Simple and effective method for detecting abnormal internet behaviors of mobile devices

Smartphones are becoming the primary mobile communications device. Because of the rich data stored in smartphones, data theft and Trojan threaten mobile security and account for most attacks. Most antivirus systems function using a signature-based approach. However, this study proposes an effective solution for detecting abnormal behaviors of mobile malware according to its communication characteristics on the Internet. Malware usually establishes external connections to transmit compromised data to a specified host; the proposed method detects abnormal behaviors by monitoring outward communicating packets. The method involves a three-step check action: identify the HTTP POST/GET packets, check for the transmission of sensitive data, and verify the rationality of the remote server. Behavior characteristics of malware and normal software were experimentally compared for verifying the efficacy of the method; a collection of malicious, legitimate, and common application programs were used in the experiment. The results revealed that the proposed method effectively identifies abnormal Internet behavior without constructing a complex detection environment. It detects anomalies in all mobile operating platforms. In addition, the method can be easily implemented by users and enterprises for enhancing information security in mobile communications.