Overlay-Based Android Malware Detection at Market Scales: Systematically Adapting to the New Technological Landscape
Liangyi Gong,Zhenhua Li,Hongyi Wang,Hao Lin,Xiaobo Ma,Yunhao Liu
DOI: https://doi.org/10.1109/TMC.2021.3079433
IF: 6.075
2022-01-01
IEEE Transactions on Mobile Computing
Abstract:Android overlay enables one app to draw over other apps by creating an extra view layer atop the host view, which nevertheless can be exploited by malicious apps (malware) to attack users. To combat this threat, prior countermeasures concentrate on restricting the capabilities of overlays at the OS level while sacrificing overlays' usability; recently, the overlay mechanism has been substantially updated to prevent a variety of attacks, which however can still be evaded by considerable adversaries. To address these shortcomings, a more pragmatic approach is to enable early detection of overlay-based malware during the app market review process, so that all the capabilities of overlays can stay unchanged. For this purpose, in this paper we first conduct a large-scale comparative study of overlay characteristics in benign and malicious apps, and then implement the OverlayChecker system to automatically detect overlay-based malware for one of the world's largest Android app stores. In particular, we have made systematic efforts in feature engineering, UI exploration, emulation architecture, and run-time environment, thus maintaining high detection accuracy (97 percent precision and 97 percent recall) and short per-app scan time (similar to 1.7 minutes) with only two commodity servers, under an intensive workload of similar to 10K newly submitted apps per day.