DroidFDR: Automatic Classification of Android Malware Using Model Checking

Abstract

Android faces an increasing threat of malware attacks. The few existing formal detection methods have drawbacks such as complex code modeling, incomplete and inaccurate expression of family properties, and excessive manual participation. To this end, this paper proposes a formal detection method, called DroidFDR, for Android malware classification based on communicating sequential processes (CSP). In this method, the APK file of an application is converted to an easy-to-analyze representation, namely Jimple, in order to model the code behavior with CSP. The process describing the behavior of a sample is inputted to an FDR model checker to be simplified and verified against a process that is automatically abstracted from the malware to express the property of a family. The sample is classified by detecting whether it has the typical behavior of any family property. DroidFDR can capture the behavioral characteristics of malicious code such as control flow, data flow, procedure calls, and API calls. The experimental results show that the automated method can characterize the behavior patterns of applications from the structure level, with a high family classification accuracy of 99.06% in comparison with another formal detection method.

Detection of Sensitive Malicious Android Functionalities using Inter-component Control-flow Analysis

“…At the start of this investigation, malware samples identified as GamblerSMS [60] and RogueSPPush [61] were discovered in Chinese app marketplaces. Unlike RogueSPPush [61] SMS Trojan, GamblerSMS is spyware. Malware tracks and forwards each received SMS message to predetermined phone numbers.…”

Malware Analysis in IoT & Android Systems with Defensive Mechanism

“…They addressed five issues, namely (1) the current unfavorable repackaging practices, (2) the way adware is embedded in the code, (3) the types of apps used to repackage, (4) the reasons people download repackaged software, and (5) the way the properties of an app change in the repackaged version. Static Malware detection tools including TinyDroid, DroidFDR [6], DroidEnsemble, and NsDroid were presented in [7], but their shortcoming is that these are not suitable for dynamic analysis. NsDroid is a lightweight and fast Android malware detection tool.…”