![](bgc.png)
let us draw detailed conclusions on the false negative
rates. Conclusions on these rates can only be drawn
from the evaluation results on the verified test sets.
These results indicate a very low false negative rate,
but due to the rather small number of verified cryp-
tographic methods, more accurate false negative rates
need to be gained in real application analysis projects.
False Positives: Here, the results from all evalu-
ation scenarios can be taken into account. Due to the
manual analysis of all detected crypto methods, we
know in detail which type of method the detector is
able to identify. When using strict definitions for the
nature of cryptographic code, then methods related to
Base64 encoding or checksum calculations could be
considered as false positives. However, our experi-
ence with application analysis shows that such meth-
ods are often used in combination with real crypto-
graphic code, and unfortunately, are sometimes used
as security mechanism by developers. In that sense
such methods have not been considered as false posi-
tives. The only real false positives were related to the
implementation of mathematical operations.
Capabilities: By analyzing the gained results, we
learn more about the capabilities of the detection sys-
tem. This is especially important when analysing new
applications where no a priori knowledge is available.
Also, knowing the type of code the detector can find
simplifies the analysis of obfuscated code, where we
cannot rely on variable or method names to find out
more about the implemented functionality.
Semdroid: The evaluation shows that the archi-
tecture of Semdroid related to method filters, model
generation, instance generation etc. is flexible enough
to be quickly adapted to heterogeneous analysis pro-
cesses. Also, the deployment of the Semantic Patterns
concept enabled us to evaluate a wide range of feature
sets without the requirement to apply complex post
processing steps.
Future Work: Since the gained results are very
promising, we aim to use the crypto detection sys-
tem in upcoming application analysis projects, and –
where possible and reasonable – extend the machine
learning based detection system to other application
security aspects, such as key derivation functions or
secure communication and management facilities.
REFERENCES
Burguera, I., Zurutuza, U., and Nadjm-Tehrani, S. (2011).
Crowdroid. In Proceedings of the 1st ACM workshop
on Security and privacy in smartphones and mobile
devices - SPSM ’11, page 15, New York, New York,
USA. ACM Press.
Cortes, C. and Vapnik, V. (1995). Support-Vector Networks.
Machine Learning, 20(3):273–297.
Egele, M., Brumley, D., Fratantonio, Y., and Kruegel, C.
(2013). An empirical study of cryptographic misuse
in android applications. In Proceedings of the 2013
ACM SIGSAC conference on Computer & communi-
cations security - CCS ’13, pages 73–84, New York,
New York, USA. ACM Press.
Fahl, S., Harbach, M., Muders, T., Smith, M., Baumg¨artner,
L., and Freisleben, B. (2012). Why Eve and Mal-
lory Love Android: An Analysis of Android SSL
(In)Security. In CCS, pages 50–61. ACM.
Georgiev, M., Iyengar, S., Jana, S., Anubhai, R., Boneh, D.,
and Shmatikov, V. (2012). The most dangerous code
in the world. In Proceedings of the 2012 ACM con-
ference on Computer and communications security -
CCS ’12, page 38. ACM Press.
Ghorbanzadeh, M., Chen, Y., Ma, Z., Clancy, T. C., and
McGwier, R. (2013). A neural network approach to
category validation of Android applications. In 2013
International Conference on Computing, Networking
and Communications (ICNC), pages 740–744. IEEE.
Menezes, A. J., Oorschot, P. C. V., and Vanstone, S. A.
(1997). Handbook of Applied Cryptography, volume
106.
Percival, C. and Josefsson, S. The scrypt Password-Based
Key Derivation Function.
Provos, N. and Mazieres, D. (1999). A Future-Adaptable
Password Scheme. USENIX Annual Technical Con-
ference, . .., pages 1–12.
Schneier, B. (1996). Applied Cryptography. Electrical En-
gineering, 1([32):429–455.
Shabtai, A., Fledel, Y., and Elovici, Y. (2010). Automated
Static Code Analysis for Classifying Android Appli-
cations Using Machine Learning. In 2010 Interna-
tional Conference on Computational Intelligence and
Security, pages 329–333. IEEE.
Shabtai, A., Kanonov, U., Elovici, Y., Glezer, C., and Weiss,
Y. (2011). Andromaly: a behavioral malware detec-
tion framework for android devices. Journal of Intel-
ligent Information Systems, 38(1):161–190.
Teufl, P., Leitold, H., and Posch, R. (2013). Semantic Pat-
tern Transformation. In Proceedings of the 13th In-
ternational Conference on Knowledge Management
and Knowledge Technologies - i-Know ’13, pages 1–8,
New York, New York, USA. ACM Press.
Witten, I. H., Frank, E., and Hall, M. A. (2011). Data
Mining: Practical Machine Learning Tools and Tech-
niques, Third Edition (The Morgan Kaufmann Series
in Data Management Systems). Morgan Kaufmann.
Wu, D.-J., Mao, C.-H., Wei, T.-E., Lee, H.-M., and Wu,
K.-P. (2012). DroidMat: Android Malware Detection
through Manifest and API Calls Tracing. In 2012 Sev-
enth Asia Joint Conference on Information Security,
pages 62–69. IEEE.
Wu, T. (1998). The Secure Remote Password Protocol. In
Proceedings of the Symposium on Network and Dis-
tributed Systems Security NDSS 98, pages 97–111. In-
ternet Society.
SECRYPT2014-InternationalConferenceonSecurityandCryptography
162