ALTERDROID:Differential fault Analysis of Obfuscated Smartphone Malware

•

0 likes•110 views

SOFTRONIICS.The best project centre in calicut.providing project guidance and assistance to mca,msc,bca,bsc.mtech,btech..etc.and also providing course and internship in java,python,php,dotnet,embedded,android..etc MD MANIKANDAN-9037291113,04954021113 softroniics@gmail.com

Education

ALTERDROID: Differential Fault Analysis of Obfuscated
Smartphone Malware
Abstract
Malware for smartphones has rocketed over the last years. Market operators face
the challenge of keeping their stores free from malicious apps, a task that has
become increasingly complex as malware developers are progressively using
advanced techniques to defeat malware detection tools. One such technique
commonly observed in recent malware samples consists of hiding and obfuscating
modules containing malicious functionality in places that static analysis tools
overlook (e.g., within data objects). In this paper, we describe ALTERDROID, a
dynamic analysis approach for detecting such hidden or obfuscated malware
components distributed as parts of an app package. The key idea in ALTERDROID
consists of analyzing the behavioral differences between the original app and a
number of automatically generated versions of it, where a number of modiﬁcations
(faults) have been carefully injected. Observable differences in terms of activities
that appear or vanish in the modiﬁed app are recorded, and the resulting
differential signature is analyzed through a pattern-matching process driven by
rules that relate different types of hidden functionalities with patterns found in the
signature. A thorough justiﬁcation and a description of the proposed model are
provided. The extensive experimental results obtained by testing ALTERDROID over
relevant apps and malware samples support the quality and viability of our
proposal
Existing system
Smartphones present a number of security and privacy concerns that are, in many
respects, even more alarming than those existing in traditional computing
environments. Most smart phone platforms are equipped with multiple sensors
that can determine user location, gestures, moves and other physical activities, to
name a few. Smartphones also feature high-quality audio and video recording

capabilities. Sensitive pieces of information that can be captured by these devices
could be easily leaked by malware residing on the smartphone. Even apparently
harmless capabilities have swiftly turned into a potential menace.
Proposed system
In this paper we describe ALTERDROID, a tool for detecting, through reverse
engineering, obfuscated functionality in components distributed as parts of an app
package. Such components are often part of a malicious app and are hidden outside
its main code components (e.g. within data objects), as code components may be
subject to static analysis by market operators. The key idea in ALTERDROID consists
of analyzing the behavioral differences between the original app and an altered
version where a number of modiﬁcations (faults) have been carefully introduced.
Such modiﬁcations are designed to have no observable effect on the app execution,
provided that the altered component is actually what it should be (i.e., it does not
hide any unwanted functionality). For example, replacing the value of some pixels
in a picture or a few characters in a string encoding an error message should not
affect the execution. However, if after doing so it is observed that a dynamic class
loading action crashes or a network connection does not take place, it may well be
that the picture was actually a piece of code or the string a network address or a
URL.

This document summarizes a study that evaluated the effectiveness of 10 popular commercial Android antimalware products against common malware transformation techniques. The researchers developed a framework called DroidChameleon that applied various obfuscation techniques to known malware samples to generate new variants. They found that none of the antimalware products were resistant to these basic transformations, and many could be trivially defeated. The researchers hope their findings will motivate the security community to improve current mobile malware detection capabilities.

Behavior-Based Security for Mobile Devices Using Machine Learning Techniques

gerogepatton

The goal of this research project is to design and implement a mobile application and machine learning techniques to solve problems related to the security of mobile devices. We introduce in this paper a behavior-based approach that can be applied in a mobile environment to capture and learn the behavior of mobile users. The proposed system was tested using Android OS and the initial experimental results show that the proposed technique is promising, and it can be used effectively to solve the problem of anomaly detection in mobile devices.

Malware Bytes – Advanced Fault Analysis

IRJET Journal

This document discusses a tool called ALTERDROID that analyzes Android applications to detect malware. ALTERDROID uses static and dynamic analysis techniques to detect obfuscated malware hidden in applications. It analyzes applications that are installed on a device to identify any malicious components. If malware is found, it asks the user for permission to uninstall the application. For unauthorized users attempting to access the device, it captures their image and sends it by email. The document compares this approach to existing static-only malware analysis techniques, which can miss hidden malicious components.

Droidcon mobile security

Judy Ngure

This document discusses the importance of mobile application security and penetration testing. It describes penetration testing as discovering vulnerabilities before attackers through vulnerability detection, comprehensive penetration attempts, and analysis/reporting. The document outlines static and dynamic analysis methods used for Android application security assessments. These include code review, function hooking, runtime debugging, and analyzing data at rest and in transit. It promotes understanding how applications work through reverse engineering, decompilation, and deobfuscation. The methodology uses tools like MARA, MobSF, Xposed, Frida, and BurpSuite.

WHAT IS APP SECURITY – THE COMPLETE PROCESS AND THE TOOLS & TESTS TO RUN IT

TekRevol LLC

IRJET - Research on Data Mining of Permission-Induced Risk for Android Devices

IRJET Journal

This document describes research on using data mining techniques to detect permission-induced risks in Android devices. It aims to develop a malware-free application using permission ranking, similarity-based feature selection, and association rule mining. These techniques are used to rank permissions and detect malware applications based on their permissions. The random forest algorithm is then applied to further increase the accuracy of malware detection. The proposed system detects malicious applications and notifies users, allowing them to block apps if desired. It analyzes app permissions to identify malware while improving on existing detection methods.

DMIA: A MALWARE DETECTION SYSTEM ON IOS PLATFORM

csandit

iOS is a popular operating system on Apple’s smartphones, and recent security events have shown the possibility of stealing the users' privacy in iOS without being detected, such as XcodeGhost. So, we present the design and implementation of a malware vetting system, called DMIA. DMIA first collects runtime information of an app and then distinguish between malicious and normal apps by a novel machine learning model. We evaluated DMIA with 1000 apps from the official App Store. The results of experiments show that DMIA is effective in detecting malwares aimed to steal privacy.

Software Birthmark Based Theft/Similarity Comparisons of JavaScript Programs

Swati Patel

A birthmark is a set of characteristic possessed by a program that uniquely recognizes a program. Birthmark of the software is based on Heap Graph. It is generated by using Google Chrome Developer Tools when the program is in execution. Software’s behavioural structure is demonstrated in the heap graph. It describes how the objects are related to each other to deliver the desired functionality of the website. Our aim is to develop and evaluate a system that can find theft/similarity between websites by using Agglomerative Clustering and Improved Frequent Subgraph Mining. To identify if a website is using the original program’s code or its module, birthmark of the original program is explored in the suspected program’s heap graph.

The document discusses detecting "certified pre-owned" software, or software containing backdoors. It describes how static analysis of software binaries can detect various types of application backdoors, including special credentials, unintended network activity, and deliberate information leakage. The document focuses on detecting indicators that software is trying to hide its behavior, such as rootkit behavior and anti-debugging techniques, through static analysis of the software code. Rules can be developed for static analyzers to inspect software for these types of backdoor behaviors and indicators.

software Testing and assurance

gk300793

Gopal Kumar presented on software quality assurance and testing done during an industrial training. The presentation covered: 1) An overview of the organization SpiceRetail Ltd and their mobile phone offerings. 2) Different types and levels of testing including manual, automation, black box, white box and functional/non-functional testing. 3) Challenges in mobile device testing like supporting different targets and operating systems. 4) A proposed interruption matrix approach to help select meaningful test cases accounting for device interruptions and states.

COVERT app

itba9

COVERT is a tool that analyzes Android applications in a compositional manner to detect security vulnerabilities that occur due to the interaction of apps. It extracts models of individual apps and the Android framework and uses the Alloy analyzer to check the models for vulnerabilities. An evaluation on over 500 real-world apps found that COVERT can effectively detect inter-app vulnerabilities in minutes and does not require source code. It was implemented with desktop, mobile, and web-based front-ends to facilitate end-user analysis of apps.

MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROID

IRJET Journal

This document discusses machine learning approaches for detecting malware in Android apps. It first classifies different types of malware like viruses, trojans, worms, spyware, adware, and ransomware. It then discusses important features for malware detection like n-grams, opcodes, strings, memory access, and API calls. The document reviews several papers on machine learning techniques for Android malware detection using methods like random forest, SVM, decision trees, and evaluating accuracy and efficiency. It proposes using ANN and SVM models to identify malicious and benign apps and providing a category-based machine learning approach to improve detection accuracy.

Avtest 2012 02-android_anti-malware_report_english

Anatoliy Tkachev

The document summarizes an evaluation of anti-malware solutions for Android. It reports that certain parts of their previous paper and testing methodology were considered flawed by vendors, so additional testing is being done. It provides details on the testing methodology used, which involved evaluating products' abilities to detect a collection of over 600 malware samples both during on-demand scans and when the samples were installed. Products were grouped into categories based on their detection rates, with the top category detecting over 90% of samples.

linkedin brainies

Vincent lefebvre

This document provides an overview of software protection objectives and techniques. The key objectives of software protection are to prevent intellectual property theft, secure business models, and prevent cyber attacks. Techniques discussed include encrypting code to prevent static analysis, anti-tampering measures to prevent code modification, and obfuscation to make reverse engineering time-consuming. The limitations are that fully preventing analysis and modification is not possible if an attacker can retrieve and execute the code. The goal is to increase costs compared to rewriting the software from scratch.

DROIDSWAN: Detecting Malicious Android Applications Based on Static Feature A...

csandit

Android being a widely used mobile platform has witnessed an increase in the number of malicious samples on its market place. The availability of multiple sources for downloading applications has also contributed to users falling prey to malicious applications. Classification of an Android application as malicious or benign remains a challenge as malicious applications maneuver to pose themselves as benign. This paper presents an approach which extracts various features from Android Application Package file (APK) using static analysis and subsequently classifies using machine learning techniques. The contribution of this work includes deriving, extracting and analyzing crucial features of Android applications that aid in efficient classification. The analysis is carried out using various machine learning algorithms with both weighted and non-weighted approaches. It was observed that weighted approach depicts higher detection rates using fewer features. Random Forest algorithm exhibited high detection rate and shows the least false positive rate.

Fraud App Detection using Machine Learning

IRJET Journal

This document proposes a system to detect fraudulent mobile apps using machine learning. It analyzes apps based on four parameters: in-app purchases, ads, user ratings, and reviews. Three machine learning models are compared: Decision Tree, Logistic Regression, and Naive Bayes. The model with the highest accuracy for predicting fraudulent apps based on these parameters will be selected. Prior research on detecting app ranking fraud and fraudulent apps using sentiment analysis is reviewed. The proposed system architecture involves collecting data on apps from the Google Play Store and using machine learning to classify apps as fraudulent or not fraudulent.

IEEE ANDROID APPLICATION 2016 TITLE AND ABSTRACT

tsysglobalsolutions

Avtest 2012 02-android_anti-malware_report_english

Daniel zhao

This document summarizes the results of testing various anti-malware solutions for Android. It tested the solutions using 618 malicious Android applications and reported the detection rates. Some solutions were able to scan the entire device storage for malware, while others could only scan installed applications and files. The testing was performed on both emulators and real Android devices to verify the results. The document analyzes the detection rates of each solution at the family level to provide more insight than just an overall detection percentage. This allows identifying weaknesses in detecting specific malware families.

Avtest 2012 02-android_anti-malware_report_english

Комсс Файквэе

The document is a test report that evaluated 41 Android anti-malware solutions and grouped them into categories based on their average detection rates of malware families. The top category detected over 90% of malware and included solutions from Avast, Dr.Web, F-Secure, Ikarus, Kaspersky, Lookout, McAfee, MYAndroid Protection, NQ Mobile, and Zoner. The next category detected between 65-90% and included solutions from 13 companies. The third category detected between 40-65% and included BluePoint, G Data, and Kinetoo. The fourth category detected less than 40% and the final category did not detect anything.

Avtest 2012 02-android_anti-malware_report_english

Комсс Файквэе

A Step-by-Step Guide on How to Scrape Data from Mobile Apps.pptx

Mobile App

IRJET- Obfuscation: Maze of Code

IRJET Journal

The document describes a proposed system called Code-a-Maze that aims to obfuscate source code through various transformations to deter software reverse engineering. Code-a-Maze works by taking source code as input and applying different obfuscation techniques depending on the path taken through an abstract "maze" represented by the code. The transformations include pointless allocation and deallocation of memory, insertion of dummy method calls, addition of bogus code and trampoline functions, flipping of conditional branches, and modification of variable and function names. The goal is to complicate the code and transfer control flow in unpredictable ways, making it difficult for attackers to analyze the code without affecting its functionality or performance.

Permission Driven Malware Detection using Machine Learning

IRJET Journal

This document summarizes research analyzing the correlation between Android application permissions and machine learning algorithms for malware detection. The research collected data on 398 applications and their 331 permission attributes. Various machine learning classification algorithms were analyzed to determine the best for detecting malware based on permissions requested. The algorithms analyzed included Naive Bayes, Ada Boost, Multi-Class Classifier, Random Tree, Random Forest, and J48. Random Forest had the highest accuracy rate of 93.2% for malware detection based on permissions. The research aims to help users identify potentially malicious applications by their requested permissions before installing them.

Review of behavior malware analysis for android

JPINFOTECH JAYAPRAKASH

This document summarizes a review of behavior-based malware analysis for Android. It discusses existing stochastic epidemic models for malware detection that are complex. The proposed system abstracts program behaviors and compares them to reference malware behaviors to detect suspicious activities. It analyzes apps, represents them as trace languages abstracted according to behavior patterns, and detects malware by comparing to a malware database. The system gets installed apps, running tasks, extracts permission information, and detects malware to help users identify potentially malicious apps.

A FRAMEWORK FOR ANALYSIS AND COMPARISON OF DYNAMIC MALWARE ANALYSIS TOOLS

IJNSA Journal

Malware writers have employed various obfuscation and polymorphism techniques to thwart static analysis approaches and bypassing antivirus tools. Dynamic analysis techniques, however, have essentially overcome these deceits by observing the actual behaviour of the code execution. In this regard, various methods, techniques and tools have been proposed. However, because of the diverse concepts and strategies used in the implementation of these methods and tools, security researchers and malware analysts find it difficult to select the required optimum tool to investigate the behaviour of a malware and to contain the associated risk for their study. Focusing on two dynamic analysis techniques: Function Call monitoring and Information Flow Tracking, this paper presents a comparison framework for dynamic malware analysis tools. The framework will assist the researchers and analysts to recognize the tool’s implementation strategy, analysis approach, system-wide analysis support and its overall handling of binaries, helping them to select a suitable and effective one for their study and analysis.

Developing secure software using Aspect oriented programming

IOSR Journals

This document discusses using aspect-oriented programming (AOP) to develop more secure software by separating security concerns from core application logic. It provides motivation for this approach by explaining how security code can become tangled and scattered in object-oriented programs. The document then introduces AOP and AspectJ, using access control as an example of how AOP can improve modularity of a cross-cutting security concern. Specifically, it describes representing access control state using a pushdown automaton updated by AOP aspects.

demystifying_the_architectures_of_a_mobile_app_development.pdf

sarah david

Adapter Wavelet Thresholding for Image Denoising Using Various Shrinkage Unde...

ALTERDROID:Differential fault Analysis of Obfuscated Smartphone Malware

Recommended

Recommended

More Related Content

Similar to ALTERDROID:Differential fault Analysis of Obfuscated Smartphone Malware

Similar to ALTERDROID:Differential fault Analysis of Obfuscated Smartphone Malware (20)

More from muhammed jassim k

More from muhammed jassim k (20)

Recently uploaded

Recently uploaded (20)

ALTERDROID:Differential fault Analysis of Obfuscated Smartphone Malware