Representing string computations as graphs for classifying malware

Abstract

Android applications rely heavily on strings for sensitive operations like reflection, access to system resources, URL connections, database access, among others. Thus, insight into application behavior can be gained through not only an analysis of what strings an application creates but also the structure of the computation used to create theses strings, and in what manner are these strings used. In this paper we introduce a static analysis of Android applications to discover strings, how they are created, and their usage. The output of our static analysis contains all of this information in the form of a graph which we call a string computation. We leverage the results to classify individual application behavior with respect to malicious or benign intent. Unlike previous work that has focused only on extraction of string values, our approach leverages the structure of the computation used to generate string values as features to perform classification of Android applications. That is, we use none of the static analysis computed string values, rather using only the graph structures of created strings to do classification of an arbitrary Android application as malware or benign. Our results show that leveraging string computation structures as features can yield precision and recall rates as high as 97% on modern malware. We also provide baseline results against other malware detection tools and techniques to classify the same corpus of applications. CCS CONCEPTS • Theory of computation → Program analysis; • Human centered computing → Mobile computing; • Security and privacy → Malware and its mitigation.

Developing a Zen Click Fraud Detection Framework Using Smart Contracts

“…For example, there are four different strategies for classifying malware using machine learning approaches [5,6]. The techniques include using static or dynamic analysis, using both static and dynamic analysis, using string analysis, or using classification techniques.…”

“…Several papers discuss the role of machine learning to discover and classify malware in Android applications [5,6,16,17]. Fung et al created a tool called RevMatch.…”

“…Vecchio et al developed a machine learning solution for classifying malware using graph structures of the strings that were created [5]. Their system uses a three-step process for detecting malware.…”

“…Data flow analysis for tracking malware is another common technique employed in the wild west of malware detection. Fuchs et al created an analysis tool that facilitates automatic reasoning about the security of Android applications [5]. The approach performs incremental checking of the application and extracts the Android applications' manifest file, checks the security specifications, and ensures compliance based on the data flows.…”