一句话：通过混淆 6000 个应用生成 7.3 万样本，大规模实证评估代码混淆对 Android 反恶意软件检测效果的影响。
恶意软件作者常使用代码混淆逃避反恶意软件检测，但混淆对检测的实际影响缺乏大规模系统评估。本文使用 7 个开源、学术与商业混淆工具的 29 种策略，对 3000 个良性应用和 3000 个恶意应用进行混淆，生成 73,362 个混淆应用，并测试主流反恶意软件产品的检测能力。结果表明：代码混淆显著影响 Android 反恶意软件产品；多数产品即使面对简单混淆也严重失效；组合混淆策略并未比单一策略更有效地规避检测；检测效果取决于混淆策略与所用工具；反恶意软件产品对恶意应用签名的采用缓慢；代码混淆常导致应用语义行为改变。
The Android platform has been the dominant mobile platform in recent years resulting in millions of apps and security threats against those apps. Anti-malware products aim to protect smartphone users from these threats, especially from malicious apps. However, malware authors use code obfuscation on their apps to evade detection by anti-malware products. To assess the effects of code obfuscation on Android apps and anti-malware products, we have conducted a large-scale empirical study that evaluates the effectiveness of the top anti-malware products against various obfuscation tools and strategies. To that end, we have obfuscated 3,000 benign apps and 3,000 malicious apps and generated 73,362 obfuscated apps using 29 obfuscation strategies from 7 open-source, academic, and commercial obfuscation tools. The findings of our study indicate that (1) code obfuscation significantly impacts Android anti-malware products; (2) the majority of anti-malware products are severely impacted by even trivial obfuscations; (3) in general, combined obfuscation strategies do not successfully evade anti-malware products more than individual strategies; (4) the detection of anti-malware products depend not only on the applied obfuscation strategy but also on the leveraged obfuscation tool; (5) anti-malware products are slow to adopt signatures of malicious apps; and (6) code obfuscation often results in changes to an app's semantic behaviors.
@inproceedings{paperbot4464,
title = {A large-scale empirical study on the effects of code obfuscations on Android apps and anti-malware products},
author = {Mahmoud Hammad and Joshua Garcia and Sam Malek},
booktitle = {ICSE},
year = {2018},
doi = {10.1145/3180155.3180228}
}