Abstract:Existing Android malware detection methods are usually hard to simultaneously resist various obfuscation techniques. Therefore, bytecode-based code obfuscation becomes an effective means to circumvent Android malware analysis. Building obfuscation-resilient Android malware analysis methods is a challenging task, due to the fact that various obfuscation techniques have vastly different effects on code and detection features. To mitigate this problem, we propose combining multiple features that are complementary in combating code obfuscation. Accordingly, we develop an obfuscation-resilient Android malware analysis method CorDroid, based on two new features: Enhanced Sensitive Function Call Graph (E-SFCG) and Opcode-based Markov transition Matrix (OMM). The first describes sensitive function call relationships, while the second reflects transition probabilities among opcodes. Combining E-SFCG and OMM can well characterize the runtime behavior of Android apps from different perspectives, hence increasing the difficulty of misleading malware analysis through using code obfuscation to affect detection features. To evaluate CorDroid, we generate 74, 138 obfuscated samples with 14 different obfuscation techniques, and compare CorDroid with the state-of-the-art detection methods (e.g., MaMaDroid, RevealDroid and APIGraph). In terms of average F1-Score, CorDroid is 29.69% higher than MaMaDroid, 21.80% higher than APIGraph, and 9.71% higher than RevealDroid, respectively. Experiments also validate the complementarity between E-SFCG and OMM, and exhibit the high execution efficiency of CorDroid.

A Metamorphic Tool for Data Structure Obfuscation

The Research of Information Hiding Technology Based on Portable Executable File Format

Misleading Malware Similarities Analysis By Automatic Data Structure Obfuscation

Parema: an Unpacking Framework for Demystifying VM-based Android Packers.

MemCloak

Design and Implementation of the Scheme of Obfuscation Based on the Recombination of the Android Executable File

Breaking Abstractions And Unstructuring Data Structures

Obfuscation: The Hidden Malware

A Taxonomy of Obfuscating Transformations

Applications of homomorphic functions to software obfuscation

Metamorphic Malware Evolution: The Potential and Peril of Large Language Models

Protecting from Malware Obfuscation Attacks through Adversarial Risk Analysis

Metamorphic Virus Detection in Portable Executables Using Opcodes Statistical Feature

Obfuscation-Resilient Android Malware Analysis Based on Complementary Features

Mimic Security Defence Strategy Based on Software Diversity

Translingual Obfuscation

Use of Cryptography in Malware Obfuscation

Assure High Quality Code Using Refactoring and Obfuscation Techniques

A Method and Implementation of Control Flow Obfuscation Using SEH

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

Layered Obfuscation: a Taxonomy of Software Obfuscation Techniques for Layered Security.