$\sf {DBank}$ DBank : Predictive Behavioral Analysis of Recent Android Banking Trojans

摘要: Using a novel dataset of Android banking trojans (ABTs), other malware, and goodware, we develop the $\sf {DBank}$ DBank system to predict whether given APK is trojan or not. We introduce concept Triadic Suspicion Graph (TSG for short) which contains three kinds nodes: trojans, API packages. feature space based on two classes scores derived from TSGs: suspicion (SUS) ranks (SR)—the latter yields family features that generalize PageRank. While TSG (based SUS/SR scores) provide very high predictive accuracy their own in predicting recent (2016-2017) ABTs, show combination with previously studied lightweight static dynamic literature highest distinguishing ABTs while preserving same prior combinations malware. In particular, ’s overall an not up 99.9% AUC 0.3% false positive rate. Moreover, have already reported unlabeled APKs VirusTotal (which has detected as ABTs) Google Security Team—in one case, discovered it before any 63 anti-virus products did, beat 62 anti-viruses VirusTotal. This suggests capable making new discoveries wild established vendors. also our some interesting defensive properties they are robust knowledge training set by adversary: even if adversary uses 90% exact use, difficult him infer predictions APKs. additionally identify best separate characterize goodware well Finally, detailed data-driven analysis five major ABT families: FakeToken , Svpeng Asacub BankBot Marcher them other-malware.