Dalvik Executable Research Articles

Mining Android Bytecodes through the Eyes of Gabor Filters for Detecting Malware

One of the basic characteristics of a Gabor filter is that it provides useful information about specific frequencies in a localized region. Such information can be used in locating snippets of code, i.e., localized code, in a program when transformed into an image for finding embedded malicious patterns. Keeping this phenomenon, we propose a novel technique using a sliding Window over Gabor filters for mining the Dalvik Executable (DEX) bytecodes of an Android application (APK) to find malicious patterns. We extract the structural and behavioral functionality and localized information of an APK through Gabor filtered images of the 2D grayscale image of the DEX bytecodes. A Window is slid over these features and a weight is assigned based on its frequency of use. The selected Windows whose weights are greater than a given threshold, are used for training a classifier to detect malware APKs. Our technique does not require any disassembly or execution of the malware program and hence is much safer and more accurate. To further improve feature selection, we apply a greedy optimization algorithm to find the best performing feature subset. The proposed technique, when tested using real malware and benign APKs, obtained a detection rate of 98.9% with 10-fold cross-validation.

A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization

Android is the most widely used mobile platform, making it a prime target for malicious attacks. Therefore, it is imperative to effectively circumvent these attacks. Recently, machine learning has been a promising solution for malware detection, which relies on distinguishing features. While machine learning-based malware scanners have a large number of features, adversaries can avoid detection by using feature-related expertise. Therefore, one of the main tasks of the Android security industry is to consistently propose cutting-edge features that can detect suspicious activity. This study presents a novel feature representation approach for malware detection that combines API-Call Graphs (ACGs) with byte-level image representation. First, the reverse engineering procedure is used to obtain the Java programming codes and Dalvik Executable (DEX) file from Android Package Kit (APK). Second, to depict Android apps with high-level features, we develop ACGs by mining API-Calls and API sequences from Control Flow Graph (CFG). The ACGs can act as a digital fingerprint of the actions taken by Android apps. Next, the multi-head attention-based transfer learning method is used to extract trained features vector from ACGs. Third, the DEX file is converted to a malware image, and the texture features are extracted and highlighted using a combination of FAST (Features from Accelerated Segment Test) and BRIEF (Binary Robust Independent Elementary Features). Finally, the ACGs and texture features are combined for effective malware detection and classification. The proposed method uses a customized dataset prepared from the CIC-InvesAndMal2019 dataset and outperforms state-of-the-art methods with 99.27% accuracy.

IoT-based green city architecture using secured and sustainable android services

Abstract Green and smart cities deliver services to their residents using mobile applications that make daily life more convenient. The privacy and security of these applications are significant in providing sustainable services in a green city. The software cloning is a severe threat which may breach the security and privacy of android applications. A centrally controlled and automated screening system across multiple app stores is inevitable to prevent the release of copyrighted or cloned copies of these apps. In this paper, we proposed IoT-enabled green city architecture for clone detection in android markets using a deep learning approach. First, the proposed system obtained an original APK file together with potential candidate cloned APKs via the cloud network. For each subject software, the system uses an APK Extractor tool to retrieve Dalvik Executable (DEX) files. The Jdex decompiler is utilized to retrieve Java source files through Dalvik Executables. Second, the AST features are extracted using ANother Tool for Language Recognition (ANTLR) parser. Third, the linear features are mined from these hierarchical structures, and Term Frequency Inverse Document Frequency (TFIDF) is applied to estimate the significance of each feature. Finally, the deep learning model is configured to detect cloned apps. The deep learning model is fine-tuned to get better accuracy. The proposed approach is analyzed on five different cloned applications collected from different android markets. The main objective of this system is to avoid the release of pirated apps with various pirated labels in multiple app markets.

Android Malware Familial Classification Based on DEX File Section Features

The rapid proliferation of Android malware is challenging the classification of the Android malware family. The traditional static method for classification is easily affected by the confusion and reinforcement, while the dynamic method is expensive in computation. To solve these problems, this paper proposes an Android malware familial classification method based on Dalvik Executable (DEX) file section features. First, the DEX file is converted into RGB (Red/Green/Blue) image and plain text respectively, and then, the color and texture of image and text are extracted as features. Finally, a feature fusion algorithm based on multiple kernel learning is used for classification. In this experiment, the Android Malware Dataset (AMD) was selected as the sample set. Two different comparative experiments were set up, and the method in this paper was compared with the common visualization method and feature fusion method. The results show that our method has a better classification effect with precision, recall and F1 score reaching 0.96. Besides, the time of feature extraction in this paper is reduced by 2.999 seconds compared with the method of frequent subsequence. In conclusion, the method proposed in this paper is efficient and precise in the classification of the Android malware family.

Detection of clone scammers in Android markets using IoT‐based edge computing

AbstractPirated application developers find an alternate way to publish pirated versions of the same Android mobile applications (apps) on different Android markets. Therefore, a centralized, automated scrutiny system among multiple app stores is inevitable to prevent publishing pirated or cloned version of these Android applications. In this paper, we proposed an Android clone detection system for Internet of things (IoT) (Droid‐IoT) devices. First, the proposed system receives an original Android application package (APK) file along with possible candidate cloned APKs over the cloud network. The system uses an apkExtractor tool to extract Dalvik Executable (DEX) files for each subject program. The Jdex decompiler is used to extract Java source files from DEXs. Then, the bag‐of‐word model is used to extract tokenized features from source files. Further, the weighting filters are used to zoom the importance of each token. Moreover, Synthetic Minority Oversampling is applied to retrieve balanced features for better training of data. Finally, TensorFlow with Keras deep learning model is designed to predict clones in Android applications. The experimental results have shown that Droid‐IoT can successfully detect cloned apps with an accuracy of up to 96%. The primary purpose of this system is to prevent the publishing of pirated apps among different app stores under different pirated names.

TinyDroid: A Lightweight and Efficient Model for Android Malware Detection and Classification

With the popularity of Android applications, Android malware has an exponential growth trend. In order to detect Android malware effectively, this paper proposes a novel lightweight static detection model, TinyDroid, using instruction simplification and machine learning technique. First, a symbol-based simplification method is proposed to abstract the opcode sequence decompiled from Android Dalvik Executable files. Then, N-gram is employed to extract features from the simplified opcode sequence, and a classifier is trained for the malware detection and classification tasks. To improve the efficiency and scalability of the proposed detection model, a compression procedure is also used to reduce features and select exemplars for the malware sample dataset. TinyDroid is compared against the state-of-the-art antivirus tools in real world using Drebin dataset. The experimental results show that TinyDroid can get a higher accuracy rate and lower false alarm rate with satisfied efficiency.

Rapid Android Parser for Investigating DEX files (RAPID)

Android malware is a well-known challenging problem and many researchers/vendors/practitioners have tried to address this issue through application analysis techniques. In order to analyze Android applications, tools decompress APK files and extract relevant data from the Dalvik EXecutable (DEX) files. To acquire the data, investigators either use decompiled intermediate code generated by existing tools, e.g., Baksmali or Dex2jar or write their own parsers/dissemblers. Thus, they either need additional time because of decompiling the application into an intermediate representation and then parsing text files, or they reinvent the wheel by implementing their own parsers. In this article, we present Rapid Android Parser for Investigating DEX files (RAPID) which is an open source and easy-to-use JAVA library for parsing DEX files. RAPID comes with well-documented APIs which allow users to query data directly from the DEX binary files. Our experiments reveal that RAPID outperforms existing approaches in terms of runtime efficiency, provides better reliability (does not crash) and can support dynamic analysis by finding critical offsets. Notably, the processing time for our sample set of 22.35 GB was only 1.5 h with RAPID while the traditional approaches needed about 23 h (parsing and querying).

안드로이드 앱 변조 방지를 위한 APK 덮어쓰기 기법

It is easy to reverse engineer an Android app package file(APK) and get its decompiled source code. Therefore, attackers obtains economic benefits by illegally using the decompiled source code, or modifies an app by inserting malware. To address these problems in Android, we propose an APK overwrite scheme that protects apps against illegal modification of themselves by using a new anti-reverse engineering technique. In this paper, the targets are the apps which have been written by any programmer. For a target app (original app), server system (1) makes a copy of a target app, (2) encrypts the target app, (3) creates a stub app by replacing the DEX (Dalvik Executable) of the copied version with our stub DEX, and then (4) distributes the stub app as well as the encrypted target app to users of smartphones. The users downloads both the encrypted target app and the corresponding stub app. Whenever the stub app is executed on smartphones, the stub app and our launcher app decrypt the encrypted target app, overwrite the stub app with the decrypted target one, and executes the decrypted one. Every time the target app ends its execution, the decrypted app is deleted. To verify the feasibility of the proposed scheme, experimentation with several popular apps are carried out. The results of the experiment demonstrate that our scheme is effective for preventing reverse engineering and tampering of Android apps. 논문 14-39B-05-08 The Journal of Korea Information and Communications Society '14-05 Vol.39B No.05 http://dx.doi.org/10.7840/kics.2014.39B.5.309 309 ※ 본 연구는 미래창조과학부가 지원한 2014년 정보통신·방송(ICT) 연구개발사업과 문화체육관광부 및 한국저작권위원회의 2014년도 저작권 기술개발사업의 연구결과로 수행되었습니다. First Author : Research Institute of Information and Communication Convergence Technology, Dankook University, notanything@dankook.ac.kr, 정회원 ° Corresponding Author : Dept. of Computer Science, Dankook University, sjcho@dankook.ac.kr, 정회원 * 단국대학교 컴퓨터학과, ggudwns@dankook.ac.kr, lchan12@dankook.ac.kr, anaislover@dankook.ac.kr 논문번호:KICS2014-04-118, Received April 7, 2014; Revised April 16, 2014; Accepted April 16, 2014 The Journal of Korea Information and Communications Society '14-05 Vol.39B No.05

안드로이드 응용의 응답 시간 향상을 위한 트레이스 기반 프리컴파일 기법

Recently, to improve the user response times of Android applications, several studies have been proposed to combine the idea of Ahead-of-Time compilation into Dalvik virtual machine, which uses Just-in-Time compilation. The studies, however, require modifications of the Dalvik executables of target applications, thus are difficult to be adopted for legacy applications already deployed. This paper proposes a JITwP(JIT with Precompile) technique that precompiles hot traces at application launch time with no modification of the Dalvik executable. It improves the user response times of target applications by providing precompile hints prepared offline. Our experimental results demonstrate a 4% improvement in terms of execution time for the Web browser application.