It is important to effectively detect, mitigate, and defend against Android malware attacks, because Android malware has long represented a major threat to Android app security. Characterizing and classifying similar malicious apps into groups plays a particularly crucial role in building a secure Android app ecosystem. The classification of malware families can efficiently enhance the malware detection process and systematically elucidate malware patterns. In this paper, we propose a novel efficient deep learning network with multi-streams for Android malware family classification. We first obtain the input data for a convolutional neural network (CNN) in string format from some main files or sections contained in each Android malicious app. We then classify malware families by applying a 1-dimensional convolution filter-based network for the files or sections. Further, by using gradient analysis to visualize the important files and sections in malicious apps, we attempt to intuitively grasp which files or sections are the most significant for malware family classification. To validate the effectiveness of our approach, we conduct extensive experiments with the well-known DREBIN and AMD malware datasets, and we compare our approach with existing methods. Our experimental results show that the 1D CNN model is more accurate than the 2D CNN model, and that the code_item part in the classes.dex is the most relevant feature for malware classification, as it is more relevant than other parts such as AndroidManifest.xml and certificate. The proposed method achieves the best accuracy of 93.2% by using 1D convolution filters with multi-streams for the main files and sections of the malware samples.

Malware family classification is grouping malware samples that have the same or similar characteristics into the same family. It plays a crucial role in understanding notable malicious patterns and recovering from malware infections. Although many machine learning approaches have been devised for this problem, there are still several open questions including, “Which features, classifiers, and evaluation metrics are better for malware familial classification”? In this paper, we propose a machine learning approach to Android malware family classification using built-in and custom permissions. Each Android app must declare proper permissions to access restricted resources or to perform restricted actions. Permission declaration is an efficient and obfuscation-resilient feature for malware analysis. We developed a malware family classification technique using permissions and conducted extensive experiments with several classifiers on a well-known dataset, DREBIN. We then evaluated the classifiers in terms of four metrics: macrolevel F1-score, accuracy, balanced accuracy (BAC), and the Matthews correlation coefficient (MCC). BAC and the MCC are known to be appropriate for evaluating imbalanced data classification. Our experimental results showed that: (i) custom permissions had a positive impact on classification performance; (ii) even when the same classifier and the same feature information were used, there was a difference up to 3.67% between accuracy and BAC; (iii) LightGBM and AdaBoost performed better than other classifiers we considered.

There are various types of Android apps such as entertainment apps, health and fitness apps, travel apps, educational apps, business apps, etc. Android apps can contain business logic, maintain sensitive personal information, and act as a bridge between IoT devices and cloud servers. Since illegal users frequently make a copy of a legitimate Android app and redistribute the plagiarized app for commercial or malicious purposes, many studies have been conducted to detect repackaged/cloned apps and make the Android ecosystem safer. A malicious attacker might apply code obfuscation to avoid app clone detection. Therefore, it is necessary to consider the effects of code obfuscation when detecting cloned apps. In this paper, we design and implement a tool called RomaDroid, which can detect efficiently cloned apps based on features inherent in each app’s AndroidManifest.xml file. The manifest file is XML structure defined by tags or attributes and its XML document can be modeled as an ordered labeled tree. RomaDroid creates a string from the hierarchical tree structure of tags as well as the class name of the components related to intent-filter tags in the manifest file, which are robust to code obfuscation. That is, we create a string from each manifest file of two apps to be compared and measure the similarity between the created two strings with the longest common subsequence (LCS) algorithm. If the measured similarity exceeds a certain threshold, the two apps are determined to be a clone pair (or similar app pair). To validate RomaDroid, we perform various experiments with both non-obfuscated apps and their obfuscated versions generated by three obfuscation tools. Experimental results show that RomaDroid detects accurately cloned apps even in the cases code obfuscation has been applied.

Validation methods for hard real-time jobs are usually performed based on the maximum execution time. The actual execution time of jobs are assumed to be known only when the jobs arrive or not known until they finish. A predictable algorithm must guarantee that it can generate a schedule for any set of jobs such that the finish time for the actual execution time is no later than the finish time for the maximum execution time. It is known that any job-level fixed priority algorithm (such as Earliest Deadline First) is predictable. However, job-level dynamic priority algorithms (such as Least Laxity First) may or may not. In this paper, we investigate the predictability of a job-level dynamic priority algorithm EDZL (Earliest Deadline Zero Laxity). We show that EDZL is predictable on the domain of integers regardless of the knowledge of the actual execution times. Based on this result, furthermore, we also show that EDZL can successfully schedule any periodic task set if the total utilization is not greater than (m + 1)/2, where m is the number of processors.

Code obfuscation is a technique that makes it difficult for code analyzers to understand a program by transforming its structures or operations while maintaining its original functionality. Android app developers often employ obfuscation techniques to protect business logic and core algorithm inside their app against reverse engineering attacks. On the other hand, malicious app writers also use obfuscation techniques to avoid being detected by anti-malware software. If malware analysts can mitigate the code obfuscation applied to malicious apps, they can analyze and detect the malicious apps more efficiently. This paper proposes a new tool, Deoptfuscator , to detect obfuscated an Android app and to restore the original source codes. Deoptfuscator detects an app control-flow obfuscated by DexGuard and tries to restore the original control-flows. Deoptfuscator deobfuscates in two steps: it determines whether an control-flow obfuscation technique is applied and then deobfuscates the obfuscated codes. Through experiments, we analyze how similar a deobfuscated app is to the original one and show that the obfuscated app can be effectively restored to the one similar to the original. We also show that the deobfuscated apps run normally.

A software birthmark is unique and native characteristics of software, and thus can be used to detect the theft of software. We propose a new static software birthmark for programs on Microsoft Windows which have Portable Executable (PE) format. These programs use different Dynamic Link Libraries (DLLs) and Application Program Interfaces (APIs) while they are executing. The number and names of the used DLLs and APIs are unique to each program. The proposed birthmark is based on these numbers and names. This information can be obtained from the Import Address Table (IAT), which is part of the PE file. By inspecting the proposed birthmark, we can identify certain software and detect pirated software. To evaluate the effectiveness of the proposed birthmark, we inspect and compare several applications of different kinds. The experimental results show that the proposed birthmark can identify Windows applications, leading to the prevention of an illegal distribution of copyrighted software.