CopperDroid: Automatic Reconstruction of Android Malware Behaviors

Abstract

Mobile devices and their application marketplaces drive the entire economy of the today's mobile landscape. Android platforms alone have produced staggering revenues, exceeding five billion USD, which has attracted cybercriminals and increased malware in Android markets at an alarming rate. To better understand this slew of threats, we present CopperDroid, an automatic VMI-based dynamic analysis system to reconstruct the behaviors of Android malware. The novelty of CopperDroid lies in its agnostic approach to identify interesting OS-and high-level Android-specific behaviors. It reconstructs these behaviors by observing and dissecting system calls and, therefore, is resistant to the multitude of alterations the Android runtime is subjected to over its life-cycle. CopperDroid automatically and accurately reconstructs events of interest that describe, not only well-known process-OS interactions (e.g., file and process creation), but also complex intra-and inter-process communications (e.g., SMS reception), whose semantics are typically contextualized through complex Android objects. Because CopperDroid's reconstruction mechanisms are agnostic to the underlying action invocation methods, it is able to capture actions initiated both from Java and native code execution. CopperDroid's analysis generates detailed behavioral profiles that abstract a large stream of low-level-often uninteresting-events into concise, high-level semantics, which are well-suited to provide insightful behavioral traits and open the possibility to further research directions. We carried out an extensive evaluation to assess the capabilities and performance of CopperDroid on more than 2,900 Android malware samples. Our experiments show that CopperDroid faithfully reconstructs OSand Android-specific behaviors. Additionally, we demonstrate how CopperDroid can be leveraged to disclose additional behaviors through the use of a simple, yet effective, app stimulation technique. Using this technique, we successfully triggered and disclosed additional behaviors on more than 60% of the analyzed malware samples. This qualitatively demonstrates the versatility of CopperDroid's ability to improve dynamic-based code coverage. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

IntelliDroid: A Targeted Input Generator for the Dynamic Analysis of Android Malware

“…In this case, the user must determine a mapping between the system call method and API methods that use the system call. Such tools include CopperDroid [39], AASandbox [10] and Crowdroid [12]. If only specific system calls are traced (e.g.…”

“…Given a set of targeted APIs that represent the analysis performed by the dynamic tool, IntelliDroid will find instances of these targeted APIs in the application and generate inputs to trigger them. These inputs can be injected into an actual Android system, allowing IntelliDroid to be integrated with any dynamic analysis tool, including those that monitor application execution from an instrumented OS [19], or from a virtual machine emulator [39]. To accomplish this task, IntelliDroid takes the following steps: 1) Identify invocations of targeted APIs.…”

Things You May Not Know About Android (Un)Packers: A Systematic Study based on Whole-System Emulation

“…malicious code or heavy computation code [20]) in Android apps. TaintDroid [21], DroidScope [39], CopperDroid [35] and VetDroid [42] conducted dynamic taint analysis to detect Yes suspicious behaviors at runtime. Static analysis requires access to complete bytecode program and therefore can be simply evaded by runtime packers.…”

Design of Function for Tracing Diffusion of Classified Information for IPC on KVM

“…CopperDroid [23] operates Android malware on QEMU, and analyzes the behavior of this malware by hooking the system calls. An analysis of Android-specific IPC using Binder is achieved by hooking ioctl(), which sends Binder the c 2016 Information Processing Society of Japan data.…”