Abstract
With the rise in recent months of malware applications for Android Operative System (OS), it has become necessary to study new methods to prevent malicious applications from attacking devices, exploiting system vulnerabilities, exposing private information and other types of security risks. Taking this into consideration, this thesis introduces a scheme to detect malware in Android applications within the Kernel Layer of the OS, by analyzing in real-time the kernel logs that are being generated within the device and applying a malware detection algorithm to determine whether an application’s behavior should be treated as malicious or not. If an application is found performing malicious behavior in the device, the user will be alerted and guided to take actions (stop, uninstall, resume) against the possible threat. To accomplish this, a system in the Kernel and an Application (User Interface) were created for Android, thus providing additional security to the device without significantly affecting the battery life or performance of the device. Experiments were performed by using a sample of 385 applications downloaded from Google Play to test the proposed scheme. After analyzing the applications 96 of them were found with potential malicious behavior and 73 applications were catalogued as malicious after carefully manually inspecting the logs of the applications. These applications were found performing malicious behavior while running in the device, by leaking some type of sensitive information such as device identifications, user accounts data, or other type of personal information.