PPREW'14 Pub Date : 2014-01-22 DOI: 10.1145/2556464.2556465

Wesley Jin, Cory F. Cohen, Jeffrey Gennari, C. Hines, S. Chaki, A. Gurfinkel, Jeffrey Havrilla, P. Narasimhan

引用次数: 37

DroidLegacy: Automated Familial Classification of Android Malware DroidLegacy: Android恶意软件的自动家族分类

PPREW'14 Pub Date : 2014-01-22 DOI: 10.1145/2556464.2556467

Luke Deshotels, Vivek Notani, Arun Lakhotia

{"title":"DroidLegacy: Automated Familial Classification of Android Malware","authors":"Luke Deshotels, Vivek Notani, Arun Lakhotia","doi":"10.1145/2556464.2556467","DOIUrl":"https://doi.org/10.1145/2556464.2556467","url":null,"abstract":"We present an automated method for extracting familial signatures for Android malware, i.e., signatures that identify malware produced by piggybacking potentially different benign applications with the same (or similar) malicious code. The APK classes that constitute malware code in a repackaged application are separated from the benign code and the Android API calls used by the malicious modules are extracted to create a signature. A piggybacked malicious app can be detected by first decomposing it into loosely coupled modules and then matching the Android API calls called by each of the modules against the signatures of the known malware families. Since the signatures are based on Android API calls, they are related to the core malware behavior, and thus are more resilient to obfuscations.\u0000 In triage, AV companies need to automatically classify large number of samples so as to optimize assignment of human analysts. They need a system that gives low false negatives even if it is at the cost of higher false positives. Keeping this goal in mind, we fine tuned our system and used standard 10 fold cross validation over a dataset of 1,052 malicious APKs and 48 benign APKs to verify our algorithm. Results show that we have 94% accuracy, 97% precision, and 93% recall when separating benign from malware. We successfully classified our entire malware dataset into 11 families with 98% accuracy, 87% precision, and 94% recall.","PeriodicalId":326045,"journal":{"name":"PPREW'14","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-01-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130930602","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 141

The GDSL toolkit: Generating Frontends for the Analysis of Machine Code GDSL工具箱:为机器代码分析生成前端

PPREW'14 Pub Date : 2014-01-22 DOI: 10.1145/2556464.2559596

A. Simon, J. Kranz

引用次数: 5

Analyzing program dependencies for malware detection 分析恶意软件检测的程序依赖关系

PPREW'14 Pub Date : 2014-01-22 DOI: 10.1145/2556464.2556470

M. Preda, Isabella Mastroeni, R. Giacobazzi

引用次数: 3

Hardware-enforced Protection against Software Reverse-Engineering based on an Instruction Set Encoding 基于指令集编码的防软件逆向工程的硬件保护

PPREW'14 Pub Date : 2014-01-22 DOI: 10.1145/2556464.2556469

J. Danger, S. Guilley, Florian Praden