DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware (1302.7212v4)

Abstract: Smartphones and mobile devices are rapidly becoming indispensable devices for many users. Unfortunately, they also become fertile grounds for hackers to deploy malware and to spread virus. There is an urgent need to have a "security analytic & forensic system" which can facilitate analysts to examine, dissect, associate and correlate large number of mobile applications. An effective analytic system needs to address the following questions: How to automatically collect and manage a high volume of mobile malware? How to analyze a zero-day suspicious application, and compare or associate it with existing malware families in the database? How to perform information retrieval so to reveal similar malicious logic with existing malware, and to quickly identify the new malicious code segment? In this paper, we present the design and implementation of DroidAnalytics, a signature based analytic system to automatically collect, manage, analyze and extract android malware. The system facilitates analysts to retrieve, associate and reveal malicious logics at the "opcode level". We demonstrate the efficacy of DroidAnalytics using 150,368 Android applications, and successfully determine 2,494 Android malware from 102 different families, with 342 of them being zero-day malware samples from six different families. To the best of our knowledge, this is the first reported case in showing such a large Android malware analysis/detection. The evaluation shows the DroidAnalytics is a valuable tool and is effective in analyzing malware repackaging and mutations.

• The paper introduces DroidAnalytics, a novel system to automatically collect and analyze Android malware samples using an opcode-level signature approach.
• Its multi-tiered signature generation effectively detects repackaged and zero-day malware, validated on a dataset of over 150,000 applications.
• The system’s class and method-level association enhances tracking of malware families and informs scalable cybersecurity strategies.

DroidAnalytics: A Comprehensive Analytic System for Android Malware

The paper "DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware," presents a novel system designed to address the challenges of detecting and analyzing Android malware. Given the pervasive use of mobile devices, specifically those running the Android operating system, there is an increasing need to develop robust methodologies to manage and mitigate security threats posed by malicious software. This paper introduces DroidAnalytics, an automated analytic system that leverages signature-based methodologies to effectively identify and analyze malware, providing a detailed exploration of its design, implementation, and experimental validation.

Overview of DroidAnalytics

The system is designed to address several key challenges:

1. Automated Malware Collection and Management: DroidAnalytics employs a flexible crawler to automatically gather samples from various sources such as official and third-party marketplaces, forums, and blogs. This capability allows for continuous updating of the malware database, which is a pivotal resource in malware research and analysis.
2. Signature-Based Analysis: The core of DroidAnalytics is its innovative multi-level signature generation approach. Unlike traditional cryptographic hash-based signatures, this system focuses on deriving signatures from the opcode level of Android applications. By mapping the sequences of Android API calls, DroidAnalytics generates a three-tiered signature system that provides detailed insights into the application's structure and behavior, aiding in the identification of repackaged applications and code obfuscation techniques used by malware developers.
3. Malware Detection and Analysis: The system can detect zero-day repackaged malware through a clustering approach that considers application similarity at the opcode level. DroidAnalytics has demonstrated its effectiveness by analyzing a substantial dataset of 150,368 Android applications, identifying 2,494 malware samples spanning 102 families, including 342 zero-day samples.
4. Systematic Malware Association: DroidAnalytics introduces a novel analytic capability through class and method-level association, enabling security analysts to uncover associations and commonalities between different applications, assisting in understanding the evolution and functional characteristics of malware families.

Numerical Results and Findings

DroidAnalytics has been empirically validated through extensive experiments. A significant outcome is its ability to process large datasets and generate accurate malware signatures that withstand evasion techniques like repackaging and code obfuscation. This capability is evidenced by the system's identification of the largest reported case of Android malware families to date. The paper highlights the system's comprehensiveness by showcasing the detailed analysis and commonality detection across diverse malware samples.

Implications and Future Work

DroidAnalytics provides a robust framework with implications for both practical and theoretical advancements in cybersecurity. Practically, it offers a refined tool for security analysts and researchers, enhancing the ability to systematically track, analyze and address the rapidly evolving Android malware landscape. Theoretically, the system's novel signature generation and similarity measurement processes invite further investigation into opcode-level analysis methods. Future developments could focus on enhancing the system's scalability and integration with other contemporary analytic frameworks to broaden its applicability and efficiency in real-world scenarios.

Conclusion

The contribution of this paper lies in its development of DroidAnalytics, a versatile malware analytic system tailored for the Android ecosystem. By integrating automatic malware collection with signature-based detection and association capabilities, it presents an effective solution to current challenges in mobile security. As the Android platform remains a prime target for malicious actors, tools like DroidAnalytics are imperative for advancing our capability to safeguard mobile infrastructures against ever-evolving threats.