Abstract:The popularity of Android platform on mobile devices has attracted much attention from many developers and researchers, as well as malware writers. Recently, Jamrozik et al. proposed a technique to secure Android applications referred to as mining sandboxes. They used an automated test case generation technique to explore the behavior of the app under test and then extracted a set of sensitive APIs that were called. Based on the extracted sensitive APIs, they built a sandbox that can block access to APIs not used during testing. However, they only evaluated the proposed technique with benign apps but not investigated whether it was effective in detecting malicious behavior of malware that infects benign apps. Furthermore, they only investigated one test case generation tool (i.e., Droidmate) to build the sandbox, while many others have been proposed in the literature. In this work, we complement Jamrozik et al.'s work in two ways: (1) we evaluate the effectiveness of mining sandboxes on detecting malicious behaviors; (2) we investigate the effectiveness of multiple automated test case generation tools to mine sandboxes. To investigate effectiveness of mining sandboxes in detecting malicious behaviors, we make use of pairs of malware and benign app it infects. We build a sandbox based on sensitive APIs called by the benign app and check if it can identify malicious behaviors in the corresponding malware. To generate inputs to apps, we investigate five popular test case generation tools: Monkey, Droidmate, Droidbot, GUIRipper, and PUMA. We conduct two experiments to evaluate the effectiveness and efficiency of these test case generation tools on detecting malicious behavior. In the first experiment, we select 10 apps and allow test case generation tools to run for one hour; while in the second experiment, we select 102 pairs of apps and allow the test case generation tools to run for one minute. Our experiments highlight that 75.5%-77.2% of malware in our dataset can be uncovered by mining sandboxes - showing its power to protect Android apps. We also find that Droidbot performs best in generating test cases for mining sandboxes, and its effectiveness can be further boosted when coupled with other test case generation tools.

State-based Sandbox Tool for Distributed Malware Detection with Avoid Techniques

A distributed malware detection model based on sandbox technology

Mining Sandboxes: Are We There Yet?

On the Effectiveness of Binary Emulation in Malware Classification

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Agent-based Vs Agent-less Sandbox for Dynamic Behavioral Analysis

Tutorial: An Overview of Malware Detection and Evasion Techniques

POW-HOW: An enduring timing side-channel to evade online malware sandboxes

Redefining Malware Sandboxing: Enhancing Analysis Through Sysmon and ELK Integration

Malware Dynamic Analysis Evasion Techniques: A Survey

EnvFaker - A Method to Reinforce Linux Sandbox Based on Tracer, Filter and Emulator Against Environmental-Sensitive Malware.

Dynamic Emulation Based Modeling and Detection of Polymorphic Shellcode at the Network Level.

Mwsandbox: On Improving The Efficiency Of Automated Coarse-Grained Dynamic Malware Analysis

A Malware Detection Method Based on Sandbox, Binary Instrumentation and Multidimensional Feature Extraction

RealDroid: Large-Scale Evasive Malware Detection on "real Devices"

Demystifying Behavior-Based Malware Detection at Endpoints

Adversarial Malware Examples for Terminal Cyberspace Attack Analysis in Cyber-Physical Power Systems

Metamorphic Detection of Repackaged Malware

Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM

Artificial Intelligence-Based Malware Detection, Analysis, and Mitigation

Obfuscated Malware Detection: Investigating Real-world Scenarios through Memory Analysis