Sound and precise malware analysis for android via pushdown reachability and entry-point saturation

Abstract

Sound malware analysis of Android applications is challenging. First, object-oriented programs exhibit highly interprocedural, dynamically dispatched control structure. Second, the Android programming paradigm relies heavily on the asynchronous execution of multiple entry points. Existing analysis techniques focus more on the second challenge, while relying on traditional analytic techniques that suffer from inherent imprecision or unsoundness to solve the first.We present Anadroid, a static malware analysis framework for Android apps. Anadroid exploits two techniques to soundly raise precision: (1) it uses a pushdown system to precisely model dynamically dispatched interprocedural and exception-driven control-flow; (2) it uses Entry-Point Saturation (EPS) to soundly approximate all possible interleavings of asynchronous entry points in Android applications. (It also integrates static taint-flow analysis and least permissions analysis to expand the class of malicious behaviors which it can catch.) Anadroid provides rich user interface support for human analysts which must ultimately rule on the "maliciousness" of a behavior.To demonstrate the effectiveness of Anadroid's malware analysis, we had teams of analysts analyze a challenge suite of 52 Android applications released as part of the Automated Program Analysis for Cybersecurity (APAC) DARPA program. The first team analyzed the apps using a version of Anadroid that uses traditional (finite-state-machinebased) control-flow-analysis found in existing malware analysis tools; the second team analyzed the apps using a version of Anadroid that uses our enhanced pushdown-based control-flow-analysis. We measured machine analysis time, human analyst time, and their accuracy in flagging malicious applications. With pushdown analysis, we found statistically significant (p < 0.05) decreases in time: from 85 minutes per app to 35 minutes per app in human plus maPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. SPSM '13, November 8, 2013, Berlin, Germany. Copyright is held by the owner/author(s). Publication rights licensed to ACM. ACM 978-1-4503-2491-5/13/11 ...$15.00. http://dx.doi.org/10.1145/2516760.2516769. chine analysis time; and statistically significant (p < 0.05) increases in accuracy with the pushdown-driven analyzer: from 71% correct identification to 95% correct identification.

Static analysis of android apps: A systematic literature review

“…C o n te x t-S e n si ti v e F lo w -S e n si ti v e F ie ld -S e n si ti v e O b je c t-S e n si ti v e P a th -S e n si ti v e Anadroid [36] 3 3 3 7 3 Total 30 31 36 15 5 In theory, the more sensitivities considered, the more precise the analysis is. It is thus reasonable to state that only one approach, namely TRESHER [106], achieves high precision by taking into account all sensitivities.…”

Evaluation of machine learning classifiers for mobile malware detection

“…The bot samples in our experiment use network connectivity as their main communication means. However, some of them use SMS, not as the main communication means, but just to intercept incoming messages and leak their content to attackers via network traffic (Liang et al 2013;Seo et al 2013).…”

Fast Flow Analysis with Godel Hashes

“…It is an effective semantic-based abstract interpretation framework to detect maliciousness in Android applications [15]. However, the analysis still suffers from the performance bottleneck originating from the subsumption testing during fixed point computation.…”

“…The details of this analyzer can be found in [15]. It is the same analyzer we have used in the later evaluation section VIII.…”