Detecting Data Leakage from Databases on Android Apps with Concept Drift

TL;DR

This paper presents a novel OS-version independent method for detecting data leakage attacks in Android apps by modeling user behavior and identifying anomalies due to concept drift in database query workloads.

Contribution

It introduces a new approach that models user behavior with query workload distributions and detects anomalies indicating data leakage, independent of OS version.

Findings

Detected over 90% of data leakage attacks in real-world Android apps.

Effectively models behavior drift to identify suspicious database access patterns.

Provides a practical protection mechanism for app developers against data breaches.

Abstract

Mobile databases are the statutory backbones of many applications on smartphones, and they store a lot of sensitive information. However, vulnerabilities in the operating system or the app logic can lead to sensitive data leakage by giving the adversaries unauthorized access to the app's database. In this paper, we study such vulnerabilities to define a threat model, and we propose an OS-version independent protection mechanism that app developers can utilize to detect such attacks. To do so, we model the user behavior with the database query workload created by the original apps. Here, we model the drift in behavior by comparing probability distributions of the query workload features over time. We then use this model to determine if the app behavior drift is anomalous. We evaluate our framework on real-world workloads of three different popular Android apps, and we show that our system was able to detect more than 90% of such attacks.