一句话：系统分析绕过 Google Play 防御的 Android 恶意软件，归纳其载荷、激活条件与隐藏技术，并指出现有检测工具的不足。
本文分析了 2016 年 1 月至 2021 年 7 月绕过 Google Play 最严格防御并进入官方 Android 市场的恶意软件。作者系统识别出 1,238 个恶意应用，归为 134 个家族，并人工分析 105 个家族的代表样本，提取恶意载荷、触发载荷的复杂激活条件、逃避用户检测的隐藏技术及其他实现特征。由于多数应用含多个载荷且各有独立激活逻辑，论文还提出基于图的表示，用控制流和数据流图展示所有载荷的激活路径。最后，作者对照观察到的恶意软件特征评估现有检测工具的能力，指出检测缺口与未来研究方向。
This paper provides an in-depth analysis of Android malware that bypassed the strictest defenses of the Google Play application store and penetrated the official Android market between January 2016 and July 2021. We systematically identified 1,238 such malicious applications, grouped them into 134 families, and manually analyzed one application from 105 distinct families. During our manual analysis, we identified malicious payloads the applications execute, conditions guarding execution of the payloads, hiding techniques applications employ to evade detection by the user, and other implementation-level properties relevant for automated malware detection. As most applications in our dataset contain multiple payloads, each triggered via its own complex activation logic, we also contribute a graph-based representation showing activation paths for all application payloads in form of a control- and data-flow graph. Furthermore, we discuss the capabilities of existing malware detection tools, put them in context of the properties observed in the analyzed malware, and identify gaps and future research directions. We believe that our detailed analysis of the recent, evasive malware will be of interest to researchers and practitioners and will help further improve malware detection tools.
DOI 原文 ·
@inproceedings{paperbot6930,
title = {Rotten apples spoil the bunch},
author = {Michael Cao and Khaled Ahmed and Julia Rubin},
booktitle = {ICSE},
year = {2022},
doi = {10.1145/3510003.3510161}
}