Authors:
Valérie Viet Triem Tong
1
;
Aurélien Trulla
1
;
Mourad Leslous
1
and
Jean-François Lalande
2
Affiliations:
1
CentraleSupelec, France
;
2
INSA Centre Val de Loire, France
Keyword(s):
Android, Malware, System Flow Graph.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Security and Privacy in Mobile Systems
Abstract:
The detection of new Android malware is far from being a relaxing job. Indeed, each day new Android
malware appear in the market and it remains difficult to quickly identify them. Unfortunately users still pay
the lack of real efficient tools able to detect zero day malware that have no known signature. The difficulty is
that most of the existing approaches rely on static analysis coupled with the ability of malware to hide their
malicious code. Thus, we believe that it should be easier to study what malware do instead of what they
contain. In this article, we propose to unmask Android malware hidden among benign applications using the
observed information flows at the OS level. For achieving such a goal, we introduce a simple characterization
of all the accountable information flows of a standard benign application. With such a model for benign
apps, we lead some experiments evidencing that malware present some deviations from the expected normal
behavior. Experiments show
that our model recognizes most of the 3206 tested benign applications and spots
most of the tested sophisticated malware (ransomware, rootkits, bootkit).
(More)