Malware Writers Research Articles

VolMemDroid—Investigating android malware insights with volatile memory artifacts

Android based smartphones have become a top target for malware writers due to their widespread use. A number of malicious applications are present on play stores and downloaded on daily basis, posing a significant threat to users’ personal and business data. As a result, the design of malware analysis frameworks is crucial in protecting the growing number of users who rely on their smart phones for routine and business tasks. The traditional signature based schemes for malware detection are unable to handle new and sophisticated malware. Furthermore, generic solutions based on static analysis schemes become less effective in the presence of obfuscated malware. In this study, a dynamic analysis based framework, VolMemDroid, for detecting malicious applications for Android is proposed. The framework extracts the volatile memory artifacts for profiling malicious Android applications. For this purpose, the memory forensic framework of volatility is utilized. A number of volatility plugins are analyzed for their compatibility w.r.t the Android platform and their ability in modeling the application’s behavior. After testing a number of plugins, chosen plugins are further processed for extraction of features. A comprehensive feature set for Android malware detection and categorization is proposed. It has been found that the suggested framework is effective for detecting Android malicious applications with an F1-score of 0.972, which is better than existing volatile memory based approaches for Android malware detection. The framework is also found to be effective in categorizing malicious Android applications into four distinct classes.

Mobile based Malware Detection using Artificial Intelligence Techniques a review

Malware attacks on mobile devices are becoming more common and more complicated every year. Malware writers see the open-source Android app as their main target because so many people use it. Artificial intelligence is used by most of the literature's mobile malware detection methods to find ransomware. Our research, on the other hand, makes it clear that most of the earlier studies used different metrics and models, as well as different datasets and classification features that came from static, dynamic, or hybrid analysis strategies. This makes comparing the different suggested detection methods more difficult and may also make the results less certain. The goal of this work is to solve the problem of AI-powered malware detection by sorting current methods and approaches into three groups: the type of dataset, the type of detection method used (machine learning models, deep learning models, and Behavioral Analysis model), and how well the method works. In this way, we suggest a convergent plan that can be used as a basis for future methods of finding malware on Android and as a solid standard for artificial intelligence work in this area.

A survey of strategy-driven evasion methods for PE malware: Transformation, concealment, and attack

The continuous proliferation of malware poses a formidable threat to the cyberspace landscape. Researchers have proffered a multitude of sophisticated defense mechanisms aimed at its detection and mitigation. Nevertheless, malware writers persistently pursue pioneering and innovative methods to evade detection by security software, thereby presenting an ever-evolving and dynamic threat to computer systems. Malware evasion refers to the use of certain strategies by malware to evade the detection of security software. Despite numerous surveys on malware evasion techniques, the existing surveys were fragmented and focused on specific types of evasion methods, leading to a lack of systematic and comprehensive research on malware evasion approaches. To fill this gap, this paper proposed a strategy-driven framework from the perspective of malware writers. Based on this framework, we categorize existing evasion detection techniques into transformation (alter the structural and behavioral pattern of the malware), concealment (conceal the behavior of the malware), and attack-based (engage in an attack on the detector to render it inoperable) methods and conduct a comprehensive survey of the relevant research works. In addition, we demonstrate how to integrate existing evasion strategies in the process of generating malware from the perspective of malware writers to subvert the multiple defenses of defenders. Our investigation indicates that: 1) evasion techniques such as packer and code obfuscation remain the foremost selection for attackers, no fewer than 10 off-the-shelf tools provide great assistance to them, 2) environment analysis is the primary concealment-based strategy used by the attacker (48% of the reviewed concealment-based strategy), defenders need greater efforts to counter them, 3) only 3 works discussed techniques for evasion attacks by leveraging fragilities in antivirus engines, meaning that direct attack on the detector is no longer as effective, 4) reinforcement learning algorithm serves as the most popular adversarial attack-based methods and 50% of works based on reinforcement learning are effective against real-world antivirus engines. Furthermore, this paper delves into the development trends in evasive malware and open issues for defenders. The primary objective of this survey is to furnish researchers and practitioners with a thorough comprehension of malware evasion strategies and techniques, thereby fostering the advancement of more potent and efficient approaches to detect and thwart malware.

Algebraic Structures Induced by the Insertion and Detection of Malware

Since its introduction, researching malware has had two main goals. On the one hand, malware writers have been focused on developing software that can cause more damage to a targeted host for as long as possible. On the other hand, malware analysts have as one of their main purposes the development of tools such as malware detection systems (MDS) or network intrusion detection systems (NIDS) to prevent and detect possible threats to the informatic systems. Obfuscation techniques, such as the encryption of the virus’s code lines, have been developed to avoid their detection. In contrast, shallow machine learning and deep learning algorithms have recently been introduced to detect them. This paper is devoted to some theoretical implications derived from these investigations. We prove that hidden algebraic structures as equipped posets and their categories of representations are behind the research of some infections. Properties of these categories are given to provide a better understanding of different infection techniques.

Demystifying Hidden Sensitive Operations in Android Apps

Security of Android devices is now paramount, given their wide adoption among consumers. As researchers develop tools for statically or dynamically detecting suspicious apps, malware writers regularly update their attack mechanisms to hide malicious behavior implementation. This poses two problems to current research techniques: static analysis approaches, given their over-approximations, can report an overwhelming number of false alarms, while dynamic approaches will miss those behaviors that are hidden through evasion techniques. We propose in this work a static approach specifically targeted at highlighting hidden sensitive operations (HSOs), mainly sensitive data flows. The prototype version of HiSenDroid has been evaluated on a large-scale dataset of thousands of malware and goodware samples on which it successfully revealed anti-analysis code snippets aiming at evading detection by dynamic analysis. We further experimentally show that, with FlowDroid, some of the hidden sensitive behaviors would eventually lead to private data leaks. Those leaks would have been hard to spot either manually among the large number of false positives reported by the state-of-the-art static analyzers, or by dynamic tools. Overall, by putting the light on hidden sensitive operations, HiSenDroid helps security analysts in validating potentially sensitive data operations, which would be previously unnoticed.

LTL model checking of self modifying code

Self modifying code is code that can modify its own instructions during the execution of the program. It is extensively used by malware writers to obfuscate their malicious code. Thus, analysing self modifying code is nowadays a big challenge. In this paper, we consider the LTL model-checking problem of self modifying code. We model such programs using self-modifying pushdown systems, an extension of pushdown systems that can modify its own set of transitions during execution. We reduce the LTL model-checking problem to the emptiness problem of self-modifying Büchi pushdown systems. We implemented our techniques in a tool that we successfully applied for the detection of several self-modifying malware. Our tool was also able to detect several malwares that well-known antiviruses such as BitDefender, Kinsoft, Avira, eScan, Kaspersky, Qihoo-360, Baidu, Avast, and Symantec failed to detect.

Android Malware Detection Techniques in Traditional and Cloud Computing Platforms

In the mobile world, Android is the most popular choice of manufacturers and users alike. Meanwhile, a number of malicious applications abbreviated as malapps or malware have increased explosively. Malware writers make use of existing apps to send malware to users' devices. To check presence of malware, the authors perform malware analysis of apps. In this paper, they provide a comprehensive review on state-of-the-art android malware detection approaches using traditional and cloud computing platforms. The paper also presents attack taxonomy to better understand security threat against Android. Furthermore, it describes various possible attacking features (static and dynamic) and their analysis mechanism. Various security tools have also been discussed. It presents two case studies: one for malware feature extraction and the other for demonstrating the use of machine learning for malware analysis in order to provide a practical insight of malware analysis. The results of malware analysis seem to be promising.

Cluster-Based Antiphishing (CAP) Model for Smart Phones

Different types of connectivity are available on smartphones such as WiFi, infrared, Bluetooth, GPRS, GPS, and GSM. The ubiquitous computing features of smartphones make them a vital part of our lives. The boom in smartphone technology has unfortunately attracted hackers and crackers as well. Smartphones have become the ideal hub for malware, gray ware, and spyware writers to exploit smartphone vulnerabilities and insecure communication channels. For every security service introduced, there is simultaneously a counterattack to breach the security and vice versa. Until a new mechanism is discovered, the diverse classifications of technology mean that one security contrivance cannot be a remedy for phishing attacks in all circumstances. Therefore, a novel architecture for antiphishing is mandatory that can compensate web page protection and authentication from falsified web pages on smartphones. In this paper, we developed a cluster-based antiphishing (CAP) model, which is a lightweight scheme specifically for smartphones to save energy in portable devices. The model is significant in identifying, clustering, and preventing phishing attacks on smartphone platforms. Our CAP model detects and prevents illegal access to smartphones based on clustering data to legitimate/normal and illegitimate/abnormal. First, we evaluated our scheme with mathematical and algorithmic methods. Next, we conducted a real test bed to identify and counter phishing attacks on smartphones which provided 90% accuracy in the detection system as true positives and less than 9% of the results as true negative.

ANDROID DESIGNED MALWARE DETECTION CHALLENGES: A FUTURE RESEARCH DIRECTION

Statistically, Android is the most targeted mobile platform when it comes to malicious application. As a result, Android malware detection has become one of the sizing topics in the domain of mobile security. As the researchers focusing on developing a new approach to detect and fight Android malware, there are always a recent report exhibiting cases of Android malware. Multiple motivations cause mobile malware writers to continuously develop an application with malware. Their intentions are to gain access to the private network and to collect sensitive data. This paper categories type of mobile malware. Furthermore, the types of mobile malware that often attacks android’s users are discussed. Then, fundamental techniques usually implement to detect mobile malware are deliberated. Basic techniques such as Static, Dynamic and Hybrid analysis are explained in the section. Finally, open issues on detecting and evaluating Android designed malware presented as a guideline for future research directions.

A Comprehensive Survey on Machine Learning Techniques for Android Malware Detection

Year after year, mobile malware attacks grow in both sophistication and diffusion. As the open source Android platform continues to dominate the market, malware writers consider it as their preferred target. Almost strictly, state-of-the-art mobile malware detection solutions in the literature capitalize on machine learning to detect pieces of malware. Nevertheless, our findings clearly indicate that the majority of existing works utilize different metrics and models and employ diverse datasets and classification features stemming from disparate analysis techniques, i.e., static, dynamic, or hybrid. This complicates the cross-comparison of the various proposed detection schemes and may also raise doubts about the derived results. To address this problem, spanning a period of the last seven years, this work attempts to schematize the so far ML-powered malware detection approaches and techniques by organizing them under four axes, namely, the age of the selected dataset, the analysis type used, the employed ML techniques, and the chosen performance metrics. Moreover, based on these axes, we introduce a converging scheme which can guide future Android malware detection techniques and provide a solid baseline to machine learning practices in this field.

Taming Reflection

Android developers heavily use reflection in their apps for legitimate reasons. However, reflection is also significantly used for hiding malicious actions. Unfortunately, current state-of-the-art static analysis tools for Android are challenged by the presence of reflective calls, which they usually ignore. Thus, the results of their security analysis, e.g., for private data leaks, are incomplete, given the measures taken by malware writers to elude static detection. We propose a new instrumentation-based approach to address this issue in a non-invasive way. Specifically, we introduce to the community a prototype tool called DroidRA, which reduces the resolution of reflective calls to a composite constant propagation problem and then leverages the COAL solver to infer the values of reflection targets. After that, it automatically instruments the app to replace reflective calls with their corresponding Java calls in a traditional paradigm. Our approach augments an app so that it can be more effectively statically analyzable, including by such static analyzers that are not reflection-aware. We evaluate DroidRA on benchmark apps as well as on real-world apps, and we demonstrate that it can indeed infer the target values of reflective calls and subsequently allow state-of-the-art tools to provide more sound and complete analysis results.

Learning metamorphic malware signatures from samples

Metamorphic malware are self-modifying programs which apply semantic preserving transformations to their own code in order to foil detection systems based on signature matching. Metamorphism impacts both software security and code protection technologies: it is used by malware writers to evade detection systems based on pattern matching and by software developers for preventing malicious host attacks through software diversification. In this paper, we consider the problem of automatically extracting metamorphic signatures from the analysis of metamorphic malware variants. We define a metamorphic signature as an abstract program representation that ideally captures all the possible code variants that might be generated during the execution of a metamorphic program. For this purpose, we developed MetaSign: a tool that takes as input a collection of metamorphic code variants and produces, as output, a set of transformation rules that could have been used to generate the considered metamorphic variants. MetaSign starts from a control flow graph representation of the input variants and agglomerates them into an automaton which approximates the considered code variants. The upper approximation process is based on the concept of widening automata, while the semantic preserving transformation rules, used by the metamorphic program, can be viewed as rewriting rules and modeled as grammar productions. In this setting, the grammar recognizes the language of code variants, while the production rules model the metamorphic transformations. In particular, we formalize the language of code variants in terms of pure context-free grammars, which are similar to context-free grammars with no terminal symbols. After the widening process, we create a positive set of samples from which we extract the productions of the grammar by applying a learning grammar technique. This allows us to learn the transformation rules used by the metamorphic engine to generate the considered code variants. We validate the results of MetaSign on some case studies.

DroidClone: Attack of the android malware clones - a step towards stopping them

Code clones are frequent in use because they can be created fast with little effort and expense. Especially for malware writers, it is easier to create a clone of the original than writing a new malware. According to the recent Symantec threat reports, Android continues to be the most targeted mobile platform, and the number of new mobile malware clones grew by 54%. There is a need to develop techniques and tools to stop this attack of Android malware clones. To stop this attack, we propose DroidClone that exposes code clones (segments of code that are similar) in Android applications to help detect malware. DroidClone is the first such effort uses specific control flow patterns for reducing the effect of obfuscations and detect clones that are syntactically different but semantically similar up to a threshold. DroidClone is independent of the programming language of the code clones. When evaluated with real malware and benign Android applications, DroidClone obtained a detection rate of 94.2% and false positive rate of 5.6%. DroidClone, when tested against various obfuscations, was able to successfully provide resistance against all the trivial (Renaming methods, parameters, and nop insertion, etc) and some non-trivial (Call graph manipulation and function indirection, etc.) obfuscations.

Integrity verification and behavioral classification of a large dataset applications pertaining smart OS via blockchain and generative models

AbstractMalware analysis and detection over the Android have been the focus of considerable research, during recent years, as customer adoption of Android attracted a corresponding number of malware writers. Antivirus companies commonly rely on signatures and are error‐prone. Traditional machine learning techniques are based on static, dynamic, and hybrid analysis; however, for large scale Android malware analysis, these approaches are not feasible. Deep neural architectures are able to analyze large scale static details of the applications, but static analysis techniques can ignore many malicious behaviors of applications. The study contributes to the documentation of various approaches for detection of malware, traditional and state‐of‐the‐art models, developed for analysis that facilitates the provision of basic insights for researchers working in malware analysis, and the study also provides a dynamic approach that employs deep neural network models for detection of malware. Moreover, the study uses Android permissions as a parameter to measure the dynamic behavior of around 16,900 benign and intruded applications. A dataset is created which encompasses a large set of permissions‐based dynamic behavior pertaining applications, with an aim to train deep learning models for prediction of behavior. The proposed architecture extracts representations from input sequence data with no human intervention. The state‐of‐the‐art Deep Convolutional Generative Adversarial Network extracted deep features and accomplished a general validation accuracy of 97.08% with an F1‐score of 0.973 in correctly classifying input. Furthermore, the concept of blockchain is utilized to preserve the integrity of the dataset and the results of the analysis.

Two Anatomists Are Better than One—Dual-Level Android Malware Detection

The openness of the Android operating system and its immense penetration into the market makes it a hot target for malware writers. This work introduces Androtomist, a novel tool capable of symmetrically applying static and dynamic analysis of applications on the Android platform. Unlike similar hybrid solutions, Androtomist capitalizes on a wealth of features stemming from static analysis along with rigorous dynamic instrumentation to dissect applications and decide if they are benign or not. The focus is on anomaly detection using machine learning, but the system is able to autonomously conduct signature-based detection as well. Furthermore, Androtomist is publicly available as open source software and can be straightforwardly installed as a web application. The application itself is dual mode, that is, fully automated for the novice user and configurable for the expert one. As a proof-of-concept, we meticulously assess the detection accuracy of Androtomist against three different popular malware datasets and a handful of machine learning classifiers. We particularly concentrate on the classification performance achieved when the results of static analysis are combined with dynamic instrumentation vis-à-vis static analysis only. Our study also introduces an ensemble approach by averaging the output of all base classification models per malware instance separately, and provides a deeper insight on the most influencing features regarding the classification process. Depending on the employed dataset, for hybrid analysis, we report notably promising to excellent results in terms of the accuracy, F1, and AUC metrics.

Detecting Malware with Information Complexity.

Malware concealment is the predominant strategy for malware propagation. Black hats create variants of malware based on polymorphism and metamorphism. Malware variants, by definition, share some information. Although the concealment strategy alters this information, there are still patterns on the software. Given a zoo of labelled malware and benign-ware, we ask whether a suspect program is more similar to our malware or to our benign-ware. Normalized Compression Distance (NCD) is a generic metric that measures the shared information content of two strings. This measure opens a new front in the malware arms race, one where the countermeasures promise to be more costly for malware writers, who must now obfuscate patterns as strings qua strings, without reference to execution, in their variants. Our approach classifies disk-resident malware with 97.4% accuracy and a false positive rate of 3%. We demonstrate that its accuracy can be improved by combining NCD with the compressibility rates of executables using decision forests, paving the way for future improvements. We demonstrate that malware reported within a narrow time frame of a few days is more homogeneous than malware reported over two years, but that our method still classifies the latter with 95.2% accuracy and a 5% false positive rate. Due to its use of compression, the time and computation cost of our method is nontrivial. We show that simple approximation techniques can improve its running time by up to 63%. We compare our results to the results of applying the 59 anti-malware programs used on the VirusTotal website to our malware. Our approach outperforms each one used alone and matches that of all of them used collectively.

Android application security: detecting Android malware and evaluating anti-malware software

Mobile devices have become widespread computing technology, people prefer to use than desktop devices. These connected devices and their features like an exchange of data, video calling etc. have made our lives simple but, this has also increased data security concerns. At present, Google's Android is dominating the market share of mobile devices; as a result, it has become a big target for malware writers. Android users can download applications from official or third-party stores. Google implements various security policies to ensure secure distribution of applications but third-party application stores have less efficient or no such policies. This makes such markets more attractive for malware writers. This paper investigates Android application security by analysing 1,946 free most downloaded Android applications in the year 2016: 1,300 from Google Play Store and 646 from third-party Android applications. 100 samples from 33 different malware families (with variants) prominent in the Android market during January 2016 to April 2016 were also collected that acted as a template for malware detection. Further, based on detected malware samples, an evaluation-based study on ten anti-malware applications is performed to identify how well they protect users from malware.

Detection of Repackaged Android Malware with Code-Heterogeneity Features

During repackaging, malware writers statically inject malcode and modify the control flow to ensure its execution. Repackaged malware is difficult to detect by existing classification techniques, partly because of their behavioral similarities to benign apps. By exploring the app's internal different behaviors, we propose a new Android repackaged malware detection technique based on code heterogeneity analysis . Our solution strategically partitions the code structure of an app into multiple dependence-based regions (subsets of the code). Each region is independently classified on its behavioral features. We point out the security challenges and design choices for partitioning code structures at the class and method level graphs, and present a solution based on multiple dependence relations. We have performed experimental evaluation with over 7,542 Android apps. For repackaged malware, our partition-based detection reduces false negatives (i.e., missed detection) by 30-fold, when compared to the non-partition-based approach. Overall, our approach achieves a false negative rate of 0.35 percent and a false positive rate of 2.97 percent.

Android application security: detecting Android malware and evaluating anti-malware software

Mobile devices have become widespread computing technology, people prefer to use than desktop devices. These connected devices and their features like an exchange of data, video calling etc. have made our lives simple but, this has also increased data security concerns. At present, Google's Android is dominating the market share of mobile devices; as a result, it has become a big target for malware writers. Android users can download applications from official or third-party stores. Google implements various security policies to ensure secure distribution of applications but third-party application stores have less efficient or no such policies. This makes such markets more attractive for malware writers. This paper investigates Android application security by analysing 1,946 free most downloaded Android applications in the year 2016: 1,300 from Google Play Store and 646 from third-party Android applications. 100 samples from 33 different malware families (with variants) prominent in the Android market during January 2016 to April 2016 were also collected that acted as a template for malware detection. Further, based on detected malware samples, an evaluation-based study on ten anti-malware applications is performed to identify how well they protect users from malware.

Dynamic Malware Analysis in the Modern Era—A State of the Art Survey

Although malicious software (malware) has been around since the early days of computers, the sophistication and innovation of malware has increased over the years. In particular, the latest crop of ransomware has drawn attention to the dangers of malicious software, which can cause harm to private users as well as corporations, public services (hospitals and transportation systems), governments, and security institutions. To protect these institutions and the public from malware attacks, malicious activity must be detected as early as possible, preferably before it conducts its harmful acts. However, it is not always easy to know what to look for—especially when dealing with new and unknown malware that has never been seen. Analyzing a suspicious file by static or dynamic analysis methods can provide relevant and valuable information regarding a file's impact on the hosting system and help determine whether the file is malicious or not, based on the method's predefined rules. While various techniques (e.g., code obfuscation, dynamic code loading, encryption, and packing) can be used by malware writers to evade static analysis (including signature-based anti-virus tools), dynamic analysis is robust to these techniques and can provide greater understanding regarding the analyzed file and consequently can lead to better detection capabilities. Although dynamic analysis is more robust than static analysis, existing dynamic analysis tools and techniques are imperfect, and there is no single tool that can cover all aspects of malware behavior. The most recent comprehensive survey performed in this area was published in 2012. Since that time, the computing environment has changed dramatically with new types of malware (ransomware, cryptominers), new analysis methods (volatile memory forensics, side-channel analysis), new computing environments (cloud computing, IoT devices), new machine-learning algorithms, and more. The goal of this survey is to provide a comprehensive and up-to-date overview of existing methods used to dynamically analyze malware, which includes a description of each method, its strengths and weaknesses, and its resilience against malware evasion techniques. In addition, we include an overview of prominent studies presenting the usage of machine-learning methods to enhance dynamic malware analysis capabilities aimed at detection, classification, and categorization.