Android smartphones largely dominate the smartphone market. For this reason, it is very important to examine these smartphones in terms of digital forensics since they are often used as evidence in trials. It is possi...Android smartphones largely dominate the smartphone market. For this reason, it is very important to examine these smartphones in terms of digital forensics since they are often used as evidence in trials. It is possible to acquire a physical or logical image of these devices. Acquiring physical and logical images has advantages and disadvantages compared to each other. Creating the logical image is done at the file system level. Analysis can be made on this logical image. Both logical image acquisition and analysis of the image can be done by software tools. In this study, the differences between logical image and physical image acquisition in Android smartphones, their advantages and disadvantages compared to each other, the difficulties that may be encountered in obtaining physical images, which type of image contributes to obtaining more useful and effective data, which one should be preferred for different conditions, and the benefits of having root authority are discussed. The practice of getting the logical image of the Android smartphones and making an analysis on the image is also included. Although root privileges are not required for logical image acquisition, it has been observed that very limited data will be obtained with the logical image created without root privileges. Nevertheless, logical image acquisition has advantages too against physical image acquisition.展开更多
In order to enhance the security of Android applications, we propose a repackaging and dynamic authority management scheme based on Android application reinforcement methods Instead of using root privileges and system...In order to enhance the security of Android applications, we propose a repackaging and dynamic authority management scheme based on Android application reinforcement methods Instead of using root privileges and system modification, we introduce a user-level sandbox, which utilizes the native C-level interception mechanism, to further reinforce the risk applications and improve the entire security of Android system. Additionally, by importing and improving the repackaging features, this proposed scheme reduces the potential risks of applications and achieves the goal of the dynamic monitoring of permissions. Finally, a comprehensive evaluation, including efficiency analysis and detection evaluation with 1 000 malwares, whose overall average success rate is about 96%, shows the feasibility and univer- sality of the proposed scheme.展开更多
文摘Android smartphones largely dominate the smartphone market. For this reason, it is very important to examine these smartphones in terms of digital forensics since they are often used as evidence in trials. It is possible to acquire a physical or logical image of these devices. Acquiring physical and logical images has advantages and disadvantages compared to each other. Creating the logical image is done at the file system level. Analysis can be made on this logical image. Both logical image acquisition and analysis of the image can be done by software tools. In this study, the differences between logical image and physical image acquisition in Android smartphones, their advantages and disadvantages compared to each other, the difficulties that may be encountered in obtaining physical images, which type of image contributes to obtaining more useful and effective data, which one should be preferred for different conditions, and the benefits of having root authority are discussed. The practice of getting the logical image of the Android smartphones and making an analysis on the image is also included. Although root privileges are not required for logical image acquisition, it has been observed that very limited data will be obtained with the logical image created without root privileges. Nevertheless, logical image acquisition has advantages too against physical image acquisition.
基金Supported by the National Natural Science Foundation of China(61303212,61332019,U1135004)the Hubei Provincial Natural Science Foundation of China(2014CFB192)the Fundamental Research Founds for National University,China University of Geosciences(Wuhan)(CUGL130234)
文摘In order to enhance the security of Android applications, we propose a repackaging and dynamic authority management scheme based on Android application reinforcement methods Instead of using root privileges and system modification, we introduce a user-level sandbox, which utilizes the native C-level interception mechanism, to further reinforce the risk applications and improve the entire security of Android system. Additionally, by importing and improving the repackaging features, this proposed scheme reduces the potential risks of applications and achieves the goal of the dynamic monitoring of permissions. Finally, a comprehensive evaluation, including efficiency analysis and detection evaluation with 1 000 malwares, whose overall average success rate is about 96%, shows the feasibility and univer- sality of the proposed scheme.
