Dexteroid: Detecting malicious behaviors in Android apps using reverse-engineered life cycle models

Abstract

The amount of Android malware has increased greatly during the last few years. Static analysis is widely used in detecting such malware by analyzing the code without execution. The effectiveness of current tools relies on the app model as well as the malware detection algorithm which analyzes the app model. If the model and/or the algorithm is inadequate, then sophisticated attacks that are triggered by specific sequences of events will not be detected.This paper presents a static analysis framework called Dexteroid, which uses reverseengineered life cycle models to accurately capture the behaviors of Android components. Dexteroid systematically derives event sequences from the models, and uses them to detect attacks launched by specific ordering of events. A prototype implementation of Dexteroid detects two types of attacks: (1) leakage of private information, and (2) sending SMS to premium-rate numbers. A series of experiments are conducted on 1526 Google Play apps, 1259 Genome Malware apps, and a suite of benchmark apps called DroidBench and the results are compared with a state-of-the-art static analysis tool called FlowDroid. The evaluation results show that the proposed framework is effective and efficient in terms of precision, recall, and execution time.

The Android malware detection systems between hope and reality

“…For example, in [88], a framework for detecting information leakage based on source-sink API tracking has been proposed. Also, in [89], a flow analysisbased framework has been proposed for detecting the potential malicious behaviour based on tracking the sensitive information from the source method to the sink method. • Other semantic features In some works, a semantic pattern was generated based on the app's description which crawled from the app store and the generated pattern has been compared with the actual behaviour of the app.…”

“…The digitized values have been converted into image and the constructed images have been fed to a convolutional neural network which adopted as a classifier. Also, in [89], a static analysis framework called DroidDee-pLearner has been developed to characterize Android malware. Multiple static features have been extracted and a deep learning model has been adopted to distinguish the malware and benign-ware.…”

“…Generally, the benign-ware dataset in most of the studied works such as [33,51,54,61,67,71,[85][86][87][88][89]125] was collected from the official Android app market (Google Play). In some other works, the benign dataset has been collected from the third-party markets such as in [49,94,126,127].…”

“…We found that well-known malware datasets such as Malgenome [130] have been used in the most of studied works. The well-known datasets have been used in many works such as [32,48,52,89]. Also, special datasets that collected from the internet have been used in some works such as [33].…”

GPFinder: Tracking the invisible in Android malware

“…Authors focus only on main classes and methods, and neglect other callbacks that may be called by the framework. In [13], authors use lifecyle callbacks of Android applications to build a model of the application and then detect malicious behaviors. This approach focuses only on lifecyle callbacks and does not handle other types of implicit calls.…”