Andro-AutoPsy: Anti-malware system based on similarity matching of malware and malware creator-centric information

Jae Wook Jang, Hyunjae Kang, Jiyoung Woo, Aziz Mohaisen, Huy Kang Kim

Research output: Contribution to journalArticlepeer-review

36 Citations (Scopus)


Mobile security threats have recently emerged because of the fast growth in mobile technologies and the essential role that mobile devices play in our daily lives. For that, and to particularly address threats associated with malware, various techniques are developed in the literature, including ones that utilize static, dynamic, on-device, off-device, and hybrid approaches for identifying, classifying, and defend against mobile threats. Those techniques fail at times, and succeed at other times, while creating a trade-off of performance and operation. In this paper, we contribute to the mobile security defense posture by introducing Andro-AutoPsy, an anti-malware system based on similarity matching of malware-centric and malware creator-centric information. Using Andro-AutoPsy, we detect and classify malware samples into similar subgroups by exploiting the profiles extracted from integrated footprints, which are implicitly equivalent to distinct characteristics. The experimental results demonstrate that Andro-AutoPsy is scalable, performs precisely in detecting and classifying malware with low false positives and false negatives, and is capable of identifying zero-day mobile malware.

Original languageEnglish
Article number576
Pages (from-to)17-35
Number of pages19
JournalDigital Investigation
Publication statusPublished - 2015 Sept


  • Android malware
  • Certificate
  • Malware classification
  • Profiling
  • Similarity matching

ASJC Scopus subject areas

  • Pathology and Forensic Medicine
  • Information Systems
  • Computer Science Applications
  • Medical Laboratory Technology
  • Law


Dive into the research topics of 'Andro-AutoPsy: Anti-malware system based on similarity matching of malware and malware creator-centric information'. Together they form a unique fingerprint.

Cite this