An exploratory study on the evolution of Android malware quality

Abstract

In the context of software engineering, product software quality measures how well a software artifact is designed and coded. Software products must satisfy nonfunctional properties (eg, reliability, usability, understandability, and maintainability), in order to make maintenance and evolution sustainable in the long period. Software evolution is an issue of interest for the malware writers, too, for 2 reasons. First, to evade detection with the minimum effort, malware writers use to produce “variants,” which are obtained by applying little changes to existing malware. Morevoer, recent studies demonstrated that malware is increasingly improving evasion strategies and infection mechanisms and is using more and more complex payloads. This suggests that malware writers are devoting relevant efforts and skills for producing high‐quality software. For this reason, we wonder whether malware writers are devoting effort to improve the structural quality of their code, too, as it happens in the development of goodware. To investigate this question, we (1) characterize a dataset containing about 20 000 Android applications, divided into goodware and malware ones, relying on the Android API version they require, and (2) compute software quality metrics, divided into 4 categories (ie, dimensional, complexity, object‐oriented, and Android‐oriented metrics) for apps belonging to each population. We then identify evolution trends of these metrics in malware and goodware. The results of our study demonstrate that goodware and malicious applications exhibit similar evolution trends for some of the quality indicators, suggesting that malware writers care about the overall quality of their code. Code quality could be considered an indirect measure of how many and how fast variants of existing malware will be released in the wild.

Investigating the criticality of user‐reported issues through their relations with app rating

“…Most of these indicators have been previously investigated in recent work 5 . However, as already reported, we also investigate Android‐oriented metrics, since they model factors which might have a direct influence on the user experience of Android applications 38‐42 . In the following, we describe the meaning and the rationale of each metric.…”

“…5 However, as already reported, we also investigate Android-orientedmetrics, since they model factors which might have a direct influence on the user experience of Android applications. [38][39][40][41][42] In the following, we describe the meaning and the rationale of each metric. In our replication package, we further include a description of the collection process.…”

Word Embedding Techniques for Malware Evolution Detection

“…The authors of [9] extract a variety of features from Android malware samples and determine trends based on standard software quality metrics. These results are compared to a similar analysis of trends in Android non-malware, or goodware.…”

Software vulnerabilities overview: A descriptive study

“…As presented in Section 5, DoS attacks in 2017 are not as frequent as in 2015 and 2016. This suggests that we could be witnessing a change of trend, which could be caused by a greater ability or interest of the cybercriminals to attack other software weaknesses that were less common in the past [28] . In this sense, the study of the evolution over time of vulnerabilities in software products is another interesting line of work for researchers in this field.…”