Accurate Specification for Robust Detection of Malicious Behavior in Mobile Environments

摘要: The need to accurately specify and detect malicious behavior is widely known. This paper presents a novel convenient way of specifying in mobile environments by taking Android as representative platform analysis implementation. Our specification takes sequence-based approach declaratively formulating action, whereby any two consecutive security-sensitive operations are connected either control or taint flow. It also captures the invocation context an operation within app’s component type lifecycle/callback method. Additionally, exclusion that invoked from UI-related callback methods can be specified indicate action’s stealthy execution portions. We show how sufficiently expressive describe patterns commonly exhibited malware. To usefulness specification, demonstrate it derive stable distinctive existing malware, we develop static analyzer automatically check app for numerous actions written using specification. Given target uncovered behavior, associates with collection known malware families. Experiments our obfuscation-resistant associate samples their correct family accuracy 97.2 %, while retaining ability differentiate benign apps profiled families 97.6 %. These results positively lend robust detection.