Droidgraph : an effective android malware detection using semantic behavior analysis

다국어 초록 (Multilingual Abstract)

Since the number of mobile malware has been tremendously increased for the last decade, discovering mobile malware has become an important issue. Numerous efforts have been devoted to mitigate mobile malware threats, but they experienced difficulties because of repackaging and metamorphic techniques. Malware authors are used to generate tremendous variants of malware by applying repackaging that hides attack modules into well-known legitimate applications. Furthermore, in order to evade the existing anti-malware solutions, they leverage the metamorphic techniques such as API substitution and junk code insertion, which allows the manipulation of malware appearance while maintaining same functionality. Consequently, current malware countermeasures are suffering from the scalability problem for responding to the dramatic increase of malware variants. In this paper, we propose a novel method, called DroidGraph, which is scalable and robust against the mobile malware threats. The DroidGraph operation focuses on the semantic behavior of malware. DroidGraph extracts behavior graphs from the application and abstracts behavior graphs to semantic graphs, which are represented with 128 identical nodes based on the semantics of the Android API calls. We select semantic graphs containing representative malicious behaviors of Android malware and employ them as semantic signatures to discover the malware variants. For evaluation, we collected 10,937 legitimate Android applications from the Google Play Store and 5,170 real-world Android malware from malware portal sites such as Contagio. DroidGraph reduced the number of signatures down to 1/8 by comparing with one of the latest research. DroidGraph showed a detection rate of 92.38% with 1.39% of false positives in ten-fold verification.

목차 (Table of Contents)

• Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i
• Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii
• List of Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v
• List of Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi
• 1 Introduction 1
• 2 Related Work 6
• 3 Backgrounds 9
• 3.1 Application Repackaging . . . . . . . . . . . . . . . . . . . . . . 9
• 3.2 Code Metamorphism . . . . . . . . . . . . . . . . . . . . . . . . 10
• 4 Problem Denition 11
• 4.1 Problem Statement . . . . . . . . . . . . . . . . . . . . . . . . . 11
• 4.2 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
• 4.3 Goal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
• 5 DroidGraph 13
• 5.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
• 5.2 API Call Graph Construction . . . . . . . . . . . . . . . . . . . 15
• 5.3 Semantic Abstraction . . . . . . . . . . . . . . . . . . . . . . . 17
• 5.4 Malicious Graph Mining . . . . . . . . . . . . . . . . . . . . . . 19
• 5.5 Signature Matching . . . . . . . . . . . . . . . . . . . . . . . . . 20
• 6 Evaluation 22
• 6.1 Data Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
• 6.2 Signature Analysis . . . . . . . . . . . . . . . . . . . . . . . . . 23
• 6.2.1 Semantic signatures . . . . . . . . . . . . . . . . . . . . 24
• 6.2.2 Signature selection strategy . . . . . . . . . . . . . . . . 25
• 6.2.3 Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . 26
• 6.3 Detection Performance . . . . . . . . . . . . . . . . . . . . . . . 28
• 6.3.1 Detection accuracy . . . . . . . . . . . . . . . . . . . . . 28
• 6.3.2 Metamorphic malware detection . . . . . . . . . . . . . 29
• 6.4 Comparison with a Previous Research . . . . . . . . . . . . . . 31
• 7 Discussion 32
• 7.1 Relationship between Legitimate and Malware Signatures . . . 33
• 7.2 Limitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
• 7.2.1 Native code and dynamic code change . . . . . . . . . . 34
• 7.2.2 Method level analysis . . . . . . . . . . . . . . . . . . . 35
• 7.2.3 Suspicious behavior by legitimate application . . . . . . 35
• 8 Conclusion 37
• References 38
• Summary (in Korean) 42