liu.seSök publikationer i DiVA
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Studying the effectiveness of dynamic analysis for fingerprinting Android malware behavior
Linköpings universitet, Institutionen för datavetenskap, Databas och informationsteknik.
2019 (Engelska)Självständigt arbete på avancerad nivå (masterexamen), 20 poäng / 30 hpStudentuppsats (Examensarbete)Alternativ titel
En studie av effektivitet hos dynamisk analys för kartläggning av beteenden hos Android malware (Svenska)
Abstract [en]

Android is the second most targeted operating system for malware authors and to counter the development of Android malware, more knowledge about their behavior is needed. There are mainly two approaches to analyze Android malware, namely static and dynamic analysis. Recently in 2017, a study and well labeled dataset, named AMD (Android Malware Dataset), consisting of over 24,000 malware samples was released. It is divided into 135 varieties based on similar malicious behavior, retrieved through static analysis of the file classes.dex in the APK of each malware, whereas the labeled features were determined by manual inspection of three samples in each variety. However, static analysis is known to be weak against obfuscation techniques, such as repackaging or dynamic loading, which can be exploited to avoid the analysis. In this study the second approach is utilized and all malware in the dataset are analyzed at run-time in order to monitor their dynamic behavior. However, analyzing malware at run-time has known weaknesses as well, as it can be avoided through, for instance, anti-emulator techniques. Therefore, the study aimed to explore the available sandbox environments for dynamic analysis, study the effectiveness of fingerprinting Android malware using one of the tools and investigate whether static features from AMD and the dynamic analysis correlate. For instance, by an attempt to classify the samples based on similar dynamic features and calculating the Pearson Correlation Coefficient (r) for all combinations of features from AMD and the dynamic analysis.

The comparison of tools for dynamic analysis, showed a need of development, as most popular tools has been released for a long time and the common factor is a lack of continuous maintenance. As a result, the choice of sandbox environment for this study ended up as Droidbox, because of aspects like ease of use/install and easily adaptable for large scale analysis. Based on the dynamic features extracted with Droidbox, it could be shown that Android malware are more similar to the varieties which they belong to. The best metric for classifying samples to varieties, out of four investigated metrics, turned out to be Cosine Similarity, which received an accuracy of 83.6% for the entire dataset. The high accuracy indicated a correlation between the dynamic features and static features which the varieties are based on. Furthermore, the Pearson Correlation Coefficient confirmed that the manually extracted features, used to describe the varieties, and the dynamic features are correlated to some extent, which could be partially confirmed by a manual inspection in the end of the study.

Ort, förlag, år, upplaga, sidor
2019. , s. 46
Nyckelord [en]
Android malware, dynamic analysis, droidbox, cuckoodroid, droidscope, mobsf, malware behavior, correlation, pearson correlation, cosine similarity, euclidean distance, chebyshev distance, mahalanobis distance, similarity analysis, static features, dynamic features, tf-idf, term frequency inverse document frequency, AMD, Android malware dataset, malware dataset, UpDroid, EC2
Nationell ämneskategori
Data- och informationsvetenskap
Identifikatorer
URN: urn:nbn:se:liu:diva-163090ISRN: LIU-IDA/LITH-EX-A--19/104--SEOAI: oai:DiVA.org:liu-163090DiVA, id: diva2:1384850
Ämne / kurs
Datateknik
Handledare
Examinatorer
Tillgänglig från: 2020-01-13 Skapad: 2020-01-11 Senast uppdaterad: 2020-01-13Bibliografiskt granskad

Open Access i DiVA

fulltext(380 kB)31 nedladdningar
Filinformation
Filnamn FULLTEXT01.pdfFilstorlek 380 kBChecksumma SHA-512
43e62d76cfe789eeaac93661194bcf5b77c634507f55665babcc50798fd0b379559502fba1dae9c467c1d73d57f6052def32de270c77a7b7b241ac608dafebfc
Typ fulltextMimetyp application/pdf

Sök vidare i DiVA

Av författaren/redaktören
Regard, Viktor
Av organisationen
Databas och informationsteknik
Data- och informationsvetenskap

Sök vidare utanför DiVA

GoogleGoogle Scholar
Totalt: 31 nedladdningar
Antalet nedladdningar är summan av nedladdningar för alla fulltexter. Det kan inkludera t.ex tidigare versioner som nu inte längre är tillgängliga.

urn-nbn

Altmetricpoäng

urn-nbn
Totalt: 161 träffar
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf