String Analysis of Android Applications (N)

Vecchio, Justin Del; Shen, Feng; Yee, Kenny; Wang, Boyu; Ko, Steven Y.; Ziarek, Lukasz

doi:10.1109/ase.2015.20

Cited by 7 publications

(3 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Input to our system is a set of Android apps to be analyzed. Finding all strings within an app statically can be viewed as a specialized form of constant propagation [52,55]. This is the starting point of our analysis and provides us with a set of statically computable string constants.…”

Section: Structural Analysis Of Stringsmentioning

confidence: 99%

“…Our string computations capture the structure of code execution used to construct strings while literals are just the static values of the string themselves that are computable during a static analysis -such as a message that is written to a log, content of a SQL query, etc. Researchers [34,52] have utilized string literals to do classification with very good results -reaching F-measures of 97%. Similarly most modern anitvirus software leverages string literals.…”

Section: Rq1: Comparison To State Of the Artmentioning

confidence: 99%

“…By identifying malware statically, these tools can offer enhanced security for end users who download and use Android apps. Many different types of analyses have proven to be useful such as data and control flow analysis [11,22,46], call graph analysis [38], sensitive API analysis [23,57], extraction of string constants [34,52], as well as analyzing strings to extract API usage and permissions [53].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Representing string computations as graphs for classifying malware

Vecchio

Ziarek

2020

Proceedings of the IEEE/ACM 7th International Conference on Mobile Software Engineering and Systems

Self Cite

View full text Add to dashboard Cite

Android applications rely heavily on strings for sensitive operations like reflection, access to system resources, URL connections, database access, among others. Thus, insight into application behavior can be gained through not only an analysis of what strings an application creates but also the structure of the computation used to create theses strings, and in what manner are these strings used. In this paper we introduce a static analysis of Android applications to discover strings, how they are created, and their usage. The output of our static analysis contains all of this information in the form of a graph which we call a string computation. We leverage the results to classify individual application behavior with respect to malicious or benign intent. Unlike previous work that has focused only on extraction of string values, our approach leverages the structure of the computation used to generate string values as features to perform classification of Android applications. That is, we use none of the static analysis computed string values, rather using only the graph structures of created strings to do classification of an arbitrary Android application as malware or benign. Our results show that leveraging string computation structures as features can yield precision and recall rates as high as 97% on modern malware. We also provide baseline results against other malware detection tools and techniques to classify the same corpus of applications. CCS CONCEPTS • Theory of computation → Program analysis; • Human centered computing → Mobile computing; • Security and privacy → Malware and its mitigation.

show abstract

Section: Structural Analysis Of Stringsmentioning

confidence: 99%

Section: Rq1: Comparison To State Of the Artmentioning

confidence: 99%