Using Loops For Malware Classification Resilient to Feature-unaware Perturbations

Abstract

In the past few years, both the industry and the academic communities have developed several approaches to detect malicious Android apps. State-of-the-art research approaches achieve very high accuracy when performing malware detection on existing datasets. These approaches perform their malware classication tasks in an "oine" scenario, where malware authors cannot learn from and adapt their malicious apps to these systems. In real-world deployments, however, adversaries get feedback about whether their app was detected, and can react accordingly by transforming their code until they are able to inuence the classication. In this work, we propose a new approach for detecting Android malware that is designed to be resilient to feature-unaware perturbations without retraining. Our work builds on two key ideas. First, we consider only a subset of the codebase of a given app, both for precision and performance aspects. For this paper, our implementation focuses exclusively on the loops contained in a given app. We hypothesize, and empirically verify, that the code contained in apps' loops is enough to precisely detect malware. This provides the additional benets of being less prone to noise and errors, and being more performant. The second idea is to build a feature space by extracting a set of labels for each loop, and by then considering each unique combination of these labels as a dierent feature: The combinatorial nature of this feature space makes it prohibitively dicult for an attacker to inuence our feature vector and avoid detection, without access to the specic model used for classication. We assembled these techniques into a prototype, called LMC, which can locate loops in applications, extract features, and perform classication, without requiring source code. We used LMC to classify about 20,000 benign and malicious applications. While focusing on a smaller portion of the program may seem counterintuitive, the results of these experiments are surprising: our system ACM acknowledges that this contribution was authored or co-authored by an employee, contractor, or aliate of the United States government. As such, the United States government retains a nonexclusive, royalty-free right to publish or reproduce this article, or to allow others to do so, for government purposes only.

HomDroid: detecting Android covert malware by social-network homophily analysis

“…In order to maintain high effectiveness on detecting Android malware, researchers [18,22,25,29,31,36,38,41,42,54,[57][58][59][60][61] conduct program analysis to extract different types of app semantics. For example, MaMaDroid [42] first performs static analysis to obtain the graph representation of an app, then all the sequences are obtained from the graph and are abstracted into the corresponding packages to model the app's invocation behaviors.…”

“…In general, existing mobile malware detection approaches can be classified into two categories, namely syntax-based approaches [17,20,46,51,55,62] and semantics-based systems [18,22,31,41,42,[58][59][60]. As for syntax-based methods, they ignore the program semantics of apps to achieve high efficient Android malware detection.…”

RacketStore: Measurements of ASO Deception in Google Play via Mobile and App Usage

“…Further, even organic workers tend to use their devices in a manner that distinguishes them from regular users. Related efforts also include extensive work to detect malware Android apps, e.g., [29,41,54,60,61,[69][70][71]95]. Notably, Yang et al [91] differentiate malware from benign apps based on the contexts that trigger security-sensitive behaviors.…”

DANdroid

“…DeepRefiner [46] employs LSTM units to analyse Android bytecode, however there may be a complexity issue in that approach with the model containing at least 18 million parameters. [25] uses semantic labels for classification determined from API methods specifically invoked within loops from an app's code. This is tested against control flow graph obfuscation and reflection.…”

“…Similarly, authors in [25] use expert-derived loop features and a conventional Random Forest (RF) classifier. Furthermore, they conduct an obfuscation test across their whole dataset by using reflection on all their malicious and benign apps.…”