TCADS: Trustworthy, Context-Related Anomaly Detection for Smartphones

In this paper we propose a novel, network-based, distributed anomaly detection framework for smart phones. Our approach is based upon the distributed collection of arbitrary, static and dynamic smart phone features. Our approach is not limited to features that can be obtained directly on a device, but also includes features that are provided by other services running in the respective, corporate IT infrastructure (e.g. an IDS). Furthermore, we tag each collected feature with two kinds of information: (1) context-information and (2) trust-information. This way, anomaly detection methods are not limited to work on the actual feature values, but can also consider the context and the trustworthiness of collected features.