DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware
Refereed conference paper presented and published in conference proceedings


Times Cited
Web of Science73WOS source URL (as at 16/10/2020) Click here for the latest count
Altmetrics Information
.

Other information
AbstractSmartphones and mobile devices are rapidly becoming indispensable devices for many users. Unfortunately, they also become fertile grounds for hackers to deploy malware. There is an urgent need to have a "security analytic & forensic system" which can facilitate analysts to examine, dissect, associate and correlate large number of mobile applications. An effective analytic system needs to address the following questions: How to automatically collect and manage a high volume of mobile malware? How to analyze a zero-day suspicious application, and compare or associate it with existing malware families in the database? How to reveal similar malicious logic in various malware, and to quickly identify the new malicious code segment? In this paper, we present the design and implementation of DroidAnalytics, a signature based analytic system to automatically collect, manage, analyze and extract android malware. The system facilitates analysts to retrieve, associate and reveal malicious logics at the "opcode level". We demonstrate the efficacy of DroidAnalytics using 150,368 Android applications, and successfully determine 2,475 Android malware from 102 different families, with 327 of them being zero-day malware samples from six different families. To the best of our knowledge, this is the first reported case in showing such a large Android malware analysis/detection. The evaluation shows the DroidAnalytics is a valuable tool and is effective in analyzing malware repackaging and mutations.
All Author(s) ListZheng M, Sun MS, Lui JCS
Name of Conference12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)
Start Date of Conference16/07/2013
End Date of Conference18/07/2013
Place of ConferenceMelbourne
Country/Region of ConferenceAustralia
Detailed descriptionorganized by IEEE,
Year2013
Month1
Day1
PublisherIEEE
Pages163 - 171
eISBN978-0-7695-5022-0
ISSN2324-898X
LanguagesEnglish-United Kingdom
Web of Science Subject CategoriesComputer Science; Computer Science, Hardware & Architecture; Computer Science, Theory & Methods; Telecommunications

Last updated on 2020-16-10 at 23:57