DroidNative: Automating and optimizing detection of Android native code malware variants

摘要: According to the Symantec and F-Secure threat reports, mobile malware development in 2013 2014 has continued focus almost exclusively (~99%) on Android platform. Malware writers are applying stealthy mutations (obfuscations) create variants, thwarting detection by signature-based detectors. In addition, plethora of more sophisticated detectors making use static analysis techniques detect such variants operate only at bytecode level, meaning that embedded native code goes undetected. A recent study shows 86% most popular applications contain code, a plausible vector. This paper proposes DroidNative, an detector uses specific control flow patterns reduce effect obfuscations provides automation. As far as we know, DroidNative is first system builds cross-platform (x86 ARM) semantic-based signatures allowing either or code. When tested with dataset 5490 samples, achieves rate (DR) 93.57% false positive 2.7%. traditional it DR 99.48%, compared DRs academic commercial tools range from 8.33% 93.22%.