Using ontologies to perform threat analysis and develop defensive strategies for mobile security

Ping Wang (), Kuo-Ming Chao (), Chi-Chun Lo () and Yu-Shih Wang ()
Additional contact information
Ping Wang: Kun Shan University
Kuo-Ming Chao: Coventry University
Chi-Chun Lo: National Chiao Tung University
Yu-Shih Wang: Kun Shan University

Information Technology and Management, 2017, vol. 18, issue 1, No 1, 25 pages

Abstract: Abstract Existing studies on the detection of mobile malware have focused mainly on static analyses performed to examine the code-structure signature of viruses, rather than the dynamic behavioral aspects. By contrast, the unidentified behavior of new mobile viruses using the self-modification, polymorphic, and mutation techniques for variants have largely been ignored. The problem of precision regarding malware variant detection has become one of the key concerns in mobile security. Accordingly, the present study proposed a threat risk analysis model for mobile viruses, using a heuristic approach incorporating both malware behavior analysis and code analysis to generate a virus behavior ontology associated with the Protégé platform. The proposed model can not only explicitly identify an attack profile in accordance with structural signature of mobile viruses, but also overcome the uncertainty regarding the probability of an attack being successful. This model is able to achieve this by extending frequent episode rules to investigate the attack profile of a given malware, using specific event sequences associated with the sandbox technique for mobile applications (apps) and hosts. For probabilistic analysis, defense evaluation metrics for each node were used to simulate the results of an attack. The simulations focused specifically on the attack profile of a botnet to assess the threat risk. The validity of the proposed approach was demonstrated numerically by using two malware cyber-attack examples. Overall, the results presented in this paper prove that the proposed scheme offers an effective countermeasure, evaluated using a set of security metrics, for mitigating network threats by considering the interaction between the attack profiles and defense needs.

Keywords: Threat risk analysis; Mobile virus; Ontology; Behavior analysis; Code analysis (search for similar items in EconPapers)
Date: 2017
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
http://link.springer.com/10.1007/s10799-014-0213-1 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:infotm:v:18:y:2017:i:1:d:10.1007_s10799-014-0213-1

Ordering information: This journal article can be ordered from
http://www.springer.com/journal/10799

DOI: 10.1007/s10799-014-0213-1

Access Statistics for this article

Information Technology and Management is currently edited by Raymond Patterson and Erik Rolland

More articles in Information Technology and Management from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().