Reducing the window of opportunity for Android malware Gotta catch 'em all

摘要: Spotting malicious samples in the wild has always been difficult, and Android malware is no exception. Actually, fact applications are (usually) not directly accessible from market places hardens task even more. For instance, Google enforces its own communication protocol to browse download market. Thus, an efficient crawler must reverse implement this protocol, issue appropriate search requests take necessary steps so as be banned. From end-users' side, having difficulties spotting mobile results most remaining unnoticed up 3 months before a security researcher finally stumbles on it. To reduce window of opportunity, paper presents heuristics engine that statically pre-processes prioritizes samples. The uses 39 different flags nature such Java API calls, presence embedded executables, code size, URLs? Each flag assigned weight, based statistics we computed techniques authors commonly use their code. outputs risk score which highlights likely malicious. tested over set clean ones. show strong difference average for both sets distribution, proving spot malware.