Andro-Dumpsys: Anti-malware system based on the similarity of malware creator and malware centric information. Issue 58 (May 2016)

• Record Type: Journal Article
• Authors: Jang, Jae-wook; Kang, Hyunjae; Woo, Jiyoung; Mohaisen, Aziz; Kim, Huy Kang
• Is Part Of: Computers & security. Issue 58(2016)
• Page Start: 125
• Page End: 138
• Publication Date: 2016-05
• Subjects: Volatile memory acquisition -- Similarity -- Malware creator centric information -- Mobile malware -- Android; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2015.12.005
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: Our system (Andro-Dumpsys) leverages volatile memory acquisition. Andro-Dumpsys leverages malware creator information and malware information. Andro-Dumpsys is anti-malware system based on similarity matching of footprints. Andro-Dumpsys is capable of detecting zero-day threats. Graphical Abstract: Abstract: With the fast growth in mobile technologies and the accompanied rise of the integration of such technologies into our everyday life, mobile security is viewed as one of the most prominent areas and is being addressed accordingly. For that, and especially to address the threat associated with malware, various malware-centric analysis methods are developed in the literature to identify, classify, and defend against mobile threats and malicious actors. However, along with this development, anti-malware analysis techniques, such as packing, dynamic loading, and dex encryption, have seen wide adoption, making existing malware-centric analysis methods less effective. In this paper, we propose a feature-rich hybrid anti-malware system, called Andro-Dumpsys, which leverages volatile memory acquisition for accurate malware detection and classification. Andro-Dumpsys is based on similarity matching of malware creator-centric and malware-centric information. Using Andro-Dumpsys, we detect and classify malware samples into similar behavior groups by exploiting their footprints, which are equivalent to unique behavior characteristics. Our experimental results demonstrate that Andro-Dumpsys is scalable, and performs well in detecting malware and classifying malware families with low false positives and false negatives, and is capable of responding zero-day threats.