Abstract:Smartphones and mobile devices are rapidly becoming indispensable devices for many users. Unfortunately, they also become fertile grounds for hackers to deploy malware and to spread virus. There is an urgent need to have a "security analytic & forensic system" which can facilitate analysts to examine, dissect, associate and correlate large number of mobile applications. An effective analytic system needs to address the following questions: How to automatically collect and manage a high volume of mobile malware? How to analyze a zero-day suspicious application, and compare or associate it with existing malware families in the database? How to perform information retrieval so to reveal similar malicious logic with existing malware, and to quickly identify the new malicious code segment? In this paper, we present the design and implementation of DroidAnalytics, a signature based analytic system to automatically collect, manage, analyze and extract android malware. The system facilitates analysts to retrieve, associate and reveal malicious logics at the "opcode level". We demonstrate the efficacy of DroidAnalytics using 150,368 Android applications, and successfully determine 2,494 Android malware from 102 different families, with 342 of them being zero-day malware samples from six different families. To the best of our knowledge, this is the first reported case in showing such a large Android malware analysis/detection. The evaluation shows the DroidAnalytics is a valuable tool and is effective in analyzing malware repackaging and mutations.

Malicious Code Detection for Android Using Instruction Signatures

LSTM Android Malicious Behavior Analysis Based on Feature Weighting

Learning-Based Detection for Malicious Android Application Using Code Vectorization

Malicious code detection in android: the role of sequence characteristics and disassembling methods

Droidetec: Android Malware Detection and Malicious Code Localization through Deep Learning

A Dynamic and Static Combined Android Malicious Code Detection Model Based on SVM.

Hybrid Dynamic Analysis for Android Malware Protected by Anti-Analysis Techniques with DOOLDA

DroidMD: an Efficient and Scalable Android Malware Detection Approach at Source Code Level

Study on the Application of Dalvik Injection Technique for the Detection of Malicious Programs in Android

An Android Mutation Malware Detection Based on Deep Learning Using Visualization of Importance from Codes

Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

Automatic Feature Extraction, Categorization and Detection of Malicious Code in Android Applications

Android X-Ray - A system for Malware Detection in Android apps using Dynamic Analysis

DexLego: Reassembleable Bytecode Extraction for Aiding Static Analysis

DCDroid: An APK Static Identification Method Based on Naïve Bayes Classifier and Dual‐Centrality Analysis

Security Analysis for Android Applications Using Sensitive Path Identification

Reviving Android Malware with DroidRide: and How Not To.

DL-Droid: Deep learning based android malware detection using real devices

DATDroid: Dynamic Analysis Technique in Android Malware Detection