A Survey of Security and Privacy Protection in Mobile Devices

Intrusion Detection and Prevention

Several methods have been proposed to protect mobile devices that have been used on traditional computing platforms. A common system to implement is an Intrusion Detection System (IDS). Two common methods to detect intrusions are signature based and anomaly based. A signature based IDS checks for a sequence of bytes within executable code that has been identified as malware from a signature provider. An anomaly based IDS checks for events and activity on the system to see if there is an anomaly from how a system is expected to operate. An IDS does not prevent intrusions but an Intrusion Prevention System (IPS) can. Preventing an intrusion from occurring is a challenge because a decision needs to be made real time if the operation to occur is valid or if it is part of an intrusion. This decision however should not affect the system from operating normally as the verification of the operation is typically blocking, meaning that future operations will not continue until verification is completed. This verification process prevents both a valid or intrusion based operation from occurring until the current operation being analyzed is verified to not be a threat. If this verification process is not completed fast enough, it may affect user experience or the system from operating to expected levels. This makes intrusion prevention systems less ideal for mobile systems as they are limited in computing power and need to make a decision immediately to prevent a poor user experience which has contributed to their fast adoption.