An Empirical Study on Android malware behavior signature extraction

Abstract

Malicious applications, especially in mobile devices, constitute a serious threats to user data. Dueto the openness, Android have become the most popular smart phone operating system in mobilemarket. Although fast and straightforward, Static analysis approach has many difficulties to detectstealthy malware. In this paper, we propose a behavior signature-based to classify whether malwareor not. To achieve this, we first hook a number of sensitive APIs to collect all possible invocationsof the app. We then extract the behaviors of malicious applications by comparing their flows and thevalue of parameters and results of each called APIs. In our study, we extracted behavior signaturesfrom malware in each family. Our works help to improve the quality of analysis compared with staticanalysis-only approaches.