resources available for mobile application security/penetration testing. So in this article we will be covering about Various Tools available for " mobile application security testing ". We will focus mostly on open source tools , framework which are publicly available to use , modify and contribute for mobile app security testing. As Mobile Application is based on Mobile OS like android , IOS , Windows OS etc, we have different methodology and tools for testing security of mobile application , so here we will categorize tools in below categories :-­‐ Android Application Security Testing etc..

The Indian government, like governments elsewhere in the world, has chosen mobile device as preferred platform to engage with citizens while offering various e-Governance services. Likewise there is huge market for mobile based e-Commerce applications across the globe. However uptake of these services is challenged by the security and privacy concerns of the end user. The limited processing power and memory of a mobile device dependent on inherently unreliable wireless channel for communication and battery for power leaves little scope for a reliable security layer. Thus there is a need for a lightweight secure framework that provides security with minimum communication and processing overhead on mobile devices. The security and privacy protection services can be achieved with the help of secure mobile-cloud application services. Taking support from a proximate cloud a security service could be devised for a mobile device which works as an interface and adaptively provides optimum s...

Over the last years, there has been a real revolution of mobile devices, which has effectively translated into the exponential increase in internet access rates on a mobile device as opposed to accessing it on desktop systems. Given the growing importance of smartphones, it is important to assess the privacy and security risks of these devices in order to mitigate them. However, as we know, in modern mobile security architecture, applications represent the most critical elements. In this paper we review common mobile applications flaws involving network communications, data storage, user input handling and also exploring a number of vulnerabilities. While apps provide amazing features and benefits for users, they also represent the main attraction for cyber criminals. In order to have a true picture of the mobile security threat spectrum, this article presents the means of how mobile applications can impact systems security, stability and compromise personal data if they`re not hand...

Over the last years, there has been a real revolution of mobile devices, which has effectively translated into the exponential increase in internet access rates on a mobile device as opposed to accessing it on desktop systems. Given the growing importance of smartphones, it is important to assess the privacy and security risks of these devices in order to mitigate them. However, as we know, in modern mobile security architecture, applications represent the most critical elements. In this paper we review common mobile applications flaws involving network communications, data storage, user input handling and also exploring a number of vulnerabilities. While applications provide amazing features and benefits for users, they also represent the main attraction for cyber criminals. In order to have a true picture of the mobile security threat spectrum, this article presents the means of how mobile applications can impact systems security, stability and compromise personal data if they are...

Computer security, also known as cybersecurity or IT security, is the protection of information systems from theft or damage to the hardware, the software, and to the information on them, as well as from disruption or misdirection of the services they provide.[1] It includes controlling physical access to the hardware, as well as protecting against harm that may come via network access, data and code injection,[2] and due to malpractice by operators, whether intentional, accidental, or due to them being tricked into deviating from secure procedures.[3]
The field is of growing importance due to the increasing reliance on computer systems in most societies.[4] Computer systems now include a very wide variety of "smart" devices, including smartphones, televisions and tiny devices as part of the Internet of Things – and networks include not only the Internet and private data networks, but also Bluetooth, Wi-Fi and other wireless networks.

This paper offers an up-to-date, comprehensive, extensive and targeted survey on Behavioral Biometrics and Continuous Authentication technologies for mobile devices. Our aim is to help interested researchers to effectively grasp the background in this field and to avoid pitfalls in their work. In our survey, we first present a classification of behavioral biometrics and continuous authentication technologies for mobile devices and an analysis for behavioral biometrics collection methodologies and feature extraction techniques. Then, we provide a state-of-the-art literature review focusing on the machine learning models performance in seven types of behavioral biometrics for continuous authentication. Further, we conduct another review that showed the vulnerability of machine learning models against well-designed adversarial attack vectors and we highlight relevant countermeasures. Finally, our discussions extend to lessons learned, current challenges and future trends.

Keywords
Machine Learning, Behavioral Biometrics, Continuous Authentication, Mobile Devices, Attacks, Defense, Survey.

Smartphones are one of the biggest technology achievements in today's world as they have are helping us in several ways and have now become an integral part of our daily life. From making calls to delivering presentations and from navigation to photography they are assisting us thus making our live a bit easier.

To improve the security of mobile management is to identify and analyze the needs of wireless mobility that revolve around the protection modules data lost or stolen devices through remote functions To achieve this, it was first necessary to apply data prevention strategies, ensures the encryption of compliance by blocking devices unbridled or unencrypted for it must be given an intelligence vision, through securing the different mobile data components of its technical architecture. To isolate mobile data analysis queries and operational queries. As analysis requests are often very cumbersome, the main objective was to preserve the performance of the mobile operating systems. Then this database dedicated to queries and analysis gradually transferred and organized.

In this paper the research surrounding the Augmented Reality in games on Android platform was performed by testing 108 games from Google Play Market and by analyzing the hundreds of user reviews to determine the level of acceptance and the level of technical stability of the mobile games based on that technology. The Location-based, Marker-based and games based on somewhat different approach were studied and compared by the runtimes, game genres and by the featuring aspects including the presence of multiplayer mode, sound effects and the dimension that the virtual objects were positioned in. The overview of the studied games was presented in this paper. The results, for instance, include that the AR game variation is very narrow in terms of gameplay style and technical issues are very commonly encountered and it makes them very influential to the gameplay experience. The rareness of the multiplayer mode among the AR games was discovered meaning the domination of the single-player game designs.

Mobile phone; which in some few years past was nothing more than a call-making tool, and at best for text messaging, has evolved to be very powerful device, hence the modern name: Smartphone. Smartphone’s unique computing capabilities, varied catalogue of software applications, fast connectivity, intuitive tendency and user-friendliness, blended with portability make it a fully-fledged miniaturized computer that fit into the user’s pocket. Owing to the enormous functionalities
and wealthy information a smartphone can hold, it has become an attractive mine field for attackers and malware creators. As smartphone gain unprecedented admiration and international usage statistics swells exponentially, hackers are enticingly lured to maliciously prey on the unsecured device of the uninformed user.
This research focuses on smartphone user’s consciousness towards mobile security threats, vulnerabilities and user’s security culture and countermeasures taken to avert any mobile threat. The interpretation of results revealed that most of the smartphone users were not conscious of the need for security on their mobile handset nor do users enable the necessary security features.

The research and communications for detecting mobile security threats with the best protection practices of applications have become essential goals nowadays due to the continuous discoveries of new vulnerabilities. The internet and web-based activities have been increased drastically in recent times by users of all categories. Users have extensively started involved in gaming, banking, frequent bill payment, entertainment, and other network and online activities that are requiring a large number of mobile phone protection and security mechanisms in response to advancements in full-stack applications and wireless networks. The goal of this paper is to uncover the best-applied practices in the domain of mobile security to protect smartphone devices. The main advantages of smartphones are small size with easiness in carrying anywhere and can be a replacement for computing devices in some ways for example emails. Unfortunately, the convenience of using smartphones to do the private task is the loophole cyber attackers need to gain access to personal data. Thus, this paper proposed eight best practices to protect and secure smart mobile phones.

By offering sophisticated services and centralizing a huge volume of personal data, modern smartphones changed the way we socialize, entertain and work. To this aim, they rely upon complex hardware/software frameworks leading to a number of vulnerabilities, attacks and hazards to profile individuals or gather sensitive information. However, the majority of works evaluating the security degree of smartphones neglects steganography, which can be mainly used to: i) exfiltrate confidential data via camouflage methods, and ii) conceal valuable or personal information into innocent looking carriers. Therefore, this paper surveys the state of the art of steganographic techniques for smartphones, with emphasis on methods developed over the period 2005 to the second quarter of 2014. The different approaches are grouped according to the portion of the device used to hide information, leading to three different covert channels, i.e., local, object and network. Also, it reviews the relevant approaches used to detect and mitigate steganographic attacks or threats. Lastly, it showcases the most popular software applications to embed secret data into carriers, as well as possible future directions.

This report reviews the influence of Artificial Intelligence (AI) on cyber security processes. For example, artificial intelligence consists of a bunch of practices that are covering machine learning, deep learning, neural networks, natural language processing amidst other variants. Machines can demonstrate Artificial Intelligence as their primary Intelligence. AI can be designated if a system identifies its background and decides relevant procedures to gain success in the relevant field. In our day to day lives, Artificial intelligence effectively keeps its growth rate high by transforming the duties of humans of society. At present, the most powerful companies utilize the ability of artificial intelligence on behalf of improving their productivity for a better marketplace. As we know, this sort of technology is rising suddenly.

Mobile devices, including smartphones and tablets, enable users to access corporate data from anywhere. In 2013, people will
purchase 1.2 billion mobile devices, surpassing personal computers as the most common method for accessing the Internet. However, security of these mobile devices is a major concern for organizations. The two leading mobile operating systems (OS), Google’s Android OS and Apple’s iOS, both have security concerns as do the mobile applications and the major
application markets. ‘Bring your own devices,’ where employees supply their own equipment for work-related purposes, can
cut costs for organizations, but failing to address security can significantly increase those costs. This paper focuses on the
increasing need for mobile business and its related mobile device security concerns. We propose that future IT professionals should be aware of these issues and learn how to secure mobile devices through the integration of the topic into the IT Model Curriculum. Using the case of one undergraduate IT program, we developed a set of mobile device security education recommendations, which we then mapped to the IT Model Curriculum using the guidelines from Accreditation Board for Engineering and Technology (ABET). This mapping approach demonstrates one way how higher education institutions could
integrate mobile device security into any IT curriculum.

The Android operating system has been the most popular for smartphones and tablets since 2012. This popularity has led to a rapid raise of Android malware in recent years. The sophistication of Android malware obfuscation and detection avoidance methods have significantly improved, making many traditional malware detection methods obsolete. In this paper, we propose DL-Droid, a deep learning system to detect malicious Android applications through dynamic analysis using stateful input generation. Experiments performed with over 30,0 0 0 applications (benign and malware) on real devices are presented. Furthermore, experiments were also conducted to compare the detection performance and code coverage of the stateful input generation method with the commonly used stateless approach using the deep learning system. Our study reveals that DL-Droid can achieve up to 97.8% detection rate (with dynamic features only) and 99.6% detection rate (with dynamic + static features) respectively which outperforms traditional machine learning techniques. Furthermore, the results highlight the significance of enhanced input generation for dynamic analysis as DL-Droid with the state-based input generation is shown to outperform the existing state-of-the-art approaches.

Android malware has been on the rise in recent years due to the increasing popularity of Android and the proliferation of third party application markets. Emerging Android malware families are increasingly adopting sophisticated detection avoidance techniques and this calls for more effective approaches for Android malware detection. Hence, in this paper we present and evaluate an n-gram opcode features based approach that utilizes machine learning to identify and categorize Android malware. This approach enables automated feature discovery without relying on prior expert or domain knowledge for predetermined features. Furthermore, by using a data segmentation technique for feature selection, our analysis is able to scale up to 10-gram opcodes. Our experiments on a dataset of 2520 samples showed an f-measure of 98% using the n-gram opcode based approach. We also provide empirical findings that illustrate factors that have probable impact on the overall n-gram opcodes performance trends.

Over the last years, there has been a real revolution of mobile devices, which has effectively translated into the exponential increase in internet access rates on a mobile device as opposed to accessing it on desktop systems. Given the growing importance of smartphones, it is important to assess the privacy and security risks of these devices in order to mitigate them. However, as we know, in modern mobile security architecture, applications represent the most critical elements. In this paper we review common mobile applications flaws involving network communications, data storage, user input handling and also exploring a number of vulnerabilities. While apps provide amazing features and benefits for users, they also represent the main attraction for cyber criminals. In order to have a true picture of the mobile security threat spectrum, this article presents the means of how mobile applications can impact systems security, stability and compromise personal data if they`re not handled properly.