liu.seSearch for publications in DiVA
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Studying the effectiveness of dynamic analysis for fingerprinting Android malware behavior
Linköpings universitet, Institutionen för datavetenskap, Databas och informationsteknik.
2019 (engelsk)Independent thesis Advanced level (degree of Master (Two Years)), 20 poäng / 30 hpOppgaveAlternativ tittel
En studie av effektivitet hos dynamisk analys för kartläggning av beteenden hos Android malware (svensk)
Abstract [en]

Android is the second most targeted operating system for malware authors and to counter the development of Android malware, more knowledge about their behavior is needed. There are mainly two approaches to analyze Android malware, namely static and dynamic analysis. Recently in 2017, a study and well labeled dataset, named AMD (Android Malware Dataset), consisting of over 24,000 malware samples was released. It is divided into 135 varieties based on similar malicious behavior, retrieved through static analysis of the file classes.dex in the APK of each malware, whereas the labeled features were determined by manual inspection of three samples in each variety. However, static analysis is known to be weak against obfuscation techniques, such as repackaging or dynamic loading, which can be exploited to avoid the analysis. In this study the second approach is utilized and all malware in the dataset are analyzed at run-time in order to monitor their dynamic behavior. However, analyzing malware at run-time has known weaknesses as well, as it can be avoided through, for instance, anti-emulator techniques. Therefore, the study aimed to explore the available sandbox environments for dynamic analysis, study the effectiveness of fingerprinting Android malware using one of the tools and investigate whether static features from AMD and the dynamic analysis correlate. For instance, by an attempt to classify the samples based on similar dynamic features and calculating the Pearson Correlation Coefficient (r) for all combinations of features from AMD and the dynamic analysis.

The comparison of tools for dynamic analysis, showed a need of development, as most popular tools has been released for a long time and the common factor is a lack of continuous maintenance. As a result, the choice of sandbox environment for this study ended up as Droidbox, because of aspects like ease of use/install and easily adaptable for large scale analysis. Based on the dynamic features extracted with Droidbox, it could be shown that Android malware are more similar to the varieties which they belong to. The best metric for classifying samples to varieties, out of four investigated metrics, turned out to be Cosine Similarity, which received an accuracy of 83.6% for the entire dataset. The high accuracy indicated a correlation between the dynamic features and static features which the varieties are based on. Furthermore, the Pearson Correlation Coefficient confirmed that the manually extracted features, used to describe the varieties, and the dynamic features are correlated to some extent, which could be partially confirmed by a manual inspection in the end of the study.

sted, utgiver, år, opplag, sider
2019. , s. 46
Emneord [en]
Android malware, dynamic analysis, droidbox, cuckoodroid, droidscope, mobsf, malware behavior, correlation, pearson correlation, cosine similarity, euclidean distance, chebyshev distance, mahalanobis distance, similarity analysis, static features, dynamic features, tf-idf, term frequency inverse document frequency, AMD, Android malware dataset, malware dataset, UpDroid, EC2
HSV kategori
Identifikatorer
URN: urn:nbn:se:liu:diva-163090ISRN: LIU-IDA/LITH-EX-A--19/104--SEOAI: oai:DiVA.org:liu-163090DiVA, id: diva2:1384850
Fag / kurs
Computer Engineering
Veileder
Examiner
Tilgjengelig fra: 2020-01-13 Laget: 2020-01-11 Sist oppdatert: 2020-01-13bibliografisk kontrollert

Open Access i DiVA

fulltext(380 kB)28 nedlastinger
Filinformasjon
Fil FULLTEXT01.pdfFilstørrelse 380 kBChecksum SHA-512
43e62d76cfe789eeaac93661194bcf5b77c634507f55665babcc50798fd0b379559502fba1dae9c467c1d73d57f6052def32de270c77a7b7b241ac608dafebfc
Type fulltextMimetype application/pdf

Søk i DiVA

Av forfatter/redaktør
Regard, Viktor
Av organisasjonen

Søk utenfor DiVA

GoogleGoogle Scholar
Totalt: 28 nedlastinger
Antall nedlastinger er summen av alle nedlastinger av alle fulltekster. Det kan for eksempel være tidligere versjoner som er ikke lenger tilgjengelige

urn-nbn

Altmetric

urn-nbn
Totalt: 155 treff
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf