Monet: A User-Oriented Behavior-Based Malware Variants Detection System for Android

摘要: Android, the most popular mobile OS, has around 78% of market share. Due to its popularity, it attracts many malware attacks. In fact, people have discovered 1 million new samples per quarter, and was reported that over 98% these are in fact “ derivatives ” (or variants) from existing families. this paper, we first show runtime behaviors malware’s core functionalities similar within a family. Hence, propose framework combine behavior with static structures detect variants. We present design implementation Monet, which client backend server module. The module is lightweight, in-device app for monitoring signature generation, realize using two novel interception techniques. responsible large scale detection. collect 3723 top 500 benign apps carry out extensive experiments detecting variants defending against transformation. Our Monet can achieve 99% accuracy Furthermore, defend ten different obfuscation transformation techniques, while only incurs 7% performance overhead about 3% battery overhead. More importantly, will automatically alert users intrusion details so prevent further malicious behaviors.