一句话：首次系统测量现有 Android 恶意软件家族自动标注系统，揭示标签随时间演化、系统分歧与披露优先级问题。
Android 恶意软件家族标注对识别新威胁、分诊安全事件和剖析规避技术十分重要。AVClass、Euphony 等工具通过统一商业杀毒厂商（如 VirusTotal）的原始标签来自动生成家族标签，广泛应用于学术与工业。然而在样本众多且动态变化的真实工业场景中，这些系统存在显著局限。工业实践发现 VirusTotal 结果会随时间变化，导致依赖标签统一的家族标注出现时序不一致，进而影响企业安全态势。本文首次从标签动态性、一致性、可靠性等方面系统测量现有自动 Android 恶意软件家族标注系统，并基于大规模数据集验证：标注结果确实随时间演化，且这种演化会给许多先前性能评估研究引入偏差；相同输入下不同系统的标注决策存在明显分歧；此外还发现这些系统标注过程中存在家族披露优先级，可能被恶意行为者利用。研究结果有助于研究者和工业界改进自动恶意软件家族标注系统。
Labeling and classifying Android malware is important for identifying new threats, triaging security incidents, and demystifying evasion techniques. To automate the malware classification pipeline, state-of-the-art tools such as AVClass and Euphony unify raw labels from commercial antivirus vendors (i.e., VirusTotal) to produce family labels. These tools are widely used for automatic malware classification in both academic research and industry practice. However, they face significant limitations in real-world industrial scenarios with numerous and dynamically changing samples. For example, our industrial practices revealed that VirusTotal's results change over time, leading to temporal inconsistencies in family labeling results that rely on label unification, which can severely impact a company's security posture. Despite this, such issues and challenges remain understudied. In this paper, we present the first systematic measurement study of existing automatic Android malware family labeling systems from various aspects, including label dynamics, consistency, reliability, and etc. Based on a large-scale dataset, we validate that the labeling results of these systems do evolve with time, and such evolution can introduce bias into many previous studies on performance assessments. We also reveal substantial divergence in labeling decisions across different systems when given the same input. Besides, we identify a disclosure priority among families in these systems' labeling processes, which could threaten the industry by allowing malicious actors to exploit these discrepancies. Our findings could benefit both researchers and industry practitioners for further refinement of automatic malware family labeling systems, contributing to their practical applications.
DOI 原文 ·
@inproceedings{paperbot8361,
title = {Android Malware Family Labeling: Perspectives from the Industry},
author = {Liu Wang and Haoyu Wang and Tao Zhang and Haitao Xu and Guozhu Meng and Peiming Gao and Chen Wei and Yi Wang},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695280}
}