Detection of Repackaged Android Malware with Code-Heterogeneity Features

Ke Tian, Danfeng Yao, Barbara G. Ryder, Gang Tan, Guojun Peng

Research output: Contribution to journalArticlepeer-review

16 Scopus citations

Abstract

During repackaging, malware writers statically inject malcode and modify the control flow to ensure its execution. Repackaged malware is difficult to detect by existing classification techniques, partly because of their behavioral similarities to benign apps. By exploring the app's internal different behaviors, we propose a new Android repackaged malware detection technique based on code heterogeneity analysis. Our solution strategically partitions the code structure of an app into multiple dependence-based regions (subsets of the code). Each region is independently classified on its behavioral features. We point out the security challenges and design choices for partitioning code structures at the class and method level graphs, and present a solution based on multiple dependence relations. We have performed experimental evaluation with over 7,542 Android apps. For repackaged malware, our partition-based detection reduces false negatives (i.e., missed detection) by 30-fold, when compared to the non-partition-based approach. Overall, our approach achieves a false negative rate of 0.35 percent and a false positive rate of 2.97 percent.

Original languageEnglish (US)
Article number8018581
Pages (from-to)64-77
Number of pages14
JournalIEEE Transactions on Dependable and Secure Computing
Volume17
Issue number1
DOIs
StatePublished - Jan 1 2020

All Science Journal Classification (ASJC) codes

  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Detection of Repackaged Android Malware with Code-Heterogeneity Features'. Together they form a unique fingerprint.

Cite this