Accurate Specification for Robust Detection of Malicious Behavior in Mobile Environments

Abstract

The need to accurately specify and detect malicious behavior is widely known. This paper presents a novel and convenient way of accurately specifying malicious behavior in mobile environments by taking Android as a representative platform of analysis and implementation. Our specification takes a sequence-based approach in declaratively formulating a malicious action, whereby any two consecutive securitysensitive operations are connected by either a control or taint flow. It also captures the invocation context of an operation within an app's component type and lifecycle/callback method. Additionally, exclusion of operations that are invoked from UI-related callback methods can be specified to indicate an action's stealthy execution portions. We show how the specification is sufficiently expressive to describe malicious patterns that are commonly exhibited by mobile malware. To show the usefulness of the specification, and to demonstrate that it can derive stable and distinctive patterns of existing Android malware, we develop a static analyzer that can automatically check an app for numerous securitysensitive actions written using the specification. Given a target app's uncovered behavior, the analyzer associates it with a collection of known malware families. Experiments show that our obfuscation-resistant analyzer can associate malware samples with their correct family with an accuracy of 97.2 %, while retaining the ability to differentiate benign apps from the profiled malware families with an accuracy of 97.6 %. These results positively show how the specification can lend to robust mobile malware detection.

The rise of obfuscated Android malware and impacts on detection methods

“…Table 8 represents static, dynamic, and hybrid-based Android malware detection frameworks and their robustness against metamorphism evasion detection techniques. (a) Code Obfuscation Detection: Code obfuscation consists of CRE, CIN, and DCI; we explain each evasion detection framework in the following list: – CRE - Code Reordering Evasion Detection: ResDroid ( Shao et al, 2014 ), AnDarwin ( Crussell, Gibler & Chen, 2015 ), and Seqmalspec ( Sufatrio et al, 2015a ) proposed static analysis based detection and managed to detect CRE evasion. Likewise, Q-floid ( Castellanos et al, 2016 ) detected CRE using the dynamic sandboxing methodology.…”

“…ResDroid ( Shao et al, 2014 ), AnDarwin ( Crussell, Gibler & Chen, 2015 ), and Seqmalspec ( Sufatrio et al, 2015a ) proposed static analysis based detection and managed to detect CRE evasion. Likewise, Q-floid ( Castellanos et al, 2016 ) detected CRE using the dynamic sandboxing methodology.…”

“…They failed to mention evasion detection methods and evaluate the currently proposed methods. Sufatrio et al (2015a) surveyed Android malware detection methods and briefly assessed a handful of related works in terms of evasion detection.…”