AVclass: A Tool for Massive Malware Labeling

Sebastián, Marcos; Rivera, Richard; Kotzias, Platon; Caballero, Juan

doi:10.1007/978-3-319-45719-2_11

Cited by 298 publications

(232 citation statements)

References 20 publications

Supporting

Mentioning

225

Contrasting

Unclassified

Order By: Relevance

“…However, we have made our best effort to leverage the AndroZoo largest available research dataset of Android apps [2] to search for piggybacked apps. Our apps span a long timeline of 6 years, and we have checked that the piggybacked apps are classified by AVClass [36] as presenting 29 different labels (representing potential malware families). Another threat to validity is that we did not include apps from the last year or so, due to delays in the collection of AV reports by the AndroZoo infrastructure.…”

Section: Threats To Validitymentioning

confidence: 43%

Understanding Android App Piggybacking: A Systematic Study of Malicious Code Grafting

Bissyandé

et al. 2017

IEEE Trans.Inform.Forensic Secur.

143

119

View full text Add to dashboard Cite

Abstract-The Android packaging model offers ample opportunities for malware writers to piggyback malicious code in popular apps, which can then be easily spread to a large user base. Although recent research has produced approaches and tools to identify piggybacked apps, the literature lacks a comprehensive investigation into such phenomenon. We fill this gap by 1) systematically building a large set of piggybacked and benign apps pairs, which we release to the community, 2) empirically studying the characteristics of malicious piggybacked apps in comparison with their benign counterparts, and 3) providing insights on piggybacking processes. Among several findings providing insights analysis techniques should build upon to improve the overall detection and classification accuracy of piggybacked apps, we show that piggybacking operations not only concern app code, but also extensively manipulates app resource files, largely contradicting common beliefs. We also find that piggybacking is done with little sophistication, in many cases automatically, and often via library code.

show abstract

Section: Threats To Validitymentioning

confidence: 43%

Understanding Android App Piggybacking: A Systematic Study of Malicious Code Grafting

Bissyandé

et al. 2017

IEEE Trans.Inform.Forensic Secur.

143

119

View full text Add to dashboard Cite

show abstract

“…Our dataset is not limited by the anti-virtualization techniques. Samples labeling is achieved through the Avclass tool [24]. Detailed information about the collection can be found in appendix, table 3.…”

Section: Methodssupporting

confidence: 49%

Data Aware Defense (DaD): Towards a Generic and Practical Ransomware Countermeasure

Palisse

Durand²,

Bouder

et al. 2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We present the Malware -O -Matic analysis platform and the Data Aware Defense ransomware countermeasure based on real time data gathering with as little impact as possible on system performance. Our solution monitors (and blocks if necessary) file system activity of all userland threads with new indicators of compromise. We successfully detect 99.37% of our 798 active ransomware samples with at most 70 MB lost per sample's thread in 90% of cases, or less than 7 MB in 70% of cases. By a careful analysis of the few false negatives we show that some ransomware authors are specifically trying to hide ongoing encryption. We used free (as in free beer) de facto industry standard benchmarks to evaluate the impact of our solution and enable fair comparisons. In all but the most demanding tests the impact is marginal.

show abstract

“…For this purpose, we employed AVclass [21], an automatic malware labeling tool which performs plurality vote on the labels assigned by AV engines.…”

Section: Methodsmentioning

confidence: 44%

No Random, No Ransom: A Key to Stop Cryptographic Ransomware

Genç

Lenzini

Ryan

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. To be effective, ransomware has to implement strong encryption, and strong encryption in turn requires a good source of random numbers. Without access to true randomness, ransomware relies on the pseudo random number generators that modern Operating Systems make available to applications. With this insight, we propose a strategy to mitigate ransomware attacks that considers pseudo random number generator functions as critical resources, controls accesses on their APIs and stops unauthorized applications that call them. Our strategy, tested against 524 active real-world ransomware samples, stops 94% of them, including WannaCry, Locky, CryptoLocker and CryptoWall. Remarkably, it also nullifies NotPetya, the latest offspring of the family which so far has eluded all defenses.

show abstract

AVclass: A Tool for Massive Malware Labeling

Cited by 298 publications

References 20 publications

Understanding Android App Piggybacking: A Systematic Study of Malicious Code Grafting

Understanding Android App Piggybacking: A Systematic Study of Malicious Code Grafting

Data Aware Defense (DaD): Towards a Generic and Practical Ransomware Countermeasure

No Random, No Ransom: A Key to Stop Cryptographic Ransomware

Contact Info

Product

Resources

About