The rise of obfuscated Android malware and impacts on detection methods

Abstract

The various application markets are facing an exponential growth of Android malware. Every day, thousands of new Android malware applications emerge. Android malware hackers adopt reverse engineering and repackage benign applications with their malicious code. Therefore, Android applications developers tend to use state-of-the-art obfuscation techniques to mitigate the risk of application plagiarism. The malware authors adopt the obfuscation and transformation techniques to defeat the anti-malware detections, which this paper refers to as evasions. Malware authors use obfuscation techniques to generate new malware variants from the same malicious code. The concern of encountering difficulties in malware reverse engineering motivates researchers to secure the source code of benign Android applications using evasion techniques. This study reviews the state-of-the-art evasion tools and techniques. The study criticizes the existing research gap of detection in the latest Android malware detection frameworks and challenges the classification performance against various evasion techniques. The study concludes the research gaps in evaluating the current Android malware detection framework robustness against state-of-the-art evasion techniques. The study concludes the recent Android malware detection-related issues and lessons learned which require researchers’ attention in the future.

Problem-Space Evasion Attacks in the Android OS: a Survey

“…[138,139,140]). However, they did not succeed, as proved in this survey and also in other surveys (e.g., [31]…”

“…Various surveys were conducted on problem-space evasion attacks, e.g. [22,23,24,25,26,27,28,29,30,31,32,33,34]. However, some of these surveys are general and therefore do not focus on a specific domain of evasion attacks [23,27,28,30,32,33].…”

“…Other surveys analyze domains other than Android OS, such as adversarial network examples, Windows PEs, Natural Language Processing, and images [22,24,25,26,29]. Several surveys focused on evasion attacks on the Android OS domain, for example [35,31,34]. While Bhusal and Rastogi [35] presented work on the nature of feature-space and problem-space attacks, they only explored one problem-space evasion attack.…”

“…While Bhusal and Rastogi [35] presented work on the nature of feature-space and problem-space attacks, they only explored one problem-space evasion attack. Also, [31,34] surveys suggest a different taxonomy, which focuses on the evasion techniques, while our survey analyzes different aspects that have increased in recent years; For example, the importance of functional evaluation [2] and the orientation of different problem-space attacks. Second, exploring problem-space attacks is vital to test the realistic assumptions of feature-space evasion attacks.…”

On the evaluation of android malware detectors against code-obfuscation techniques

“…Malware authors are always looking for new tricks and mechanisms to bypass Android security. The malware authors adopt different obfuscation and transformation techniques to bypass the anti-malware detection ( Elsersy, Feizollah & Anuar, 2022 ). The main motivation of this work is to evaluate the anti-malware tools against the malware that uses code-obfuscations.…”