PaperlayerView exact revision on arXiv

Source-linked AI summary

DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

Min Zheng, Mingshen Sun, John C. S. Lui

arXiv:1302.7212v4cs.CR

TL;DR

Android malware analysis requires scalable collection and ways to compare suspicious applications with existing malware despite repackaging and obfuscation. DroidAnalytics addresses this with automated collection and opcode-level, multi-level signatures; on 150,368 applications, it identified 2,494 malware samples from 102 families, including 342 zero-day samples from six families.

  • Problem

    Android malware variants are difficult to collect, identify after repackaging or obfuscation, and associate using mutable hashes or package names.

  • Method

    DroidAnalytics automatically collects and analyzes applications, generates application/class/method signatures from opcode-level semantic features, retrieves malicious code, and associates samples by similarity.

  • Results

    150,368 Android applications produced 2,494 malware samples from 102 families, including 342 zero-day repackaged malware samples from six families.

  • Takeaways & Limitations

    DroidAnalytics supports opcode-level retrieval, association, and analysis of malware repackaging, mutations, and malicious logic.

Abstract

from arXiv · show

Smartphones and mobile devices are rapidly becoming indispensable devices for many users. Unfortunately, they also become fertile grounds for hackers to deploy malware and to spread virus. There is an urgent need to have a "security analytic & forensic system" which can facilitate analysts to examine, dissect, associate and correlate large number of mobile applications. An effective analytic system needs to address the following questions: How to automatically collect and manage a high volume of mobile malware? How to analyze a zero-day suspicious application, and compare or associate it with existing malware families in the database? How to perform information retrieval so to reveal similar malicious logic with existing malware, and to quickly identify the new malicious code segment? In this paper, we present the design and implementation of DroidAnalytics, a signature based analytic system to automatically collect, manage, analyze and extract android malware. The system facilitates analysts to retrieve, associate and reveal malicious logics at the "opcode level". We demonstrate the efficacy of DroidAnalytics using 150,368 Android applications, and successfully determine 2,494 Android malware from 102 different families, with 342 of them being zero-day malware samples from six different families. To the best of our knowledge, this is the first reported case in showing such a large Android malware analysis/detection. The evaluation shows the DroidAnalytics is a valuable tool and is effective in analyzing malware repackaging and mutations.

I. Introduction

DroidAnalytics addresses the difficulty of collecting large malware datasets, identifying repackaged or obfuscated applications, and associating malware beyond mutable hashes or package names. Its multi-level opcode-based signatures support malware analysis, mutation tracking, and zero-day repackaged-malware detection.

  • 150,368 Android applications yielded 2,494 malware samples from 102 families, including 342 zero-day samples from six families.
  • DroidAnalytics automates malware collection, analysis, and management to address limited access to samples scattered across third-party markets.
  • The system uses multi-level signatures based on opcode-level semantic features, making them more robust than cryptographic hashes against repackaging and code obfuscation.
  • DroidAnalytics associates malware at application, class, and method levels, revealing malicious behavior and supporting analysis of mutations and derivatives.
  • 342 zero-day repackaged malware samples were detected across six malware families.

II. Design & Implementation of DroidAnalytics

DroidAnalytics integrates automatic malware collection, signature generation, information retrieval, association, and similarity comparison into one analytic system. Its architecture is designed to support detection of zero-day repackaged malware.

  • DroidAnalytics combines automatic malware collection, signature generation, information retrieval, malware association, and similarity comparison.
  • The system architecture supports using these functions to detect zero-day repackaged malware.

A. Building Blocks of DroidAnalytics

The system builds signatures from disassembled Android applications, API-call sequences, and dynamic payloads across method, class, and application levels. Supporting components collect applications, detect downloaded payloads, parse APK information, and measure processing costs.

  • 150,368 mobile applications were collected through an extensible crawler for security analysis and association.
  • The dynamic payload detector identifies suspicious files by magic numbers, executes applications in an emulator, and forwards downloaded payloads for signature generation.
  • 47,126 Android SDK 4.1 full-path methods were assigned hexadecimal identifiers in the API calls table.
  • DroidAnalytics disassembles APK files, extracts API-call ID sequences from methods, and hashes those sequences into Lev3 method signatures.
  • Dynamic .dex or .jar payloads become classes with Lev2 signatures, while .elf or .so payloads use cryptographic hashes as Lev2 signatures.
  • Lev2 signatures aggregate sorted Lev3 method signatures into class signatures, and sorted Lev2 signatures aggregate into the Lev1 application signature.
  • Scanning one application takes about 60 seconds on average, while generating all three signature levels takes about three seconds.

III. Utility & Effectiveness of Signature Based System

DroidAnalytics uses opcode-level, multi-level signatures to analyze malware repackaging, mutations, and obfuscation beyond conventional cryptographic hashes. Experiments show that variants with changed hashes can retain identical Level 1 signatures.

  • Analyzing Malware Repackaging: DroidAnalytics generates the same Level 1 signature for repackaged APKs when their DEX opcodes remain unchanged.It sorts Level 2 and Level 3 signatures before generating the Level 1 signature.
  • Analyzing Malware Repackaging: 117 Kmin variants shared one Level 1 signature despite having different MD5 values.The variants had the same application structure and malicious behavior, differing only in icons and wallpaper files.
  • Analyzing Malware Repackaging: DroidAnalytics identifies malware variants that conventional cryptographic hashing cannot group reliably.The Kmin experiment found that the most frequent Level 1 signature corresponded to 117 files with different MD5 values.
  • Analyzing Malware with Code Obfuscation: The signature generator ignores non-runtime-executed methods and class or method names, while its analyst-defined API-call table can be updated.These design choices address defunct code, name obfuscation, and changing obfuscation techniques.
  • Analyzing Malware with Code Obfuscation: 240 ADAM-generated malware variants retained the original sample’s Level 1 signature despite repackaging and code obfuscation.Each original sample was transformed into seven variants, including three repackaging and four code-obfuscation variants.

C. Analyzing Malware with Attachement Files or Dynamic

DroidAnalytics combines static and dynamic analysis to inspect concealed attachment files and code downloaded during execution. Experiments identified disguised native payloads and revealed malicious behavior in dynamically downloaded JAR files.

  • Analyzing Malware with Attachment Files or Dynamic Payloads: DroidAnalytics treats concealed attachment files and Internet-downloaded files as dynamic payloads.It accesses these payloads using both static and dynamic analysis techniques and generates signatures for them.
  • Analyzing Malware with Attachment Files or Dynamic Payloads: A file named with a .png extension was identified by its magic number as an .elf root exploit belonging to GinMaster.The signature system detected malware containing the disguised file.
  • Analyzing Malware with Attachment Files or Dynamic Payloads: Dynamic analysis found that Plankton malware downloaded plankton_v0.0.4.jar or a similar JAR when its main activity started.The downloaded JAR contained browser-history theft, screen-shortcut creation, and botnet logic.

IV. Analytic Capability of DroidAnalytics

DroidAnalytics supports opcode-level malware analytics through permission recursion, multilevel signatures, similarity measurement, and class association. Experiments show it can expose suspicious methods, compare applications, and identify repackaged malware and injected malicious code.

  • Detailed Analysis on Malware: DroidAnalytics tags permissions from API calls at method, class, and application levels to help analysts locate suspicious methods and classes.Permissions are recursively combined from methods into classes and applications.
  • Similarity Measurement: Similarity measurement uses three-level signatures to compare applications and identify common and different classes at code level.The approach is applied to detect repackaged malware and reveal injected malicious code.
  • Similarity Measurement: The Jaccard-based similarity score weights common Lev2 signatures by their total API-call counts relative to the union of application classes.Lev2 signatures represent application classes, and S(x) returns the total API calls in a signature set.
  • Similarity Measurement: Five applications sharing the Touch alarm package name were ranked after the legitimate app, and the following four were identified as repackaged Adrd malware.Adrd steals personal and hardware information, encrypts it, uploads it remotely, and may dynamically download a newer version.
  • Similarity Measurement: DroidAnalytics identified malicious code inserted into benign Touch alarm and distinguished differing signatures while preserving common classes.The analysis found suspicious SMS and device-information APIs in the repackaged malware.
  • Class Association: A Lev2 signature used by 105 legitimate applications and 80 malware was traced to the Google AdMob library, illustrating class association across benign and malicious apps.Another shared class was associated with the DOMOB advertisement library.

V. Zero-day Malware Detection

The paper presents DroidAnalytics as a methodology for detecting zero-day repackaged malware. It illustrates the system's effectiveness through analyses of three zero-day malware families.

  • Zero-day Malware Detection: DroidAnalytics detects zero-day repackaged malware by analyzing three zero-day malware families.The paper presents this as a novel methodology for demonstrating the system's effectiveness.

A. Zero-day Malware

Zero-day malware is defined by malicious behavior that remains undetected by current commercial antivirus signatures. Repackaging is a central concern because many Android malware samples derive from legitimate applications and can deceive users.

  • A. Zero-day Malware: Zero-day malware is new malicious software that current commercial antivirus systems cannot detect.Antivirus signatures generally require samples before they can be generated and deployed.
  • A. Zero-day Malware: DroidAnalytics defines an application as zero-day malware when it behaves maliciously but evades popular antivirus software using the latest signature database.The definition is explicitly bounded by the software and signature database available at the evaluation time.
  • A. Zero-day Malware: Nearly 86.0% of Android malware was reported as repackaged legitimate applications, which can camouflage malicious software from users.This reported prevalence motivates examining zero-day repackaged malware.

B. Zero-Day Malware Detection Methodology

The zero-day detection methodology filters common legitimate classes, compares applications through shared API-call signatures, and clusters samples by similarity. Applied to multiple families, it reveals shared malicious packages and behaviors in repackaged applications.

  • B. Zero-Day Malware Detection Methodology: The method first white-lists common legitimate Lev2 signatures from utility and advertisement libraries so they do not affect similarity scores.Examples include Json, Google AdMob, and Airpush libraries.
  • B. Zero-Day Malware Detection Methodology: The method then counts common API calls between applications using a Lev2-signature similarity score focused on shared repackaged malicious logic.The score ignores the effect of other API calls in the applications.
  • B. Zero-Day Malware Detection Methodology: Hierarchical clustering starts with one cluster per application and repeatedly combines the pair with the largest similarity score.The inter-cluster distance is the similarity score defined in the preceding step.
  • B. Zero-Day Malware Detection Methodology: 87 AisRs samples shared the malicious package com.ais.rs and communicated with camouflaged download websites capable of issuing botnet commands.Commands included downloading APK files and uploading application-installation and system information.
  • B. Zero-Day Malware Detection Methodology: 51 AIProvider samples shared a disguised system-like package, encrypted SMS information with DES, and sent SMS messages without notification after boot.The background OperateService decrypted SMS data before sending messages.
  • B. Zero-Day Malware Detection Methodology: 96 G3app samples shared com.g3app and used status-bar notifications and injected triggers into legitimate-application buttons.The injected triggers were activated when users pressed buttons.

VI. Related Work

Prior Android malware studies addressed permission leaks, malware detection, and repackaging, but DroidAnalytics focuses on comprehensive analysis, correlation, and opcode-level identification of malicious code.

  • Earlier Android research primarily examined permission and capability leaks rather than comprehensive malware analytics.
  • Studies characterized Android malware or detected market malware, but did not fully automate systematic analysis and association.
  • DroidMOSS and related approaches addressed repackaging, while DroidAnalytics targets broader opcode-level malware correlation.
  • PC malware research covered signatures, obfuscation, malicious-behavior mining, and functionality analysis, but mobile malware has different features.

VII. Conclusion

DroidAnalytics is an Android malware analytic system that automates collection, signature generation, malicious-code identification, and association with malware and applications. It supports opcode-level retrieval and analysis, including repackaged applications identified through similarity scores.

  • DroidAnalytics automatically collects malware, generates application signatures, identifies malicious code segments, and associates samples with database applications and malware.
  • The system retrieves permissions recursively and associates methods, classes, and applications at the opcode level.
  • Similarity scores help analysts discover repackaged applications.

342 zero-day malware

The experiments included samples from six different malware families and demonstrated DroidAnalytics’s analytic and malware-detection capabilities.

  • Six different malware families were represented among the reported samples.
  • Extensive experiments demonstrated DroidAnalytics’s analytic capabilities.
  • The experiments also demonstrated the system’s malware-detection capabilities.
Loading 1302.7212v4…