DroidLegacy: Automated familial classification of Android malware

Proceedings of the 3rd ACM SIGPLAN Program Protection and Reverse Engineering Workshop 2014, PPREW 2014

Volumn , Issue , 2014, Pages

  Deshotels, Luke ^a   Notani, Vivek ^a   Lakhotia, Arun ^a  

^a UNIVERSITY OF LOUISIANA AT LAFAYETTE   (United States)

Author keywords

Android malware; Class dependence graphs; Familial classification; Malware detection; Module generation; Piggybacked malware; Signature generation; Static analysis

Indexed keywords

ANDROID (OPERATING SYSTEM); APPLICATION PROGRAMMING INTERFACES (API); CODES (SYMBOLS); MOBILE SECURITY; STATIC ANALYSIS;

ANDROID MALWARE; API CALLS; CLASS DEPENDENCE GRAPH; DEPENDENCE GRAPHS; FAMILIAL CLASSIFICATION; MALWARE DETECTION; MALWARES; MODULE GENERATION; PIGGYBACKED MALWARE; SIGNATURE GENERATION;

ANDROID MALWARE;

EID: 84893970618     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2556464.2556467     Document Type: Conference Paper

References (34)

1. Android statistics, 2013. URL http://www.appbrain.com/stats/number-of- android-apps.
2. How many apps are in each app store?, 2013. URL http://www. pureoxygenmobile.com/how-many-apps-in-each-app-store/.
3. ndInternational Conference on, pages 608-616. IEEE, 2012.
4. N. Anquetil, C. Fourrier, and T. C. Lethbridge. Experiments with clustering as a software remodularization method. In WCRE'99: Proceedings of the Sixth Working Conference on Reverse Engineering (Washington, DC, USA), IEEE Computer Society, page 235, 1999.
5. M. Ballano. Android malware, Oct. 2012. URL http://www.itu.int/ITU-D/eur/ rf/cybersecurity/presentations/symantec-itu\-mobile.pdf.
6. thInternational Conference on, pages 66-72. IEEE, 2011.
7. C. Blichmann. Vxclass - clustering malwares, generating signatures, 2010. URL http://www.zynamics.com/downloads/inbot10-vxclass.pdf.
8. E. Burd and J. Bailey. Evaluating clone detection tools for use during preventative maintenance. In Source Code Analysis and Manipulation, 2002. Proceedings. Second IEEE International Workshop on, pages 36-43. IEEE, 2002.
9. P. Burman. A comparative study of ordinary cross-validation, v-fold cross-validation and the repeated learning-testing methods. Biometrika, 76(3):503-514, 1989.
10. S. Burrows, S. M. Tahaghoghi, and J. Zobel. Efficient plagiarism detection for large code repositories. Software: Practice and Experience, 37(2):151-175, 2007.
11. S. Chakradeo, B. Reaves, P. Traynor, and W. Enck. Mast: Triage for market-scale mobile malware analysis. In Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks, pages 13-24. ACM, 2013.
12. M. Christodorescu, S. Jha, S. A. Seshia, D. Song, and R. E. Bryant. Semantics-aware malware detection. In Security and Privacy, 2005 IEEE Symposium on, pages 32-46. IEEE, 2005.
13. F. Cohen. Computer viruses: Theory and experiments. Computers & security, 6(1):22-35, 1987.
14. J. Crussell, C. Gibler, and H. Chen. Attack of the clones: Detecting cloned applications on android markets. In Computer Security- ESORICS 2012, pages 37-54. Springer, 2012.
15. A. Desnos and G. Gueguen. Android: From reversing to decompilation. Proc. of Black Hat Abu Dhabi, 2011. URL http://code.google.com/p/androguard/.
16. K. O. Elish, D. D. Yao, and B. G. Ryder. User-centric dependence analysis for identifying malicious mobile apps. MOST 2012: MOBILE SECURITY TECHNOLOGIES 2012, 2012.
17. A. Jain and R. Dubes. Algorithms for clustering data. Prentice- Hall Advanced Reference Series. Prentice Hall PTR, 1988. ISBN 9780130222787. URL http://books.google.com/books?id=7eBQAAAAMAAJ.
18. J. Kinable and O. Kostakis. Malware classification based on call graph clustering. Journal in Computer Virology, 7(4):233-245, 2011.
19. thInternational Workshop on, pages 45-52. IEEE, 1998.
20. C. D. Manning, P. Raghavan, and H. Schütze. Introduction to information retrieval, volume 1. Cambridge University Press Cambridge, 2008.
21. rdVirus Bulletin International Conference. Virus Bulletin, Oct. 2013.
22. C. K. Roy, J. R. Cordy, and R. Koschke. Comparison and evaluation of code clone detection techniques and tools: A qualitative approach. Science of Computer Programming, 74(7):470-495, 2009.
23. P. Schulz. Code protection in android. Technical report, University of Bonn, 2012. URL http://net.cs.uni-bonn.de/fileadmin/user\-upload/plohmann/2012- Schulz-Code\-Protection\-in\-Android.pdf.
24. A. Shabtai, Y. Fledel, U. Kanonov, Y. Elovici, S. Dolev, and C. Glezer. Google android: A comprehensive security assessment. IEEE Security Privacy, 8(2):35-44, 2010. ISSN 1540-7993. .
25. T. Vidas, D. Votipka, and N. Christin. All your droid are belong to us: A survey of current android attacks. In Proceedings of the 5th USENIX conference on Offensive technologies, page 1019, San Francisco, CA, 2011. USENIX Association.
26. A. Walenstein and A. Lakhotia. The software similarity problem in malware analysis. In R. Koschke, E. Merlo, and A. Walenstein, editors, Duplication, Redundancy, and Similarity in Software, number 06301 in Dagstuhl Seminar Proceedings, 2007.
27. A.Walenstein, A. Lakhotia, and R. Koschke. The second international workshop on detection of software clones: Workshop report. ACM SIGSOFT Software Engineering Notes, 29(2):1-5, 2004.
28. R. Winiewski and C. Tumbleson. android-apktool - A tool for reverse engineering android APK files, 2013. URL https://code.google.com/p/android- apktool/.
29. D.-J. Wu, C.-H. Mao, T.-E. Wei, H.-M. Lee, and K.-P. Wu. Droidmat: Android malware detection through manifest and api calls tracing. In Information Security (Asia JCIS), 2012 Seventh Asia Joint Conference on, pages 62-69. IEEE, 2012.
30. thACM SIGKDD international conference on Knowledge discovery and data mining, KDD '07, pages 1043-1047, New York, NY, USA, 2007. ACM. ISBN 978-1-59593- 609-7. .
31. P. N. Yianilos. Data structures and algorithms for nearest neighbor search in general metric spaces. In Proceedings of the fourth annual ACM-SIAM Symposium on Discrete algorithms, pages 311-321. Society for Industrial and Applied Mathematics, 1993.
32. thIEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 13), Melbourne, Australia, July 2013., 2013.
33. W. Zhou, Y. Zhou, M. Grace, X. Jiang, and S. Zou. Fast, scalable detection of piggybacked mobile applications. In Proceedings of the third ACM conference on Data and application security and privacy, page 185196, 2013.
34. Y. Zhou and X. Jiang. Dissecting android malware: Characterization and evolution. In Security and Privacy (SP), 2012 IEEE Symposium on, page 95109, 2012.