Abstract:Today's mobile platforms provide only coarse-grained permissions to users with regard to how third-party applications use sensitive private data. Unfortunately, it is easy to disguise malware within the boundaries of legitimately-granted permissions. For instance, granting access to “contacts” and “internet” may be necessary for a text-messaging application to function, even though the user does not want contacts transmitted over the internet. To understand fine-grained application use of permissions, we need to statically analyze their behavior. Even then, malware detection faces three hurdles: (1) analyses may be prohibitively expensive, (2) automated analyses can only find behaviors that they are designed to find, and (3) the maliciousness of any given behavior is application-dependent and subject to human judgment. To remedy these issues, we propose semantic-based program analysis, with a human in the loop as an alternative approach to malware detection. In particular, our analysis allows analyst-crafted semantic predicates to search and filter analysis results. Human-oriented semantic-based program analysis can systematically, quickly and concisely characterize the behaviors of mobile applications. We describe a tool that provides analysts with a library of the semantic predicates and the ability to dynamically trade speed and precision. It also provides analysts the ability to statically inspect details of every suspicious state of (abstract) execution in order to make a ruling as to whether or not the behavior is truly malicious with respect to the intent of the application. In addition, permission and profiling reports are generated to aid analysts in identifying common malicious behaviors.

Analyzing Android Application in Real-Time at Kernel Level

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Real-Time Behavior Analysis and Identification for Android Application

Dissecting Android Malware: Characterization and Evolution

NCScope: Hardware-Assisted Analyzer for Native Code in Android Apps

Real-Time Detection of Malicious Behavior in Android Apps

Droidlogger: Reveal Suspicious Behavior of Android Applications Via Instrumentation

DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

Reviving Android Malware with DroidRide: and How Not To.

RealDroid: Large-Scale Evasive Malware Detection on "real Devices"

SEDalvik: A Kernel-Level Android Behavior Forensic Method

Dynamic Analysis Scheme of Android Malware Based on Sandbox

Detection of Malicious Behavior in Android Apps Through API Calls and Permission Uses Analysis.

Research on Method of Android System Malware Behavior Monitoring Based on Multi-level and Cross-view Analysis

Android Malicious Behavior Detection based on Reverse Engineering

AnaDroid: Malware Analysis of Android with User-supplied Predicates

Android X-Ray - A system for Malware Detection in Android apps using Dynamic Analysis

Android Malware Forensics: Reconstruction of Malicious Events

Vetting Undesirable Behaviors in Android Apps with Permission Use Analysis

Permission Use Analysis for Vetting Undesirable Behaviors in Android Apps