Detecting energy-greedy anomalies and mobile malware variants

Mobile users of computation and communication services have been rapidly adopting battery-powered mobile hand-helds, such as PocketPCs and SmartPhones, for their work. However, the limited battery-lifetime of these devices re-stricts their portability and applicability, and this weak-ness can be exacerbated by mobile malware targeting de-pletion of battery energy. Such malware are usually diffi-cult to detect and prevent, and frequent outbreaks of new malware variants also reduce the effectiveness of commonly-seen signature-based detection. To alleviate these prob-lems, we propose a power-aware malware-detection frame-work that monitors, detects, and analyzes previously un-known energy-depletion threats. The framework is com-posed of (1) a power monitor which collects power sam-ples and builds a power consumption history from the col-lected samples, and (2) a data analyzer which generates a power signature from the constructed history. To gener-ate a power signature, simple and effective noise-filtering and data-compression are applied, thus reducing the detec-tion overhead. Similarities between power signatures are measured by the χ2-distance, reducing both false-positive and false-negative detection rates. According to our exper-imental results on an HP iPAQ running a Windows Mobile OS, the proposed framework achieves significant (up to 95%) storage-savings without losing the detection accuracy, and a 99 % true-positive rate in classifying mobile malware