SMS Botnet Detection for Android Devices through Intent Capture and Modeling

Mobile devices are subject to an increased attack surface vector as compared to desktop computing, due to the nature of sensors, radios, and increased peripherals. We investigate in this work mobile botnets with a specific focus on Android, which is the most widely adopted mobile platform, and a prime target for malicious software, 79% of reported malware threats to mobile operating systems are targeted at Android. Our analysis focuses on a short messaging service (SMS) botnet structure and investigates a new detection model using the concept of intents. We show that transparent control can be achieved by a remote endpoint, yet also detected by our proposed intent detection model. Intents are late run-time bindings mechanisms provided to applications in the Android operating system. Intents provide a clear and accurate picture of device behaviour with external sources, due to their design as a late run time binding mechanism in the Android Operating System. We propose an intent logging system to capture sample data, and use this as the basis to design and evaluate our proposed detection scheme.