DBank: Predictive Behavioral Analysis of Recent Android Banking Trojans

Abstract

Using a novel dataset of Android banking trojans (ABTs), other Android malware, and goodware, we develop the DBank system to predict whether a given Android APK is a banking trojan or not. We introduce the novel concept of a Triadic Suspicion Graph (TSG for short) which contains three kinds of nodes: goodware, banking trojans, and API packages. We develop a novel feature space based on two classes of scores derived from TSGs: suspicion scores (SUS) and suspicion ranks (SR)-the latter yields a family of features that generalize PageRank. While TSG features (based on SUS/SR scores) provide very high predictive accuracy on their own in predicting recent (2016-2017) ABTs, we show that the combination of TSG features with previously studied lightweight static and dynamic features in the literature yields the highest accuracy in distinguishing ABTs from goodware, while preserving the same accuracy of prior feature combinations in distinguishing ABTs from other Android malware. In particular, DBank's overall accuracy in predicting whether an APK is a banking trojan or not is up to 99.9% AUC with 0.3% false positive rate. Moreover, we have already reported two unlabeled APKs from VirusTotal (which DBank has detected as ABTs) to the Google Android Security Team-in one case, we discovered it before any of the 63 anti-virus products on VirusTotal did, and in the other case, we beat 62 of 63 anti-viruses on VirusTotal. This suggests that DBank is capable of making new discoveries in the wild before other established vendors. We also show that our novel TSG features have some interesting defensive properties as they are robust to knowledge of the training set by an adversary: even if the adversary uses 90% of our training set and uses the exact TSG features that we use, it is difficult for him to infer DBank's predictions on APKs. We additionally identify the features that best separate and characterize ABTs from goodware as well as from other Android malware. Finally, we develop a detailed data-driven analysis of five major recent ABT families: FakeToken, Svpeng, Asacub, BankBot, and Marcher, and identify the features that best separate them from goodware and other malware.

Analysis of Anubis Trojan Attack on Android Banking Application Using Mobile Security Labware

“…Also, a detailed data-driven analysis of five prominent His ABT families was recently developed. We investigated FakeToken, Svpeng, Asacub, BankBot, and Marcher and identified the features that most differentiate them from other goodware and malware [21].…”

A Review on Android Malware: Attacks, Countermeasures and Challenges Ahead

“…The main aim of adversarial example crafting in malware detection [7,48,164,168] is to misguide the malware detection system so as to change the detection for a given application as per the desire of the attacker. Therefore, the development of secure and robust ML models is necessary to protect against the adversarial attacks.…”

“…Defense methodologies [7,46,48,49,190,191] can be roughly summarized as but not limited to the following:…”

“…Images are continuous space where perturbations can be crafted anywhere in the image to cause misclassification. In the malware space, the attacker faces few constraints when crafting the adversarial samples [7,48,164,168].…”

“…The inverse relationship between malware and anti-malware has lead to the coevolution of malware authors and malware defenders for decades. The task of malware detection is a well-fought arms race between malware authors who continuously update themselves to deceive anti-malware engines and malware defenders who try to update and bring in better security mechanism to handle the various malware attacks [1][2][3][4][5][6][7]. Even as technology for countermeasures improves continuously, malware author designs malware with the objective of bypassing the anti-malware engines by formulating novel methods to evade detection and fulfill their malicious intent.…”