Efficient Collaborative Application Monitoring Scheme for Mobile Networks

TL;DR

This paper introduces a collaborative monitoring scheme for mobile applications that leverages collective device resources and a novel flooding algorithm to efficiently detect malicious apps with reduced network overhead and high resilience.

Contribution

It proposes a new TTL Probabilistic Propagation algorithm for collaborative monitoring, outperforming existing methods in speed, efficiency, and robustness against attacks.

Findings

Outperforms existing algorithms in convergence time and network overhead.

Significantly reduces infected devices in real-world data.

Proven tolerant to Byzantine attacks.

Abstract

New operating systems for mobile devices allow their users to download millions of applications created by various individual programmers, some of which may be malicious or flawed. In order to detect that an application is malicious, monitoring its operation in a real environment for a significant period of time is often required. Mobile devices have limited computation and power resources and thus are limited in their monitoring capabilities. In this paper we propose an efficient collaborative monitoring scheme that harnesses the collective resources of many mobile devices, "vaccinating" them against potentially unsafe applications. We suggest a new local information flooding algorithm called "TTL Probabilistic Propagation" (TPP). The algorithm periodically monitors one or more application and reports its conclusions to a small number of other mobile devices, who then propagate this information onwards. The algorithm is analyzed, and is shown to outperform existing state of the art information propagation algorithms, in terms of convergence time as well as network overhead. The maximal "load" of the algorithm (the fastest arrival rate of new suspicious applications, that can still guarantee complete monitoring), is analytically calculated and shown to be significantly superior compared to any non-collaborative approach. Finally, we show both analytically and experimentally using real world network data that implementing the proposed algorithm significantly reduces the number of infected mobile devices. In addition, we analytically prove that the algorithm is tolerant to several types of Byzantine attacks where some adversarial agents may generate false information, or abuse the algorithm in other ways.