Automated Synthesis of Semantic Malware Signatures using Maximum Satisfiability

摘要: This paper proposes a technique for automatically learning semantic malware signatures Android from very few samples of family. The key idea underlying our is to look maximally suspicious common subgraph (MSCS) that shared between all known instances An MSCS describes the functionality multiple applications in terms inter-component call relations and their metadata (e.g., data-flow properties). Our approach identifies such subgraphs by reducing problem maximum satisfiability. Once signature learned, uses combination static analysis new approximate matching algorithm determine whether an application matches characterizing given We have implemented tool called ASTROID show it has number advantages over state-of-the-art detection techniques. First, we compare synthesized with manually-written used previous work learned perform better accuracy as well precision. Second, against two tools demonstrate its interpretability accuracy. Finally, ASTROID's resistant behavioral obfuscation can be detect zero-day malware. In particular, were able find 22 Google Play are not reported existing tools.