Open Access Open Access  Restricted Access Subscription Access

Detection and Visualization of Android Malware Behavior


Affiliations
1 Electronics and Computing Department, Mondragon University, 20500 Mondragon, Spain
2 ExoClick SL, 08005 Barcelona, Spain
3 Department of Computer and Information Science, Linkoping University, 581 83 Linkoping, Sweden
 

Malware analysts still need to manually inspect malware samples that are considered suspicious by heuristic rules. They dissect software pieces and look for malware evidence in the code. The increasing number of malicious applications targeting Android devices raises the demand for analyzing them to find where the malcode is triggered when user interacts with them. In this paper a framework tomonitor and visualize Android applications' anomalous function calls is described. Our approach includes platformindependent application instrumentation, introducing hooks in order to trace restricted API functions used at runtime of the application. These function calls are collected at a central server where the application behavior filtering and a visualization take place. This can help Android malware analysts in visually inspecting what the application under study does, easily identifying such malicious functions.
User
Notifications
Font Size

Abstract Views: 52

PDF Views: 0




  • Detection and Visualization of Android Malware Behavior

Abstract Views: 52  |  PDF Views: 0

Authors

Oscar Somarriba
Electronics and Computing Department, Mondragon University, 20500 Mondragon, Spain
Urko Zurutuza
Electronics and Computing Department, Mondragon University, 20500 Mondragon, Spain
Roberto Uribeetxeberria
Electronics and Computing Department, Mondragon University, 20500 Mondragon, Spain
Laurent Delosieres
ExoClick SL, 08005 Barcelona, Spain
Simin Nadjm-Tehrani
Department of Computer and Information Science, Linkoping University, 581 83 Linkoping, Sweden

Abstract


Malware analysts still need to manually inspect malware samples that are considered suspicious by heuristic rules. They dissect software pieces and look for malware evidence in the code. The increasing number of malicious applications targeting Android devices raises the demand for analyzing them to find where the malcode is triggered when user interacts with them. In this paper a framework tomonitor and visualize Android applications' anomalous function calls is described. Our approach includes platformindependent application instrumentation, introducing hooks in order to trace restricted API functions used at runtime of the application. These function calls are collected at a central server where the application behavior filtering and a visualization take place. This can help Android malware analysts in visually inspecting what the application under study does, easily identifying such malicious functions.