Insights into rooted and non-rooted Android mobile devices with behavior analytics
Yun Cheng Shen, Nathan S. Evans, Azzedine Benameur · 2016
In the Android community, a commonly held belief is that rooted devices are more at-risk than their standard counterparts. Many applications include "protections" that disable certain functionality in the presence of a "rooted" device. In this paper, we carry out a detailed quantitative analysis on 6.14 million Android devices comparing rooted and non-rooted devices across a broad range of characteristics. Specifically our study focuses on measuring and analyzing various behavioral differences between rooted and non-rooted devices, and how such differences impact the security of rooted devices, e.g. making them more susceptible to malware or at higher risk. We further leverage our insights and implement a machine learning system to determine whether a device is rooted based on a comprehensive set of features with an accuracy of approximately 90%.