Android malware analysis in a nutshell

The threat of malware in the Internet of Things (IoT) is ever-present given that many IoT systems today rely on the Android operating system. There has been a consistent rise in Android Malware in recent years and many new variants continue to adopt sophisticated detection avoidance techniques, including various forms of obfuscation. Hence, there is a need to improve the effectiveness of Android malware detection as obfuscation becomes more prevalent in the wild. In this paper we present a novel approach for obfuscated malware detection in IoT Android applications based on the visualization of app executable files with Markov images. The app images are trained using CNN to detect obfuscated malware and for the identification of the obfuscation type. We evaluate the performance of the proposed system by experimenting with four different classification models using 12,000 Android applications. The CNN model created to distinguish between malware and benign apps obtained an accuracy of 99.41%. The model for identifying obfuscated malware from benign applications obtained 99.65% accuracy, while the model created to identify obfuscated malware from nonobfuscated malware yielded an accuracy of 99.81%. The model for classifying obfuscated malware into 14 different obfuscation categories obtained an accuracy of 99.67%. The results of these experiments show that CNN models trained from Markov images generated using application byte code can be highly effective for obfuscated malware detection and classification. Moreover, our proposed system provides a more sustainable, accurate and cost effective method for obfuscated malware detection compared to the manual feature engineering-based approaches that are more prevalent in the current literature.

show abstract

ModDiff: Modularity Similarity-Based Malware Homologation Detection

Sun¹,

Shu²,

Kang³

et al. 2023

Electronics

View full text Add to dashboard Cite

In recent years, the number and scale of malicious codes have grown exponentially, posing an increasing threat to cybersecurity. Hence, it is of great research value to quickly identify variants of malware and master their family information. Binary code similarity detection, as a key technique in reverse analysis, plays an indispensable role in malware analysis. However, most existing methods focus on similarity at the function or basic block level, ignoring the modular composition of malware. Implementing similarity detection among malware modules would greatly improve the efficiency and accuracy of homology detection. Inspired by the successful application of deep-learning techniques in program analysis, we propose a binary code module similarity detection method called ModDiff. It abstracts malware into attribute graphs, clusters functions using graph-embedded clustering algorithms to decompose malware into function-based modules, and calculates module similarity using graph-matching algorithms and natural language processing-based function similarity detection algorithms. The experimental results indicated that ModDiff improves the accuracy of module partitioning by 10.8% compared with previous work, and the highest F1 score of 89% is achieved in malware homologation detection. These results demonstrate the effectiveness of ModDiff in detecting and analyzing malware with important application value and development prospects.

show abstract

Android malware analysis in a nutshell

Cited by 4 publications

References 39 publications

ASParseV3: Auto-Static Parser and Customizable Visualizer

ASParseV3: Auto-Static Parser and Customizable Visualizer

Obfuscated Malware Detection in IoT Android Applications Using Markov Images and CNN

ModDiff: Modularity Similarity-Based Malware Homologation Detection

Contact Info

Product

Resources

About