Abstract:The Android mobile platform is the most popular and dominates the cell phone market. With the increasing use of Android, malware developers have become active in circumventing security measures by using various obfuscation techniques. The obfuscation techniques are used to hide the malicious code in the Android applications to evade detection by anti-malware tools. Some attackers use the obfuscation techniques in isolation, while some attackers use a mixed approach (i.e., employing multiple obfuscation techniques simultaneously). Therefore, it is crucial to analyze the impact of the different obfuscation techniques, both when they are used in isolation and when they are combined as hybrid techniques. Several studies have suggested that the obfuscation techniques may be more effective when used in a mixed pattern. However, in most of the related works, the obfuscation techniques used for analysis are either based on individual or a combination of primitive obfuscation techniques. In this work, we provide a comprehensive evaluation of anti-malware tools to gauge the impact of complex hybrid code-obfuscations techniques on malware detection capabilities of the prominent anti-malware tools. The evaluation results show that the inter-category-wise hybridized code obfuscation results in more evasion as compared to the individual or simple hybridized code obfuscations (using multiple and similar code obfuscations) which most of the existing related work employed for the evaluation. Obfuscation techniques significantly impact the detection rate of any anti-malware tool. The remarkable result i.e., almost 100% best detection rate is observed for the seven out of 10 tools when analyzed using the individual obfuscation techniques, four out of 10 tools on category-wise obfuscation, and not a single anti-malware tool attained full detection (i.e., 100%) for inter-category obfuscations.

DroidChameleon

Catch Me If You Can: Evaluating Android Anti-Malware Against Transformation Attacks

Dissecting Android Malware: Characterization and Evolution

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

AirBag: Boosting Smartphone Resistance to Malware Infection.

Reviving Android Malware with DroidRide: and How Not To.

On the evaluation of android malware detectors against code-obfuscation techniques

Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

DroidMD: an Efficient and Scalable Android Malware Detection Approach at Source Code Level

The rise of obfuscated Android malware and impacts on detection methods

DroidNative: Automating and Optimizing Detection of Android Native Code Malware Variants

Obfuscation-Resilient Android Malware Analysis Based on Complementary Features

DroidNative: Semantic-Based Detection of Android Native Code Malware

Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

DeepImageDroid: A Hybrid Framework Leveraging Visual Transformers and Convolutional Neural Networks for Robust Android Malware Detection

DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

A Family of Droids -- Android Malware Detection via Behavioral Modeling: Static vs Dynamic Analysis

DroidChain: A Novel Malware Detection Method for Android Based on Behavior Chain.

Monet: A User-oriented Behavior-based Malware Variants Detection System for Android

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware.

Malware Detection in Adversarial Settings