Abstract:Today's mobile platforms provide only coarse-grained permissions to users with regard to how third-party applications use sensitive private data. Unfortunately, it is easy to disguise malware within the boundaries of legitimately-granted permissions. For instance, granting access to “contacts” and “internet” may be necessary for a text-messaging application to function, even though the user does not want contacts transmitted over the internet. To understand fine-grained application use of permissions, we need to statically analyze their behavior. Even then, malware detection faces three hurdles: (1) analyses may be prohibitively expensive, (2) automated analyses can only find behaviors that they are designed to find, and (3) the maliciousness of any given behavior is application-dependent and subject to human judgment. To remedy these issues, we propose semantic-based program analysis, with a human in the loop as an alternative approach to malware detection. In particular, our analysis allows analyst-crafted semantic predicates to search and filter analysis results. Human-oriented semantic-based program analysis can systematically, quickly and concisely characterize the behaviors of mobile applications. We describe a tool that provides analysts with a library of the semantic predicates and the ability to dynamically trade speed and precision. It also provides analysts the ability to statically inspect details of every suspicious state of (abstract) execution in order to make a ruling as to whether or not the behavior is truly malicious with respect to the intent of the application. In addition, permission and profiling reports are generated to aid analysts in identifying common malicious behaviors.

Droidlogger: Reveal Suspicious Behavior of Android Applications Via Instrumentation

Analyzing Android Application in Real-Time at Kernel Level

Reviving Android Malware with DroidRide: and How Not To.

Dissecting Android Malware: Characterization and Evolution

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

Real-Time Behavior Analysis and Identification for Android Application

DynaLog: An automated dynamic analysis framework for characterizing Android applications

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware.

DroidNative: Semantic-Based Detection of Android Native Code Malware

DroidNative: Automating and Optimizing Detection of Android Native Code Malware Variants

Study on the Application of Dalvik Injection Technique for the Detection of Malicious Programs in Android

Hybrid Dynamic Analysis for Android Malware Protected by Anti-Analysis Techniques with DOOLDA

DroidMark: A Tool for Android Malware Detection using Taint Analysis and Bayesian Network

DroidMD: an Efficient and Scalable Android Malware Detection Approach at Source Code Level

DroidDissector: A Static and Dynamic Analysis Tool for Android Malware Detection

An Android Behavior-Based Malware Detection Method Using Machine Learning

LSTM Android Malicious Behavior Analysis Based on Feature Weighting

AnaDroid: Malware Analysis of Android with User-supplied Predicates

Droidetec: Android Malware Detection and Malicious Code Localization through Deep Learning