VAHunt: Warding Off New Repackaged Android Malware in App-Virtualization's Clothing
VAHunt: Warding Off New Repackaged Android Malware in App-Virtualization's Clothing
复制标题
DOI：
10.1145/3372297.3423341
复制
发表时间：
2020-10
期刊：
影响因子：
--
通讯作者：
Luman Shi;Jiang Ming;Jianming Fu;Guojun Peng;Dongpeng Xu;Kun Gao;Xuanchen Pan
中科院分区：
文献类型：
--
作者：
Luman Shi;Jiang Ming;Jianming Fu;Guojun Peng;Dongpeng Xu;Kun Gao;Xuanchen Pan
使用恶意负载重新包装流行的良性应用程序曾经是传播Android恶意软件的最常见方式。然而，自2016年以来，我们观察到Android生态系统出现了一个令人担忧的新趋势：越来越多的Android恶意软件样本滥用最近的应用程序虚拟化创新作为新的分发渠道。应用程序虚拟化使用户能够在单个设备上运行同一应用程序的多个副本，数千万用户正在享受这种便利。然而，网络犯罪分子将各种恶意APK文件重新打包为插件到应用程序虚拟化平台中，该平台可以灵活地启动任意插件，而无需安装麻烦。这种新的重新包装方式通过将嫁接的恶意负载隐藏在插件中来获得绕过反恶意软件扫描程序的能力，而且它也违背了现有重新包装的应用程序检测解决方案所体现的基本前提。由于基于应用程序虚拟化的应用程序不一定是恶意软件，在本文中，我们的目标是在运行时间之前对它们做出判决。我们的深入研究得出了两个关键结论：1）插件应用与Android框架之间的代理层是应用虚拟化机制的核心，它揭示了有限状态转换的特征; 2）恶意软件通常会偷偷加载插件并隐藏恶意行为。这些见解促使我们开发一种双层检测方法，称为VAHunt。首先，我们设计了一个有状态的检测模型来识别APK文件中是否存在应用程序虚拟化引擎。其次，我们进行数据流分析，提取指纹特征，区分恶意和良性的加载策略。自2019年10月以来，我们在领先的移动的安全公司Antiy AVL移动的Security中测试了VAHunt，检测了超过139 K基于应用程序虚拟化的样本。与地面实况相比，VAHunt实现了0.7%的假阴性和零假阳性。我们的自动检测将安全分析师从逆向工程的负担中解放出来。
Repackaging popular benign apps with malicious payload used to be the most common way to spread Android malware. Nevertheless, since 2016, we have observed an alarming new trend to Android ecosystem: a growing number of Android malware samples abuse recent app-virtualization innovation as a new distribution channel. App-virtualization enables a user to run multiple copies of the same app on a single device, and tens of millions of users are enjoying this convenience. However, cybercriminals repackage various malicious APK files as plugins into an app-virtualization platform, which is flexible to launch arbitrary plugins without the hassle of installation. This new style of repackaging gains the ability to bypass anti-malware scanners by hiding the grafted malicious payload in plugins, and it also defies the basic premise embodied by existing repackaged app detection solutions. As app-virtualization-based apps are not necessarily malware, in this paper, we aim to make a verdict on them prior to run time. Our in-depth study results in two key observations: 1) the proxy layer between plugin apps and the Android framework is the core of app-virtualization mechanism, and it reveals the feature of finite state transitions; 2) malware typically loads plugins stealthily and hides malicious behaviors. These insights motivate us to develop a two-layer detection approach, called VAHunt. First, we design a stateful detection model to identify the existence of an app-virtualization engine in APK files. Second, we perform data flow analysis to extract fingerprinting features to differentiate between malicious and benign loading strategies. Since October 2019, we have tested VAHunt in Antiy AVL Mobile Security, a leading mobile security company, to detect more than 139K app-virtualization-based samples. Compared with the ground truth, VAHunt achieves 0.7% false negatives and zero false positive. Our automated detection frees security analysts from the burden of reverse engineering.