Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

Abstract

Abstract-Smartphones and mobile devices are rapidly becoming indispensable devices for many users. Unfortunately, they also become fertile grounds for hackers to deploy malware. There is an urgent need to have a "security analytic & forensic system" which can facilitate analysts to examine, dissect, associate and correlate large number of mobile applications. An effective analytic system needs to address the following questions: In this paper, we present the design and implementation of DroidAnalytics, a signature based analytic system to automatically collect, manage, analyze and extract android malware. The system facilitates analysts to retrieve, associate and reveal malicious logics at the "opcode level". We demonstrate the efficacy of DroidAnalytics using 150,368 Android applications, and successfully determine 2,494 Android malware from 102 different families, with 342 of them being zero-day malware samples from six different families. To the best of our knowledge, this is the first reported case in showing such a large Android malware analysis/detection. The evaluation shows the DroidAnalytics is a valuable tool and is effective in analyzing malware repackaging and mutations.

Addressing Security Issues in Latest Android Versions and Applications

“…But nowadays applications are being built on other languages too. [4] Eclipse IDE was the Application Software that was used to build android applications until Android Studio became the officially supported software application by Google Inc. to develop android applications. However there are many other online and offline tools to develop android application.…”

InstDroid: A Light Weight Instant Malware Detector for Android Operating Systems

“…Different permissions have different purposes associated with them but they are used in order to limit the access of the application to the critical resources of device such as camera, SMS storage and Bluetooth permissions, etc. After careful inspection of these permissions, it is up to the user whether he wants to install the application or not [12]. There are four major categories of permissions: Normal, Dangerous, Signature and SignatureOrSystem [22].…”

“…The ICC very smoothly takes care of transferring the request from user to the destination applications. After that applications can access the components or services of other applications as a service [12]. This ICC process is used by malware applications too in order to control the other applications and perform malicious activities on the device.…”

Android Malware Detection & Protection: A Survey

“…DroidAnalytics [27] is a signature based analytic system which extract and analyze the apps at op-code level. It not only generates the signature but also associate the malware with existing malwares after identifying the malicious content.…”