Revisiting the Description-to-Behavior Fidelity in Android Applications

摘要: Since more than 96% of mobile malware targets on Android platform, various techniques based static code analysis or dynamic behavior have been proposed to detect malicious applications. As is becoming complicated and stealthy, recent research a promising detection approach that looks for the inconsistency between an application's permissions its description. In this paper, we revisit find using description permission will lead many false positives. Therefore, propose employing app's privacy policy bytecode enhance detection. It non-trivial automatically analyze perform cross-verification among these four kinds software artifacts including, policy, bytecode, description, permissions. We novel data flow model analyzing develop system, named TAPVerifier, carrying out investigation individual conducting cross-verification. The experimental results show TAPVerifier can with high accuracy recall rate. More importantly, integrating level information removes 8.1%-65.5% positives existing systems permission.