When the Guard failed the Droid: A case study of Android malware

Abstract

Android malware is a persistent threat to billions of users around the world. As a countermeasure, Android malware detection systems are occasionally implemented. However, these systems are often vulnerable to evasion attacks, in which an adversary manipulates malicious instances so that they are misidentified as benign. In this paper, we launch various innovative evasion attacks against several Android malware detection systems. The vulnerability inherent to all of these systems is that they are part of Androguard [34], a popular open source library used in Android malware detection systems. Some of the detection systems decrease to a 0% detection rate after the attack. Therefore, the use of open source libraries in malware detection systems calls for caution.In addition, we present a novel evaluation scheme for evasion attack generation that exploits the weak spots of known Android malware detection systems. In so doing, we evaluate the functionality and maliciousness of the manipulated instances created by our evasion attacks. We found variations in both the maliciousness and functionality tests of our manipulated apps. We show that non-functional apps, while considered malicious, do not threaten users and are thus useless from an attacker's point of view. We conclude that evasion attacks must be assessed for both functionality and maliciousness to evaluate their impact, a step which is far from commonplace today.

EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection

“…Xu et al [23] proposed a semi-black-box attack that perturbs DREBIN features of Android apps based on the simulated annealing algorithm. Berger et al [24] considerd the vulnerability of Androguard-based Android malware detectors to present different attacks that can mislead Android malware detection. Yang et al [29] presented a problem-space evasion attack to mislead Android malware detectors in the black-box setting.…”

“…pixel intensity in a grayscale image). To address this challenge, the authors of [20], [24] considered manipulating the features extracted from the Android Manifest file; however, the practicality of such manipulations in generating executable adversarial examples is questionable for the following reasons. Firstly, modifying features from the Android Manifest (e.g., content providers, intents, etc.)…”

“…Secondly, adding unused features to the Manifest file can be discarded by applying pre-processing techniques [26]. Eventually, the advanced Android malware detectors (e.g., [31], [34]) are mostly based on the semantic of Android apps, which belong to the Dalvik bytecode of Android apps, not the Manifest files [27], [24].…”

“…• Most studies [17]- [24] generated adversarial perturbations in the feature space, while the feasibility of the proposed techniques have not been evaluated in real-world samples. For those papers [26]- [29] that did generate real-world adversarial examples based on the feature-space perturbations, the inverse mapping techniques used often came with some restrictions (e.g.…”

The geomorphological distribution of subaqueous tufa columns in a hypersaline lake: Mono Lake, U.S.A.

“…The third case is no knowledge (NK), where the attacker neither has access to training data nor the knowledge about the underlying classifier. Although the Android malware detectors can hide the underlying model, however, there are many publicly available Android malware datasets that can help the attacker to get insights into the training data [6]. So there is a large gap to fill in research for adversarial evasion detection considering the publicly available datasets while designing a sophisticated Android malware detector.…”