一句话：提出 HomDroid，用社交网络同质性分析定位 Android 应用中与良性代码强耦合的隐蔽恶意部分，以降低漏报。
Android 恶意软件常将恶意行为伪装在大量良性行为中，恶意成分只占应用代码一小部分且与良性部分强耦合，导致从整个应用提取特征的检测器容易漏报。已有先划分应用再发现恶意部分的方法通常假设正常部分与恶意部分连接较弱，因此只适用于重打包类恶意软件。HomDroid 引入社交网络中的同质性分析来应对这一限制，试图在强弱耦合条件下识别隐蔽恶意组件。摘要未报告具体实验设置与结果。
Android has become the most popular mobile operating system. Correspondingly, an increasing number of Android malware has been developed and spread to steal users’ private information. There exists one type of malware whose benign behaviors are developed to camouflage malicious behaviors. The malicious component occupies a small part of the entire code of the application (app for short), and the malicious part is strongly coupled with the benign part. In this case, the malware may cause false negatives when malware detectors extract features from the entire apps to conduct classification because the malicious features of these apps may be hidden among benign features. Moreover, some previous work aims to divide the entire app into several parts to discover the malicious part. However, the premise of these methods to commence app partition is that the connections between the normal part and the malicious part are weak (repackaged malware).
DOI 原文 ·
@inproceedings{paperbot6699,
title = {HomDroid: detecting Android covert malware by social-network homophily analysis},
author = {Yueming Wu and Deqing Zou and Wei Yang and Xiang Li and Hai Jin},
booktitle = {ISSTA},
year = {2021},
doi = {10.1145/3460319.3464833}
}