Advanced persistent threat (APT) detection in a mobile device
Advanced persistent threats to a mobile device are detected and prevented by leveraging the built-in mandatory access control (MAC) environment in the mobile operating system in a “stateful” manner. To this end, the MAC mechanism is placed in a permissive mode of operation wherein permission denials are logged but not enforced. The mobile device security environment is augmented to include a monitoring application that is instantiated with system privileges. The application monitors application execution parameters of one or more mobile applications executing on the device. These application execution parameters including, without limitation, the permission denials, are collected and used by the monitoring application to facilitate a stateful monitoring of the operating system security environment. By assembling security-sensitive events over a time period, the system identifies an advanced persistent threat (APT) that otherwise leverages multiple steps using benign components. Once an APT has been detected, a mitigation action (e.g., terminating the malicious process) is undertaken.
1. A method to secure a mobile device operating system that enforces a mandatory access control (MAC) security model, comprising:
instantiating mandatory access control (MAC) in the mobile device operating system in a permissive mode of operation in which permission denials are logged but not enforced;
monitoring application execution parameters as one or more applications are executed;
collecting, as a set of security-sensitive events, the application execution parameters including one or more permission denials generated by the MAC operating in the permissive mode of operation, the collected set of security-sensitive events representing a monitored state of the mobile device operating system;
determining whether the set of security-sensitive events representing the monitored state match against a signature that is indicative of an advanced persistent threat (APT); and
taking an action to mitigate the advanced persistent threat upon determining that the set of security-sensitive events match against the signature.
2. The method as described in claim 1 wherein the application execution parameters are monitored using a monitoring application instantiated by the mobile device operating system with system privileges.
3. The method as described in claim 1 wherein the mobile device operating system is an application sandbox-based operating system that executes mandatory access control on inter-process communications (IPC) and permissions.
4. The method as described in claim 1 wherein the application execution parameters are collected over a given time period.
5. The method as described in claim 4 further including delaying a response to the set of security-sensitive events until a confidence level of an attack as evidenced by the security-sensitive events exceeds a predetermined metric as evidenced by the signature.
6. The method as described in claim 5 further including declaring the APT when the confidence level is reached.
7. Apparatus, comprising:
a processor;
computer memory holding computer program instructions executed by the processor to secure a mobile device operating system that enforces a mandatory access control (MAC) security model, the computer program instructions comprising program code configured to:
instantiate mandatory access control (MAC) in the mobile device operating system in a permissive mode of operation in which permission denials are logged but not enforced;
monitor application execution parameters as one or more applications are executed;
collect, as a set of security-sensitive events, the application execution parameters including one or more permission denials generated by the MAC operating in the permissive mode of operation, the collected set of security-sensitive events representing a monitored state of the mobile device operating system;
determine whether the set of security-sensitive events representing the monitored state match against a signature that is indicative of an advanced persistent threat (APT); and
take an action to mitigate the advanced persistent threat upon determining that the set of security-sensitive events match against the signature.
8. The apparatus as described in claim 7 wherein the application execution parameters are monitored using a monitoring application instantiated by the mobile device operating system with system privileges.
9. The apparatus as described in claim 7 wherein the mobile device operating system is an application sandbox-based operating system that executes mandatory access control on inter-process communications (IPC) and permissions.
10. The apparatus as described in claim 7 wherein the application execution parameters are collected over a given time period.
11. The apparatus as described in claim 10 wherein the program code is further configured to delay a response to the set of security-sensitive events until a confidence level of an attack as evidenced by the security-sensitive events exceeds a predetermined metric as evidenced by the signature.
12. The apparatus as described in claim 11 wherein the program code is further configured to declare the APT when the confidence level is reached.
13. A non-transitory computer readable storage medium, storing thereon a computer program product, the computer program product comprising computer program instructions executed by a hardware processor to secure a mobile device operating system that enforces a mandatory access control (MAC) security model, the computer program instructions comprising program code configured to:
instantiate mandatory access control (MAC) in the mobile device operating system in a permissive mode of operation in which permission denials are logged but not enforced;
monitor application execution parameters as one or more applications are executed;
collect, as a set of security-sensitive events, the application execution parameters including one or more permission denials generated by the MAC operating in the permissive mode of operation, the collected set of security-sensitive events representing a monitored state of the mobile device operating system; and
determine whether the set of security-sensitive events representing the monitored state match against a signature that is indicative of an advanced persistent threat (APT); and
take an action to mitigate the advanced persistent threat upon determining that the set of security-sensitive events match against the signature.
14. The non-transitory computer readable storage medium as described in claim 13 wherein the application execution parameters are monitored using a monitoring application instantiated by the mobile device operating system with system privileges.
15. The non-transitory computer readable storage medium as described in claim 13 wherein the mobile device operating system is an application sandbox-based operating system that executes mandatory access control on inter-process communications (IPC) and permissions.
16. The non-transitory computer readable storage medium as described in claim 13 wherein the application execution parameters are collected over a given time period.
17. The non-transitory computer readable storage medium as described in claim 16 wherein the program code is further configured to delay a response to the set of security-sensitive events until a confidence level of an attack as evidenced by the security-sensitive events exceeds a predetermined metric as evidenced by the signature.
18. The non-transitory computer readable storage medium as described in claim 17 wherein the program code is further configured to declare the APT when the confidence level is reached.