StaDART: Addressing the problem of dynamic code updates in the security analysis of android applications
| Autor: | Bruno Crispo, Valerio Costamagna, Francesco Bergadano, Maqsood Ahmad, Yury Zhauniarovich |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
Security analysis
Computer science 05 social sciences Dynamic code updates Reflection 020207 software engineering Static program analysis 02 engineering and technology Android Dynamic code updates Reflection Dynamic class loading Security analysis computer.software_genre Hooking Android Hardware and Architecture 0502 economics and business 0202 electrical engineering electronic engineering information engineering Operating system Malware Android (operating system) computer Dynamic class loading 050203 business & management Software Information Systems |
| Zdroj: | Journal of Systems and Software. 159:110386 |
| ISSN: | 0164-1212 |
| DOI: | 10.1016/j.jss.2019.07.088 |
| Popis: | Dynamic code update techniques ( Android Studio – support for dynamic delivery ), such as dynamic class loading and reflection, enable Android apps to extend their functionality at runtime. At the same time, these techniques are misused by malware developers to transform a seemingly benign app into a malware, once installed on a real device. Among the corpus of evasive techniques used in modern real-world malware, evasive usage of dynamic code updates plays a key role. First, we demonstrate the ineffectiveness of existing tools to analyze apps in the presence of dynamic code updates using our test apps, i.e., Reflection-Bench and InboxArchiver. Second, we present StaDART, combining static and dynamic analysis of Android apps to reveal the concealed behavior of malware. StaDART performs dynamic code interposition using a vtable tampering technique for API hooking to avoid modifications to the Android framework. Furthermore, we integrate it with a triggering solution, DroidBot, to make it more scalable and fully automated. We present our evaluation results with a dataset of 2000 real world apps; containing 1000 legitimate apps and 1000 malware samples. The evaluation results with this dataset and Reflection-Bench show that StaDART reveals suspicious behavior that is otherwise hidden to static analysis tools. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full Text from ScienceDirect