Trustworthy Anomaly Detection for Smartphones

Due to the increasing level of utilization, smartphones are commonly used in enterprise environments nowadays. This introduces new threats to such environments like mo-bile malware with different behavior (mostly exfiltration of user information or abuse of premium services [1]). However, there is currently no established way for an enterprise to as-sess the security state of connected smartphones in order to prevent or at least limit the potential amount of damage that compromised devices can cause. To circumvent this problem, we propose a novel network-based, distributed anomaly detection system for smartphones. Our system is based upon the distributed collection of arbi-trary, static and dynamic smartphone features. The seman-tic of a feature can vary greatly (e.g. battery level, permis-sions of installed applications). The term distributed refer