DroidClone: Attack of the android malware clones - a step towards stopping them

Abstract

Code clones are frequent in use because they can be created fast with little effort and expense. Especially for malware writers, it is easier to create a clone of the original than writing a new malware. According to the recent Symantec threat reports, Android continues to be the most targeted mobile platform, and the number of new mobile malware clones grew by 54%. There is a need to develop techniques and tools to stop this attack of Android malware clones. To stop this attack, we propose DroidClone that exposes code clones (segments of code that are similar) in Android applications to help detect malware. DroidClone is the first such effort uses specific control flow patterns for reducing the effect of obfuscations and detect clones that are syntactically different but semantically similar up to a threshold. DroidClone is independent of the programming language of the code clones. When evaluated with real malware and benign Android applications, DroidClone obtained a detection rate of 94.2% and false positive rate of 5.6%. DroidClone, when tested against various obfuscations, was able to successfully provide resistance against all the trivial (Renaming methods, parameters, and nop insertion, etc) and some non-trivial (Call graph manipulation and function indirection, etc.) obfuscations.

AndroMalPack: enhancing the ML-based malware classification by detection and removal of repacked apps for Android systems

“…ImageStruct 63 and a similar work DroidEagle 64 leverage the similarity of images and UI layout to detect potential clones and repacked malware in Android apps. DroidClone 65 rely on the structure and reusing of code segments to detect repackaged apps and clones of Android malware. Singh et al employ a multi-view machine learning-based technique to detect repacked Android malware 66 and report up to 97.46% accuracy using 15,297 malware samples.…”

“…As a result, they detected up to 92% of the repacked apps in the dataset. Alam et al 70 proposed DroidClone to address the problem of clones in Android malware. DroidClone employs MAIL , a novel language to identify control flow patterns in the program.…”