![](bg6.png)
leavel app code) and dynamic (system calls in app
execution trace) analysis. The underlying assump-
tion is that obfuscating the code of an app should
leave its execution trace almost unchanged, making
a dynamic classifier robust to obfuscation, but should
change completely the sequence of opcodes deriving
from its code, making a static classifier totally inef-
fective. We experimentally validated this assumption
by applying two state-of-the-art methods to legitimate
apps, malware apps, and malware apps subjected to
8 different code morphing techniques: results show
that static analysis-based detection is essentially un-
effective on obfuscated malware. We also showed
that static detection may be made robust to obfusca-
tion by making obfuscated malware apps available for
the learning. In the future, we plan to study if and to
which degree static and dynamic detection are able to
correctly classify apps subjected to new code morph-
ing techniques, i.e., techniques for which no samples
were available in the learning phase.
ACKNOWLEDGEMENTS
This work has been partially supported by H2020
EU-funded projects NeCS and C3ISP and EIT-Digital
Project HII.
REFERENCES
Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H.,
Rieck, K., and Siemens, C. (2014). Drebin: Effec-
tive and explainable detection of android malware in
your pocket. In NDSS.
Backes, M. and Nauman, M. (2017). Luna: Quantifying
and leveraging uncertainty in android malware anal-
ysis through bayesian machine learning. In Security
and Privacy (EuroS&P), 2017 IEEE European Sym-
posium on, pages 204–217. IEEE.
Borello, J.-M. and M
´
e, L. (2008). Code obfuscation tech-
niques for metamorphic viruses. Journal in Computer
Virology, 4(3):211–220.
Canfora, G., De Lorenzo, A., Medvet, E., Mercaldo, F.,
and Visaggio, C. A. (2015a). Effectiveness of opcode
ngrams for detection of multi family android mal-
ware. In Availability, Reliability and Security (ARES),
2015 10th International Conference on, pages 333–
340. IEEE.
Canfora, G., Di Sorbo, A., Mercaldo, F., and Visag-
gio, C. A. (2015b). Obfuscation techniques against
signature-based detection: a case study. In Mobile
Systems Technologies Workshop (MST), 2015, pages
21–26. IEEE.
Canfora, G., Medvet, E., Mercaldo, F., and Visaggio, C. A.
(2015c). Detecting android malware using sequences
of system calls. In Proceedings of the 3rd Interna-
tional Workshop on Software Development Lifecycle
for Mobile, pages 13–20. ACM.
Canfora, G., Mercaldo, F., Visaggio, C. A., and Di Notte, P.
(2014). Metamorphic malware detection using code
metrics. Information Security Journal: A Global Per-
spective, 23(3):57–67.
Cimitile, A., Martinelli, F., Mercaldo, F., Nardone, V.,
and Santone, A. (2017). Formal methods meet mo-
bile code obfuscation identification of code reorder-
ing technique. In Enabling Technologies: Infrastruc-
ture for Collaborative Enterprises (WETICE), 2017
IEEE 26th International Conference on, pages 263–
268. IEEE.
Collberg, C. S., Thomborson, C. D., and Low, D. W. K.
(2003). Obfuscation techniques for enhancing soft-
ware security. US Patent 6,668,325.
Demontis, A., Melis, M., Biggio, B., Maiorca, D., Arp,
D., Rieck, K., Corona, I., Giacinto, G., and Roli, F.
(2017). Yes, machine learning can be more secure! a
case study on android malware detection. IEEE Trans-
actions on Dependable and Secure Computing.
Ferrante, A., Medvet, E., Mercaldo, F., Milosevic, J., and
Visaggio, C. A. (2016). Spotting the malicious mo-
ment: Characterizing malware behavior using dy-
namic features. In Availability, Reliability and Secu-
rity (ARES), 2016 11th International Conference on,
pages 372–381. IEEE.
Garcia, J., Hammad, M., Pedrood, B., Bagheri-Khaligh,
A., and Malek, S. (2015). Obfuscation-resilient, ef-
ficient, and accurate detection and family identifica-
tion of android malware. Department of Computer
Science, George Mason University, Tech. Rep.
Martinelli, F., Marulli, F., and Mercaldo, F. (2017). Eval-
uating convolutional neural network for effective mo-
bile malware detection. Procedia Computer Science,
112(C):2372–2381.
Medvet, E. and Mercaldo, F. (2016). Exploring the usage
of topic modeling for android malware static analy-
sis. In Availability, Reliability and Security (ARES),
2016 11th International Conference on, pages 609–
617. IEEE.
O’kane, P., Sezer, S., and McLaughlin, K. (2016). Detect-
ing obfuscated malware using reduced opcode set and
optimised runtime trace. Security Informatics, 5(1):1–
12.
Ramachandran, R., Oh, T., and Stackpole, W. (2012). An-
droid anti-virus analysis. In Annual Symposium on
Information Assurance & Secure Knowledge Manage-
ment, pages 35–40.
Rastogi, V., Chen, Y., and Jiang, X. (2013a). Droid-
chameleon: evaluating android anti-malware against
transformation attacks. In Proceedings of the 8th
ACM SIGSAC symposium on Information, computer
and communications security, pages 329–334. ACM.
Rastogi, V., Chen, Y., and Jiang, X. (2013b). Droid-
chameleon:evaluating android anti-malware against
transformation attacks. In ACM Symposium on In-
formation, Computer and Communications Security,
pages 329–334.
ICISSP 2018 - 4th International Conference on Information Systems Security and Privacy
384