Mobile SDNs: Associating End-User Commands with Network Flows in Android Devices

Abstract

Mobile devices pose several distinct challenges from a security perspective. First, they have varied and ephemeral network connections, often using a cellular provider network as a backup option when connectivity is not available via wireless local access networks. This varied network connectivity makes it difficult to comprehensively deploy in-network solutions, such as firewalls or intrusion detection systems, since they would have to be active in every network the device would use. Second, with personally owned devices, the device owner may have security goals and privacy priorities that are distinct from organizations that provide connectivity or data assets, such as employers or schools. These complex relationships may complicate efforts to protect the devices. This paper explores a technique that runs on the mobile device endpoints to learn about the usage patterns associated with the device, in order to enforce network policy. We explore sensors that examine the mobile device's user interface, using physical inputs via finger taps, and that link them with the network activity on the device. We incorporate with allow-list policies that can be provided by organizations to make on-device access control decisions. Using IP address and DNS host name allow-lists as a baseline, we explore the accuracy of interface-aware allow-lists. We find the interface-aware allow-lists can reach over 98.5% accuracy, even when user-specified destinations are used, greatly exceeding the baseline accuracy. Our performance evaluation indicates our approach introduces a median of 3.87 ms of overall delay with low CPU usage.