Abstract:The focus of a large amount of research on malware detection is currently working on proposing and improving neural network structures, but with the constant updates of Android, the proposed detection methods are more like a race against time. Through the analysis of these methods, we found that the basic processes of these detection methods are roughly the same, and these methods rely on professional reverse engineering tools for malware analysis and feature extraction. These tools generally have problems such as high time-space cost consumption, difficulty in achieving concurrent analysis of a large number of Apk, and the output results are not convenient for feature extraction. Is it possible to propose a general malware detection process implementation platform that optimizes each process of existing malware detection methods while being able to efficiently extract various features on malware datasets with a large number of APK? To solve this problem, we propose an automated platform, AmandaSystem, that highly integrates the various processes of deep learning-based malware detection methods. At the same time, the problem of over privilege due to the openness of Android system and thus the problem of excessive privileges has always required the accurate construction of mapping relationships between privileges and API calls, while the current methods based on function call graphs suffer from inefficiency and low accuracy. To solve this problem, we propose a new bottom-up static analysis method based on AmandaSystem to achieve an efficient and complete tool for mapping relationships between Android permissions and API calls, PerApTool. Finally, we conducted tests on three publicly available malware datasets, CICMalAnal2017, CIC-AAGM2017, and CIC-InvesAndMal2019, to evaluate the performance of AmandaSystem in terms of time efficiency of APK parsing, space occupancy, and comprehensiveness of extracted features, respectively, compared with existing methods were compared.

HM-SAF: Cross-Layer Static Analysis Framework for HarmonyOS

NCScope: Hardware-Assisted Analyzer for Native Code in Android Apps

CiD4HMOS: A Solution to HarmonyOS Compatibility Issues

HSAS-MD Analyzer: A Hybrid Security Analysis System Using Model-Checking Technique and Deep Learning for Malware Detection in IoT Apps

JN-SAF: Precise and Efficient NDK/JNI-aware Inter-language Static Analysis Framework for Security Vetting of Android Applications with Native Code.

Demystifying Hidden Sensitive Operations in Android apps

Design of Intelligent Security Systems based on HarmonyOS

SIAT: A Systematic Inter-Component Communication Analysis Technology for Detecting Threats on Android

SymFinder: Privacy Leakage Detection using Symbolic Execution on Android Devices

User-aware Privacy Control Via Extended Static-Information-flow Analysis

Automatic Privacy Leakage Detection for Massive Android Apps Via a Novel Hybrid Approach.

Detection and Analysis of Broken Access Control Vulnerabilities in App-Cloud Interaction in IoT

AndroShield: Automated Android Applications Vulnerability Detection, a Hybrid Static and Dynamic Analysis Approach

Faster and Better: Detecting Vulnerabilities in Linux-based IoT Firmware with Optimized Reaching Definition Analysis

On the (in)security of Manufacturer-Provided Remote Attestation Frameworks in Android.

AmandaSystem: A new framework for static and dynamic Android malware analysis

Static Detection of Filesystem Vulnerabilities in Android Systems

Systematic Analysis and Detection of Misconfiguration Vulnerabilities in Android Smartphones

Exploring the Use of Static and Dynamic Analysis to Improve the Performance of the Mining Sandbox Approach for Android Malware Identification

HYBit: A Hybrid Taint Analyzing Framework for Binary Programs.

HoMonit: Monitoring Smart Home Apps from Encrypted Traffic.