Zero-CFG & Anti-CFG: Structure-Break Attacks

• Zero-CFG and Anti-CFG are evasion strategies that manipulate CFG feature extraction to bypass malware detectors while preserving original app functionality.
• They achieve evasion by repackaging APK directory structures and rewriting class references to distort Markov-chain transition statistics used in CFG-based classification.
• Empirical evaluations show tree-based classifiers suffer drastic TPR reductions under these attacks, highlighting the need for augmented, multi-feature detection methods.

Zero-CFG and Anti-CFG are targeted evasion strategies that manipulate the control-flow graph (CFG) feature abstraction used in Android malware detectors such as MaMaDroid. Both belong to the Structure-Break (StB) family of attacks, in which the adversary systematically repackages an APK’s directory tree and rewrites class references. The objective is to subvert family-level Markov-chain transition statistics that underpin CFG-based classification, causing malicious applications to be misclassified as benign without altering underlying application logic or API invocation behavior (Berger et al., 2022).

1. Definitions and Core Strategies

Zero-CFG, formally Black-Hole Statistical StB, aims to force as many transition features as possible into feature vector buckets associated with “unused” API families—bins largely unoccupied by benign samples—so that malicious samples appear “empty.” This is accomplished with only gray-box access: the attacker requires statistics over available malicious test samples to select least-used API families as black holes.

Anti-CFG, formally Full-Statistical StB, restructures the malicious application’s classes under API families that are heavily represented in benign training data—the “most benign” transitions. The attacker, with white-box knowledge of both benign and malicious Markov statistics from the training set, anti-aligns the malicious CFG profile to mimic the benign class.

Both attacks operate by repackaging sizable fractions of the .smali directory tree, renaming directories by prefixing them with an attacker-chosen family label, and rewriting all internal references (in manifest, layouts, and smali code) so that functionality is preserved though apparent CFG connectivity is drastically altered.

2. General Structure-Break Algorithm

The Structure-Break (StB) attack provides a general template for both Zero-CFG and Anti-CFG. The attacker selects parameters:

• The family label $f$ (“mode element”) for prefixing,
• Directory tree depth $L$ to operate at,
• Fraction $P$ of subdirectories at level $L$ to manipulate.

The high-level workflow:

1. Decompile the APK to extract manifest, smali directory tree, and layouts.
2. Determine tree depth and select manipulation level $L$ and fraction $P$.
3. Choose $f$ as per attack variant (statistical black hole or benign-dominated family).
4. Reparent targeted directory subtrees under $f$ and rewrite all relevant references.
5. Reassemble the APK with its function and logic intact, but with the altered structure reflected in Markov family transitions.

For Zero-CFG, $L = 0$ (entire tree), $P = 1$, $L$0 is the rarest family by malicious transition statistics. For Anti-CFG, $L$1, $L$2, $L$3 is the most “benign” family by training statistics (Berger et al., 2022).

3. CFG Feature Model and Statistical Formulation

MaMaDroid’s feature extraction maps an APK to a Markov-chain over API families: the feature vector consists of all transition probabilities $L$4, where $L$5 and $L$6 are family indices and

$L$7

This $L$8 matrix (flattened to a vector) feeds into machine learning classifiers.

Attack impact metrics include:

• True-Positive Rate (TPR)/Evasion Robustness (ER): $L$9, quantifying detection drop.
• Defense Reciprocal Rate (DRR): $P$0, assessing model confidence in the correct class.
• Model Reliability: $P$1, where high Shannon entropy indicates less decisive model outputs (Berger et al., 2022).

4. Mapping of Attack Variants to Zero-CFG and Anti-CFG

Zero-CFG (Black-Hole Statistical StB) manipulates feature vectors by forcing transitions into bins corresponding to rarely used families, making the app resemble benign samples with little activity in dominant features. In this variant, the attacker only requires knowledge of the malicious test set.

Anti-CFG (Full-Statistical StB) chooses families most typical of benign apps, achieving maximal anti-alignment to the malicious class by repackaging under these dominant benign family prefixes. This requires full knowledge of benign and malicious family-wise transition matrices from training.

Both approaches comprehensively restructure the smali tree and remap all references, with distinct selection logic for $P$2 depending on the statistical goal. The transformations produce functionally equivalent apps but fundamentally alter the input to any Markov-family-based CFG feature extractor.

5. Empirical Performance on CFG-Based Models

Six models were evaluated: 1-NN, 3-NN, 5-NN, Random Forest, Decision Tree, AdaBoost, all trained on MaMaDroid family-mode features across various benign:malicious ratios. Attacks were executed using both Zero-CFG and Anti-CFG techniques.

Findings for a 90% benign ratio:

• Decision Tree: Baseline TPR ≈ 90%; drops to 5% (Anti-CFG), 3% (Zero-CFG)
• AdaBoost: 80% → 10% → 5%
• Random Forest: 75% → 12% → 8%
• K-NN (1-, 3-, 5-NN): smaller drops; e.g., 60% → 58% → 55% (1-NN)

Model	Baseline TPR	Anti-CFG TPR	Zero-CFG TPR
1-NN	60%	58%	55%
3-NN	55%	53%	50%
5-NN	45%	43%	40%
Random Forest	75%	12%	8%
AdaBoost	80%	10%	5%
Decision Tree	90%	5%	3%

DRR and Reliability mirrored these trends: tree-based models lost all confidence post-attack, while K-NN remained approximately as unreliable as before manipulation (Berger et al., 2022).

6. Attack Strengths, Limitations, and Defenses

Strengths:

• No modification of core logic, API calls, or functionality.
• Transparent to repackaging and emulation; dynamic analysis is not subverted.
• Requires only directory restructuring and textual reference replacement; no code instrumentation.

Limitations:

• Requires access to full smali tree and associated repackaging infrastructure.
• Structural anomalies (e.g., duplicate family prefixes in directory tree) can serve as fingerprints for detection.
• Black-Hole (Zero-CFG) requires only test-set knowledge, making it broadly applicable; slight reduction in effectiveness compared to Anti-CFG in some splits.

Mitigations:

1. Feature fusion: Combining CFG transitions with static app features (e.g., permissions) as in MaMaDroid 2.0 restores detection to ≳90% post-attack.
2. Structural sanity: Detection of duplicate family roots or abnormal prefix distributions flags suspect APKs.
3. Randomized/adversarial training: Injecting benign-style reparenting into training data hardens models against Structure-Break variants (Berger et al., 2022).

Purely CFG-based detectors (e.g., MaMaDroid, DaDiDroid, CDGDroid) are empirically vulnerable, with tree-based models particularly susceptible due to their reliance on discrete feature splits over edge transitions.

7. Significance and Implications

Zero-CFG and Anti-CFG represent two extremal points in Structure-Break attack design: vacating commonly used transition bins versus maximally populating those used by benign applications. Both demonstrate that defences relying solely on CFG-derived Markov statistics are fundamentally subvertible through inexpensive structural repackaging, achieving evasion rates that reduce detection on tree-based classifiers toward zero. Comprehensive defense necessitates either feature-set augmentation with orthogonal signal or direct checking of directory structure for manipulation artifacts (Berger et al., 2022).