Detecting Data Leakage from Databases on Android Apps with Concept Drift
Gokhan Kul, Shambhu Upadhyaya, Varun Chandola

TL;DR
This paper presents a novel OS-version independent method for detecting data leakage attacks in Android apps by modeling user behavior and identifying anomalies due to concept drift in database query workloads.
Contribution
It introduces a new approach that models user behavior with query workload distributions and detects anomalies indicating data leakage, independent of OS version.
Findings
Detected over 90% of data leakage attacks in real-world Android apps.
Effectively models behavior drift to identify suspicious database access patterns.
Provides a practical protection mechanism for app developers against data breaches.
Abstract
Mobile databases are the statutory backbones of many applications on smartphones, and they store a lot of sensitive information. However, vulnerabilities in the operating system or the app logic can lead to sensitive data leakage by giving the adversaries unauthorized access to the app's database. In this paper, we study such vulnerabilities to define a threat model, and we propose an OS-version independent protection mechanism that app developers can utilize to detect such attacks. To do so, we model the user behavior with the database query workload created by the original apps. Here, we model the drift in behavior by comparing probability distributions of the query workload features over time. We then use this model to determine if the app behavior drift is anomalous. We evaluate our framework on real-world workloads of three different popular Android apps, and we show that our…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
