More Like this

1. Object Allocation Pattern as an Indicator for Maliciousness - An Exploratory Analysis

   https://doi.org/10.1145/3422337.3450322  

   Hussaini, Adamu; Zahran, Bassam; Ali-Gombe, Aisha (April 2021, ACM CODASPY 2021)

   null (Ed.)

   Traditionally, Android malware is analyzed using static or dynamic analysis. Although static techniques are often fast; however, they cannot be applied to classify obfuscated samples or malware with a dynamic payload. In comparison, the dynamic approach can examine obfuscated variants but often incurs significant runtime overhead when collecting every important malware behavioral data. This paper conducts an exploratory analysis of memory forensics as an alternative technique for extracting feature vectors for an Android malware classifier. We utilized the reconstructed per-process object allocation network to identify distinguishable patterns in malware and benign application. Our evaluation results indicate the network structural features in the malware category are unique compared to the benign dataset, and thus features extracted from the remnant of in-memory allocated objects can be utilized for robust Android malware classification algorithm. 

   more » « less
2. Automated Dynamic Detection of Self-Hiding Behavior

   https://doi.org/10.1109/MASSW.2019.00024  

   Baird, Luke; Shan, Zhiyong; Namboodiri, Vinod (November 2019, IEEE MASS)

   null (Ed.)

   Certain Android applications, such as but not limited to malware, conceal their presence from the user, exhibiting a self-hiding behavior. Consequently, these apps put the user's security and privacy at risk by performing tasks without the user's awareness. Static analysis has been used to analyze apps for self-hiding behavior, but this approach is prone to false positives and suffers from code obfuscation. This research proposes a set of three tools utilizing a dynamic analysis method of detecting self-hiding behavior of an app in the home, installed, and running application lists on an Android emulator. Our approach proves both highly accurate and efficient, providing tools usable by the Android marketplace for enhanced security screening. 

   more » « less
3. An Evaluation of One-Class Feature Selection and Classification for Zero-Day Android Malware Detection

   https://doi.org/10.1007/978-3-030-43020-7_15  

   Wang, Y; Zheng, J (May 2020, New generation)

   Security has become a serious problem for Android system as the number of Android malware increases rapidly. A great amount of effort has been devoted to protect Android devices against the threats of malware. Majority of the existing work use two-class classification methods which suffer the overfitting problem due to the lack of malicious samples. This will result in poor performance of detecting zero-day malware attacks. In this paper, we evaluated the performance of various one-class feature selection and classification methods for zero-day Android malware detection. Unlike two-class methods, one-class methods only use benign samples to build the detection model which overcomes the overfitting problem. Our results demonstrate the capability of the one-class methods over the two-class methods in detecting zero-day Android malware attacks. 

   more » « less
4. When Malware is Packin' Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features

   https://doi.org/10.14722/ndss.2020.24310  

   Aghakhani, Hojjat; Gritti, Fabio; Mecca, Francesco; Lindorfer, Martina; Ortolani, Stefano; Balzarotti, Davide; Vigna, Giovanni; Kruegel, Christopher (January 2020, Network and Distributed Systems Security (NDSS) Symposium 2020)

   Machine learning techniques are widely used in addition to signatures and heuristics to increase the detection rate of anti-malware software, as they automate the creation of detection models, making it possible to handle an ever-increasing number of new malware samples. In order to foil the analysis of anti-malware systems and evade detection, malware uses packing and other forms of obfuscation. However, few realize that benign applications use packing and obfuscation as well, to protect intellectual property and prevent license abuse. In this paper, we study how machine learning based on static analysis features operates on packed samples. Malware researchers have often assumed that packing would prevent machine learning techniques from building effective classifiers. However, both industry and academia have published results that show that machine-learning-based classifiers can achieve good detection rates, leading many experts to think that classifiers are simply detecting the fact that a sample is packed, as packing is more prevalent in malicious samples. We show that, different from what is commonly assumed, packers do preserve some information when packing programs that is “useful” for malware classification. However, this information does not necessarily capture the sample’s behavior. We demonstrate that the signals extracted from packed executables are not rich enough for machine-learning-based models to (1) generalize their knowledge to operate on unseen packers, and (2) be robust against adversarial examples. We also show that a na¨ıve application of machine learning techniques results in a substantial number of false positives, which, in turn, might have resulted 

   more » « less
5. GPU-Based Static Data-Flow Analysis for Fast and Scalable Android App Vetting

   https://doi.org/10.1109/IPDPS47924.2020.00037  

   Yu, Xiaodong; Wei, Fengguo; Ou, Xinming; Becchi, Michela; Bicer, Tekin; Yao, Danfeng Daphne (May 2020, 2020 IEEE International Parallel and Distributed Processing Symposium (IPDPS))

   Many popular vetting tools for Android applications use static code analysis techniques. In particular, Inter-procedural Data-Flow Graph (IDFG) construction is the computation at the core of Android static data-flow analysis and consumes most of the analysis time. Many analysis tools use a worklist algorithm, an iterative fixed-point approach, to construct the IDFG. In this paper, we observe that a straightforward GPU parallelization of the worklist algorithm leads to significant underutilization of the GPU resources. We identify four performance bottlenecks, namely, frequent dynamic memory allocations, high branch divergence, workload imbalance, and irregular memory access patterns. Accordingly, we propose GDroid, a GPU-based worklist algorithm implementation with multiple fine-grained optimizations tailored to common characteristics of Android applications. The optimizations considered are: matrix-based data structure, memory access-based node grouping, and worklist merging. Our experimental evaluation, performed on 1000 Android applications, shows that the proposed optimizations are beneficial to performance, and GDroid can achieve up to 128X speedups against a plain GPU implementation. 

   more » « less