SherlockDroid: a research assistant to spot unknown malware in Android marketplaces

摘要: With over 1,400,000 Android applications in Google Play alone, and dozens of different marketplaces, malware unfortunately have no difficulty to sneak silently spread. Known their variants are nowadays quite well detected by anti-virus scanners. Nevertheless, the fundamentally new unknown remain an issue. To assist research teams discovery such malware, we built infrastructure, named SherlockDroid, whose goal is filter out mass only keep those which most likely be malicious for future inspection Anti-virus teams. SherlockDroid consists marketplace crawlers, code-level property extractors a classification tool Alligator decides whether sample looks or not, based on some prior learning. In our tests, extracted properties classified 480K applications. During two crawling campaigns July 2014 October 2014, crawled 120K with detection one Android/Odpa.A!tr.spy, riskware. previous findings, this increases Alligator’s “Hall Shame” 8 potentially unwanted