Andro-AutoPsy: Anti-malware system based on similarity matching of malware and malware creator-centric information

Jae Wook Jang, Hyunjae Kang, Jiyoung Woo, Aziz Mohaisen, Huy Kang Kim

Research output: Contribution to journalArticle

20 Citations (Scopus)

Abstract

Mobile security threats have recently emerged because of the fast growth in mobile technologies and the essential role that mobile devices play in our daily lives. For that, and to particularly address threats associated with malware, various techniques are developed in the literature, including ones that utilize static, dynamic, on-device, off-device, and hybrid approaches for identifying, classifying, and defend against mobile threats. Those techniques fail at times, and succeed at other times, while creating a trade-off of performance and operation. In this paper, we contribute to the mobile security defense posture by introducing Andro-AutoPsy, an anti-malware system based on similarity matching of malware-centric and malware creator-centric information. Using Andro-AutoPsy, we detect and classify malware samples into similar subgroups by exploiting the profiles extracted from integrated footprints, which are implicitly equivalent to distinct characteristics. The experimental results demonstrate that Andro-AutoPsy is scalable, performs precisely in detecting and classifying malware with low false positives and false negatives, and is capable of identifying zero-day mobile malware.

Original languageEnglish
Article number576
Pages (from-to)17-35
Number of pages19
JournalDigital Investigation
Volume14
DOIs
Publication statusPublished - 2015 Sep 1

Fingerprint

Autopsy
Computer systems
threat
Equipment and Supplies
Posture
Technology
Growth
performance
Malware
Mobile devices
literature

Keywords

  • Android malware
  • Certificate
  • Malware classification
  • Profiling
  • Similarity matching

ASJC Scopus subject areas

  • Law
  • Computer Science Applications
  • Medical Laboratory Technology

Cite this

Andro-AutoPsy : Anti-malware system based on similarity matching of malware and malware creator-centric information. / Jang, Jae Wook; Kang, Hyunjae; Woo, Jiyoung; Mohaisen, Aziz; Kim, Huy Kang.

In: Digital Investigation, Vol. 14, 576, 01.09.2015, p. 17-35.

Research output: Contribution to journalArticle

@article{ac70bc6183214075b7290ad875f6f3c9,
title = "Andro-AutoPsy: Anti-malware system based on similarity matching of malware and malware creator-centric information",
abstract = "Mobile security threats have recently emerged because of the fast growth in mobile technologies and the essential role that mobile devices play in our daily lives. For that, and to particularly address threats associated with malware, various techniques are developed in the literature, including ones that utilize static, dynamic, on-device, off-device, and hybrid approaches for identifying, classifying, and defend against mobile threats. Those techniques fail at times, and succeed at other times, while creating a trade-off of performance and operation. In this paper, we contribute to the mobile security defense posture by introducing Andro-AutoPsy, an anti-malware system based on similarity matching of malware-centric and malware creator-centric information. Using Andro-AutoPsy, we detect and classify malware samples into similar subgroups by exploiting the profiles extracted from integrated footprints, which are implicitly equivalent to distinct characteristics. The experimental results demonstrate that Andro-AutoPsy is scalable, performs precisely in detecting and classifying malware with low false positives and false negatives, and is capable of identifying zero-day mobile malware.",
keywords = "Android malware, Certificate, Malware classification, Profiling, Similarity matching",
author = "Jang, {Jae Wook} and Hyunjae Kang and Jiyoung Woo and Aziz Mohaisen and Kim, {Huy Kang}",
year = "2015",
month = "9",
day = "1",
doi = "10.1016/j.diin.2015.06.002",
language = "English",
volume = "14",
pages = "17--35",
journal = "Digital Investigation",
issn = "1742-2876",
publisher = "Elsevier Limited",

}

TY - JOUR

T1 - Andro-AutoPsy

T2 - Anti-malware system based on similarity matching of malware and malware creator-centric information

AU - Jang, Jae Wook

AU - Kang, Hyunjae

AU - Woo, Jiyoung

AU - Mohaisen, Aziz

AU - Kim, Huy Kang

PY - 2015/9/1

Y1 - 2015/9/1

N2 - Mobile security threats have recently emerged because of the fast growth in mobile technologies and the essential role that mobile devices play in our daily lives. For that, and to particularly address threats associated with malware, various techniques are developed in the literature, including ones that utilize static, dynamic, on-device, off-device, and hybrid approaches for identifying, classifying, and defend against mobile threats. Those techniques fail at times, and succeed at other times, while creating a trade-off of performance and operation. In this paper, we contribute to the mobile security defense posture by introducing Andro-AutoPsy, an anti-malware system based on similarity matching of malware-centric and malware creator-centric information. Using Andro-AutoPsy, we detect and classify malware samples into similar subgroups by exploiting the profiles extracted from integrated footprints, which are implicitly equivalent to distinct characteristics. The experimental results demonstrate that Andro-AutoPsy is scalable, performs precisely in detecting and classifying malware with low false positives and false negatives, and is capable of identifying zero-day mobile malware.

AB - Mobile security threats have recently emerged because of the fast growth in mobile technologies and the essential role that mobile devices play in our daily lives. For that, and to particularly address threats associated with malware, various techniques are developed in the literature, including ones that utilize static, dynamic, on-device, off-device, and hybrid approaches for identifying, classifying, and defend against mobile threats. Those techniques fail at times, and succeed at other times, while creating a trade-off of performance and operation. In this paper, we contribute to the mobile security defense posture by introducing Andro-AutoPsy, an anti-malware system based on similarity matching of malware-centric and malware creator-centric information. Using Andro-AutoPsy, we detect and classify malware samples into similar subgroups by exploiting the profiles extracted from integrated footprints, which are implicitly equivalent to distinct characteristics. The experimental results demonstrate that Andro-AutoPsy is scalable, performs precisely in detecting and classifying malware with low false positives and false negatives, and is capable of identifying zero-day mobile malware.

KW - Android malware

KW - Certificate

KW - Malware classification

KW - Profiling

KW - Similarity matching

UR - http://www.scopus.com/inward/record.url?scp=84944049128&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84944049128&partnerID=8YFLogxK

U2 - 10.1016/j.diin.2015.06.002

DO - 10.1016/j.diin.2015.06.002

M3 - Article

AN - SCOPUS:84944049128

VL - 14

SP - 17

EP - 35

JO - Digital Investigation

JF - Digital Investigation

SN - 1742-2876

M1 - 576

ER -