Monet: A User-Oriented Behavior-Based Malware Variants Detection System for Android
Monet: A User-Oriented Behavior-Based Malware Variants Detection System for Android
复制标题
DOI：
10.1109/tifs.2016.2646641
复制
发表时间：
2017-05-01
影响因子：
6.8
通讯作者：
Liang, Zhenkai
中科院分区：
文献类型：
--
作者：
Sun, Mingshen;Li, Xiaolei;Liang, Zhenkai
Android是最受欢迎的移动的操作系统，拥有约78%的移动的市场份额。由于其受欢迎程度，它吸引了许多恶意软件攻击。事实上，人们每季度发现大约100万个新的恶意软件样本，据报道，这些新的恶意软件样本中有98%以上实际上是现有恶意软件家族的“衍生物”（或变体）。在本文中，我们首先表明恶意软件核心功能的运行时行为在恶意软件家族中实际上是相似的。因此，我们提出了一个框架，结合联合收割机“运行时行为”与“静态结构”来检测恶意软件的变种。我们提出了MONET的设计和实现，它有一个客户端和一个后端服务器模块。客户端模块是一个轻量级的设备内应用程序，用于行为监控和签名生成，我们使用两种新颖的拦截技术实现这一点。后端服务器负责大规模恶意软件检测。我们收集了3723个恶意软件样本和前500个良性应用程序，以进行大量的实验，检测恶意软件变体和防御恶意软件转换。我们的实验表明，MONET在检测恶意软件变体方面可以达到99%左右的准确率。此外，它可以抵御十种不同的混淆和转换技术，而仅产生约7%的性能开销和约3%的电池开销。更重要的是，MONET会自动提醒用户入侵细节，以防止进一步的恶意行为。
Android, the most popular mobile OS, has around 78% of the mobile market share. Due to its popularity, it attracts many malware attacks. In fact, people have discovered around 1 million new malware samples per quarter, and it was reported that over 98% of these new malware samples are in fact "derivatives" (or variants) from existing malware families. In this paper, we first show that runtime behaviors of malware's core functionalities are in fact similar within a malware family. Hence, we propose a framework to combine "runtime behavior" with "static structures" to detect malware variants. We present the design and implementation of MONET, which has a client and a backend server module. The client module is a lightweight, in-device app for behavior monitoring and signature generation, and we realize this using two novel interception techniques. The backend server is responsible for large scale malware detection. We collect 3723 malware samples and top 500 benign apps to carry out extensive experiments of detecting malware variants and defending against malware transformation. Our experiments show that MONET can achieve around 99% accuracy in detecting malware variants. Furthermore, it can defend against ten different obfuscation and transformation techniques, while only incurs around 7% performance overhead and about 3% battery overhead. More importantly, MONET will automatically alert users with intrusion details so to prevent further malicious behaviors.