Visualizing the outcome of dynamic analysis of Android malware with VizMal. (February 2020)

• Record Type: Journal Article
• Authors: De Lorenzo, Andrea; Martinelli, Fabio; Medvet, Eric; Mercaldo, Francesco; Santone, Antonella
• Is Part Of: Journal of information security and applications. Volume 50(2020)
• Publication Date: 2020-02
• Subjects: Malware analysis -- Android -- Machine learning -- Multiple instance learning -- LSTM-RNN -- Security; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2019.102423
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: Malware detection techniques based on signature extraction require security analysts to manually inspect samples to find evidences of malicious behavior. This time-consuming task received little attention by researchers and practitioners, as most of the effort is on the identification as malware or non-malware of an entire sample. There are no tools for supporting the analyst in identifying when the malicious behavior occurs, given a sample. In this paper we propose VizMal, a tool able to visualize the execution traces of Android applications and to highlight which portions of the traces correspond to a potentially malicious behavior. The aim of VizMal is twofold: assisting the malware analyst during the inspection of an application and pushing the research community to organize and focus its effort on the malicious behavior localization. VizMal is able to discern if the application behavior during each second of execution are legitimate or malicious and to show this information in a simple and understandable way. We validate VizMal experimentally and by means of a user study: the results are promising and confirm that the tool can be useful.