Mobile Phone Anomalous Behaviour Detection for Real-time Information Theft Tracking

Abstract—Due to the prevalence of mobile phones usage and their increasing features and functionalities, the amount of personal and confidential data residing in the phones is becoming substantial. In the event of information theft by applications residing on the phones, the loss of such important data can be damaging to the user’s reputation or result in a financial loss. We show in this paper how these applications can appear to be non-malicious but are stealthily retrieving and exporting confidential information without leaving any trace, thus bypassing detections by current state-of-the-art anti-virus solutions. We propose a tool to detect and track the behaviour of these applications in real-time so as to collect evidence. Using this tool, we can successfully monitor the applications non-intrusively, detect the “misbehaving ” applications, alert the users, and log the evidence of malicious activities with timestamp information to facilitate forensic investigations and institute accountability