Malicious Android Applications Research Articles

VolMemDroid—Investigating android malware insights with volatile memory artifacts

Android based smartphones have become a top target for malware writers due to their widespread use. A number of malicious applications are present on play stores and downloaded on daily basis, posing a significant threat to users’ personal and business data. As a result, the design of malware analysis frameworks is crucial in protecting the growing number of users who rely on their smart phones for routine and business tasks. The traditional signature based schemes for malware detection are unable to handle new and sophisticated malware. Furthermore, generic solutions based on static analysis schemes become less effective in the presence of obfuscated malware. In this study, a dynamic analysis based framework, VolMemDroid, for detecting malicious applications for Android is proposed. The framework extracts the volatile memory artifacts for profiling malicious Android applications. For this purpose, the memory forensic framework of volatility is utilized. A number of volatility plugins are analyzed for their compatibility w.r.t the Android platform and their ability in modeling the application’s behavior. After testing a number of plugins, chosen plugins are further processed for extraction of features. A comprehensive feature set for Android malware detection and categorization is proposed. It has been found that the suggested framework is effective for detecting Android malicious applications with an F1-score of 0.972, which is better than existing volatile memory based approaches for Android malware detection. The framework is also found to be effective in categorizing malicious Android applications into four distinct classes.

Benchmarking Android Malware Analysis Tools

Today, malware is arguably one of the biggest challenges organisations face from a cybersecurity standpoint, regardless of the types of devices used in the organisation. One of the most malware-attacked mobile operating systems today is Android. In response to this threat, this paper presents research on the functionalities and performance of different malicious Android application package analysis tools, including one that uses machine learning techniques. In addition, it investigates how these tools streamline the detection, classification, and analysis of malicious Android Application Packages (APKs) for Android operating system devices. As a result of the research included in this article, it can be highlighted that the AndroPytool, a tool that uses machine learning (ML) techniques, obtained the best results with an accuracy of 0.986, so it can be affirmed that the tools that use artificial intelligence techniques used in this study are more efficient in terms of detection capacity. On the other hand, of the online tools analysed, Virustotal and Pithus obtained the best results. Based on the above, new approaches can be suggested in the specification, design, and development of new tools that help to analyse, from a cybersecurity point of view, the code of applications developed for this environment.

Design and Development of Android App Malware Detector API Using Androguard and Catboost

Abstract: Android has been constant target of attacks through the use of malicious applications (malware) that can harm users, for instance, by leaking sensitive data (e.g., bank account details), blocking access to information and demanding monetary compensation for the ransom, or even leveraging social engineering scams. A large number of malicious applications is distributed in a daily basis through different distribution vectors, such as application markets, including official and third party stores, or untrusted sources like Web repositories. The increasing prevalence of Android malware necessitates advanced detection mechanisms to safeguard users and their devices. The aim of the project is to presents an innovative approach to Android malware detection, integrating machine learning, blockchain technology, and web development tools. The proposed system is to develop a Andriod App Malware Detector API capable of identifying and mitigating malicious applications effectively. The system begins with the collection of diverse datasets comprising both benign and malicious Android applications, ensuring the representation of various threat vectors and scenarios. Androguard, a powerful tool for Android app analysis, the system extracts relevant features such as permissions, API calls, and intents, providing valuable insights into the behaviour and characteristics of each application. The AndroMal Model is designed and trained using CatBoost Algorithm and integrated with a blockchain framework for secure metadata storage. Consensus mechanisms and smart contracts enhance transparency and reliability. Privacy considerations, continuous monitoring, and user feedback mechanisms further fortify the system. The proposed design promises an effective, scalable, and user-centric solution for Android malware detection.

KFFPDet: Android malicious application detection system with assisted detection of adversarial samples

Machine learning methods are widely used in Android malware detection, but carefully scrambled adversarial samples can effectively evade detection. Adversarial defence methods such as retraining and ensemble learning have high training costs and significant errors. This paper proposes a novel Android malware detection system, KFFPDet, to detect adversarial samples. It can detect adversarial samples efficiently. Firstly, this paper uses K-Nearest Neighbor (KNN) as the primary detection algorithm. In addition, this paper proposes a three-stage adversarial sample detection method, which saves the detection cost and reduces the error through prior knowledge. In the first stage, the frequency difference between benign typical features and malicious typical features is used to filter adversarial samples. In the second stage, the feature continuous values of benign typical features are used for adversarial sample filtering. The third stage filters adversarial samples by detecting isolation permissions and application programming interface (API). Experiments on various benchmark datasets verify the detection effect of KFFPDet. KFFPDet achieves 96% accuracy of adversarial sample detection on the VirusShare dataset. Compared with other advanced methods, KFFPDet ’s adversarial sample detection accuracy is improved by 4.43% to 94.53%. The experimental results show that the proposed three-stage adversarial sample detection method is useful and will help design a more effective adversarial sample detection scheme.

Enhancing android malware detection explainability through function call graph APIs

Nowadays, mobile devices are massively used in everyday activities. Thus, they contain sensitive data targeted by threat actors like bank accounts and personal information. Through the years, Machine Learning approaches have been proposed to identify malicious Android applications, but recent research highlights the need for better explanations for model decisions, as existing ones may not be related to the app’s malicious functionalities.This paper proposes an explainable approach based on static analysis to detect Android malware. The novelty lies in the specific analysis conducted to select and extract the features (i.e., APIs taken from the DEX Call Graph) that immediately provide meaningful explanations of the model functionality, thus allowing a significant correlation of the malware behavior with its family. Moreover, since we contain the number and type of features, the distinct impacts of each one appear more evident. The attained results show that it is possible to reach comparable results (in terms of accuracy) to existing state-of-the-art models while providing easy-to-understand explanations, which may yield significant insights into the malicious functionalities of the samples.

Enhancing android application security: A novel approach using DroidXGB for malware detection based on permission analysis

AbstractThe prevalence of malicious Android applications targeting the platform has introduced significant challenges in the realm of security testing. Traditional solutions have proven insufficient in handling the growing number of malicious apps, resulting in persistent exposure of Android smartphones to evolving forms of malware. This study investigates the potential of extreme gradient boosting (XGB) in identifying complex and high‐dimensional malicious permissions. By leveraging attribute combination and selection techniques, XGBoost demonstrates promising capabilities in this area. However, enhancing the XGBoost model presents a formidable challenge. To overcome this, This research employs adaptive grey wolf optimization (AGWO) for hyper‐parameter tuning. AGWO utilizes continuous values to represent the position and movement of the grey wolf, enabling XGBoost to search for optimal hyper‐parameter values in a continuous space. The proposed approach, DroidXGB, utilizes XGBoost and AGWO to analyze permissions and identify malware Android applications. It aims to address security vulnerabilities and compares its performance with baseline algorithms and state‐of‐the‐art methods using four benchmark datasets. The results showcase DroidXGB's impressive accuracy of 98.39%, outperforming other existing methods and significantly enhancing Android malware detection and security testing capabilities.

An efficient Android malware detection method using Borutashap algorithm

The Android operating system captures the largest global smartphone market share. However, its popularity and open-source nature have garnered the attention of cybercriminals. The landscape of Android malware has evolved significantly over time. Traditional techniques for detecting Android malware are encountering difficulties in keeping up with this evolution. Specifically, methods that rely on extracting various features from Android applications are becoming difficult to implement as high-dimensional feature sets incur huge computational overheads when employed with machine learning algorithms. Therefore, this research proposes using Bortua and BorutaShap feature selection algorithms to choose features that contribute to detecting malicious Android applications. It uses static and dynamic features of Android applications to create a detection model for verification and evaluation of the mentioned algorithms. Experimental results showed that Bortua and BorutaShap algorithms offer promising results by achieving the highest accuracy of approximately 99%.

DeepMDFC: A deep learning based android malware detection and family classification method

AbstractUnprecedented growth and prevalent adoption of the Android Operating System (OS) have triggered a substantial transformation, not only within the smartphone industry but across various categories of intelligent devices. These intelligent devices store a wealth of sensitive data, making them enticing targets for malicious individuals who create harmful Android applications to steal this data for malicious purposes. While numerous Android malware detection methods have been proposed, the exponential growth in sophisticated and malicious Android apps presents an unprecedented challenge to existing detection techniques. Some of the researchers have attempted to classify malicious Android applications into families through static analysis of applications but most of them are evaluated on applications of previous API levels. This paper introduces a novel dataset compromising of 2019 to 2021 applications and proposes a Deep Learning based Malware Detection and Family Classification method (DeepMDFC) to detect and classify emerging malicious Android applications through static analysis and deep Artificial Neural Networks. Experimental findings indicate that DeepMDFC surpasses standard machine learning algorithms, achieving accuracy rates of 99.3% and 96.7% for Android malware detection and classification, respectively, with a limited size feature set. The performance of DeepMDFC is also assessed using the benchmark dataset (DREBIN) and results showed that DeepMDFC surpasses these methods in terms of performance. Furthermore, it leverages the proposed dataset to construct a prediction model that adeptly identifies malicious Android applications from both the years 2022 and 2023. This process the potency and resilience of DeepMDFC against emerging Android applications.

Machine learning and deep learning techniques for detecting malicious android applications: An empirical analysis

The open system architecture of android makes it vulnerable to a variety of cyberattacks. Cybercriminals use android applications to intrude into the system and steal confidential data. This situation poses a threat to user privacy and integrity of the system. This paper proposes a static analysis approach to detect malicious and benign Android applications using various machine learning and deep learning algorithms. The proposed work has been validated using a bench marked dataset comprising 11,449 benign and malicious Android applications. The proposed approach applies a wrapper-based feature selection method to filter irrelevant features. The results clearly show that the deep learning algorithms of DBN and MLP outperformed machine learning algorithms in detecting malicious Android applications.

Malicious Android Application Detection Method using Machine Learning

With the increasing popularity of the Android platform, we have seen the rapid growth of malicious Android applications recently. Considering that the heavy use of applications on mobile phones such as games, emails, and social network services has become a crucial part of our daily life, we have become more vulnerable to malicious applications running on mobile devices. This paper demonstrates on the problem of detecting malicious applications in the mobile internet, which is of great importance for personal information security and privacy security. We convert the android internet malicious application detection problem to a classification problem, and utilize the SVM classifier to solve it. Finally, we conduct an experiment to test the performance of the proposed method. Experimental results that the proposed can detect android internet malicious application with higher accuracy, true positive rate, and lower false positive rate.

Android Malware Application Detection Method Based on RGB Image Features in E-Commerce

<p>In recent years, with the continuous development of Android applications, part of e-commerce business gradually promoted to the Android platform. Android malicious applications have become an important factor threatening E-Commerce security. The Android malware application detection methods based on machine learning play an important role in malware detection, and most of them construct self-defined structured features with static analysis technique. The accuracy and comprehensiveness of features are disturbed by shell and code obfuscation techniques. In the case of applications using shell and code obfuscation techniques, these techniques would lead to instability of detection result. In addition, the way of these methods, which mainly use disassembly technology to extract source data, would deteriorate the efficiency of detection. In view of such problems, we propose an android malware application detection method based on RGB image features. Our method uses RGB image visualization technology to directly transform binary files into unstructured RGB images. In the process of model training, we acquire advanced features autonomously by training the VGG16 model with RGB images. We perform a comprehensive analysis of our approach and other methods on the Android malware dataset. The results show good efficiency and the adaptability of our method.</p> <p> </p>

Security Hardened and Privacy Preserved Android Malware Detection Using Fuzzy Hash of Reverse Engineered Source Code

The risk of malware has increased drastically in recent years due to advances in the IT industry but it also increased the need for malware analysis and prevention. Hackers inject malicious code using awful applications. In this research, a framework is proposed to identify malicious Android applications based on repacked malicious code. The sensitive features of android applications are extracted using source code. These extracted features are compared with existing malware signatures to identify repacked malicious android applications. Experiments are performed using 3490 android-based malware samples belonging to 21 different malware families. A threshold value for malware categorization is defined using fuzzy logic. If the fuzzy comparison match is greater than 40%, the application is malicious. Meanwhile, if the match is greater than 10% and less than 40%, the application is suspicious otherwise benign. Furthermore, the proposed framework presents around 74% of the repacked malware compared to other similar approaches.

Android Malware Detection Method Based on Permission Complement and API Calls

The dynamic code loading mechanism of the Android system allows an application to load executable files externally at runtime. This mechanism makes the development of applications more convenient, but it also brings security issues. Applications that hide malicious behavior in the external file by dynamic code loading are becoming a new challenge for Android malware detection. To overcome this challenge, based on dynamic code loading mechanisms, three types of threat models, i.e. Model I, Model II, and Model III are defined. For the Model I type malware, its malicious behavior occurs in DexCode, so the application programming interface (API) classes were used to characterize the behavior of the DexCode file. For the Model II type and Model III type malwares whose malicious behaviors occur in an external file, the permission complement is defined to characterize the behaviors of the external file. Based on permission complement and API calls, an Android malicious application detection method is proposed, of which feature sets are constructed by improving a feature selection method. Five datasets containing 15,581 samples are used to evaluate the performance of the proposed method. The experimental results show that our detection method achieves accuracy of 99.885% on general dataset, and performes the best on all evaluation metrics on all datasets in all comparison methods.

BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem

Xiaomi is the leading company in the fitness tracking industry. Successful attacks on its fitness tracking ecosystem would result in severe consequences, including the loss of sensitive health and personal data. Despite these relevant risks, we know very little about the security mechanisms adopted by Xiaomi. In this work, we uncover them and show that they are insecure. In particular, Xiaomi protects its fitness tracking ecosystem with custom application-layer protocols spoken over insecure Bluetooth Low-Energy (BLE) connections (ignoring standard BLE security mechanisms already supported by their devices) and TLS connections. We identify severe vulnerabilities affecting such proprietary protocols, including unilateral and replayable authentication. Those issues are critical as they affect all Xiaomi trackers released since 2016 and up-to-date Xiaomi companion apps for Android and iOS. We show in practice how to exploit the identified vulnerabilities by presenting six impactful attacks. Four attacks enable to wirelessly impersonate any Xiaomi fitness tracker and companion app, man-in-the-middle (MitM) them, and eavesdrop on their communication. The other two attacks leverage a malicious Android application to remotely eavesdrop on data from a tracker and impersonate a Xiaomi fitness app. Overall, the attacks have a high impact as they can be used to exfiltrate and inject sensitive data from any Xiaomi tracker and compatible app. We propose five practical and low-overhead countermeasures to mitigate the presented vulnerabilities. Moreover, we present breakmi, a modular toolkit that we developed to automate our reverse-engineering process and attacks. breakmi understands Xiaomi application-layer proprietary protocols, reimplements Xiaomi security mechanisms, and automatically performs our attacks. We demonstrate that our toolkit can be generalized by extending it to be compatible with the Fitbit ecosystem. We will open-source breakmi.

Malicious Android Applications’ Classification using Machine Learning

Smartphones have been an integral part of everyday life for society since their development. Naturally, the popularity of these devices has brought an equal amount of malware designed specifically for these smartphone devices. The struggle to keep these devices secure and in turn the sensitive information stored on these devices from getting into the wrong hands has become an ever-evolving endeavor. With the sheer amount of malware produced coupled with the intelligent, polymorphic nature of the malicious software, it has become increasingly difficult to protect against them. In this paper, we propose a dynamic approach to classifying malicious Android applications that does not rely solely on the signatures of said applications. Instead, we analyze the Android Manifest of the dataset to classify whether an application should be considered malicious or benign.

An Android Malicious Application Detection Method with Decision Mechanism in the Operating Environment of Blockchain

Recently, security policies and behaviour detection methods have been proposed to improve the security of blockchain by many researchers. However, these methods cannot discover the source of typical behaviours, such as the malicious applications in the blockchain environment. Android application is an important part of the blockchain operating environment, and machine learning-based Android malware application detection method is significant for blockchain user security. The way of constructing features in these methods determines the performance. The single-feature mechanism, training classifiers with one type of features, cannot detect the malicious applications effectively which exhibit the typical behaviours in various forms. The multifeatures fusion mechanism, constructing mixed features from multiple types of data sources, can cover more kinds of information. However, different types of data sources will interfere with each other in the mixed features constructed by this mechanism. That limits the performance of the model. In order to improve the detection performance of Android malicious applications in complex scenarios, we propose an Android malicious application detection method which includes parallel feature processing and decision mechanism. Our method uses RGB image visualization technology to construct three types of RGB image which are utilized to train different classifiers, respectively, and a decision mechanism is designed to fuse the outputs of subclassifiers through weight analysis. This approach simultaneously extracts different types of features, which preserve application information comprehensively. Different classifiers are trained by these features to guarantee independence of each feature and classifier. On this basis, a comprehensive analysis of many methods is performed on the Android malware dataset, and the results show that our method has better efficiency and adaptability than others.

COMPARATIVE ANALYSIS OF MACHINE LEARNING ALGORITHMS FOR THE DETECTION OF ANDROID MALWARE

This paper examines the effectiveness of some machine learning algorithms in the detection of android malicious application. In order to carry out this analysis, drebin dataset of android malicious and good applications were obtained and used for the classification as described in a section of this article. The classification results show that the Cubic SVM, Quadratic SVM and ensemble Subspace KNN performed better with 99.2%, 98.7% and 98.4% accuracy with 0.0079, 0.0129 and 0.1598 error rate respectively.

SANT: Static Analysis of Native Threads for Security Vetting of Android Applications

Most of the current research on static analysis of Android applications for security vetting either work on Java source code or the Dalvik bytecode. Nevertheless, Android allows developers to use C or C++ code in their programs that is compiled into various binary architectures. Moreover, Java and the native code components (C or C++) can collaborate with each other using Java Native Interface. Recent research shows that native codes are frequently used in both benign and malicious Android applications. Most of the present Android static analysis tools avert considering native codes in their analysis and applied trivial models for their data-flow analysis. As we know only the open source JN-SAF tool has tried to solve this issue statically. However, there are still challenges like libC functions and multi-threading in native codes that we want to address in this work. We presented SANT as an extension of JN-SAF for supporting Static Analysis of Native Threads. We considered modeling libC functions in our data-flow analysis to have a more precise analysis when dealing with security vetting of native codes. We also used control flow and data dependence graphs in SANT to handle multiple concurrent threads and find implicit data-flow between them. Our experiments show that the conducted improvements outperforms JN-SAF in real-world benchmark applications.

Learning-Based Detection for Malicious Android Application Using Code Vectorization

The malicious APK (Android Application Package) makers use some techniques such as code obfuscation and code encryption to avoid existing detection methods, which poses new challenges for accurate virus detection and makes it more and more difficult to detect the malicious code. A report indicates that a new malicious app for Android is created every 10 seconds. To combat this serious malware activity, a scalable malware detection approach is needed, which can effectively and efficiently identify the malware apps. Common static detection methods often rely on Hash matching and analysis of viruses, which cannot quickly detect new malicious Android applications and their variants. In this paper, a malicious Android application detection method is proposed, which is implemented by the deep network fusion model. The hybrid model only needs to use the sample training model to achieve high accuracy in the identification of the malicious applications, which is more suitable for the detection of the new malicious Android applications than the existing methods. This method extracts the static features in the core code of the Android application by decompiling APK files, then performs code vectorization processing, and uses the deep learning network for classification and discrimination. Our experiments with a data set containing 10,170 apps show that the decisions from the hybrid model can increase the malware detection rate significantly on a real device, which verifies the superiority of this method in the detection of malicious codes.

Detecting malicious Android applications based on the network packets generated

Widespread communication by mobile devices today has promoted the use of huge amounts of information on them. Malware applications are undergoing exponential growth, directly attacking these smartphones to steal information. For this reason, we have created a methodology to analyze the network packets sent by any type of mobile applications in order to validate their behavior. In order to solve this problem, we have used supervised learning systems in an attempt to modelize the traffic communication with a set of previously labeled data. This will help to actively detect if applications installed in mobile devices could be tagged as malicious.