Estimating intent-based covert channel bandwidth by time series decomposition analysis in Android platform

摘要

Data leakage threats to Android mobile devices by using covert channels are indeed a potentially serious issue. In this paper, we propose a system which is capable of detecting the intent-based covert storage channels as well as estimating their respective bandwidths in Android platform. We prove the existence of intent-based covert storage channels by performing a cross-comparison between the API usage frequencies and analyzing the decomposition of the signals in the log records related to the intent broadcasting system. In order to identify the presence of intent-based covert channel attack in Android platform, we use the patterns of APIs activities to compare the relationship with the hidden covert channel signal to estimate the covert channel bandwidth. Our experiment is done on the physical machine which considers user activities. We also discuss the effectiveness of the detection and the relation to bandwidth size of intent-based covert storage channel.