Rage against the virtual machine: hindering dynamic analysis of Android malware
Rage against the virtual machine: hindering dynamic analysis of Android malware
复制标题
DOI：
10.1145/2592791.2592796
复制
发表时间：
2014-04
期刊：
影响因子：
--
通讯作者：
Thanasis Petsas;Giannis Voyatzis;E. Athanasopoulos;M. Polychronakis;S. Ioannidis
中科院分区：
文献类型：
--
作者：
Thanasis Petsas;Giannis Voyatzis;E. Athanasopoulos;M. Polychronakis;S. Ioannidis
Antivirus companies, mobile application marketplaces, and the security research community, employ techniques based on dynamic code analysis to detect and analyze mobile malware. In this paper, we present a broad range of anti-analysis techniques that malware can employ to evade dynamic analysis in emulated Android environments. Our detection heuristics span three different categories based on (i) static properties, (ii) dynamic sensor information, and (iii) VM-related intricacies of the Android Emulator. To assess the effectiveness of our techniques, we incorporated them in real malware samples and submitted them to publicly available Android dynamic analysis systems, with alarming results. We found all tools and services to be vulnerable to most of our evasion techniques. Even trivial techniques, such as checking the value of the IMEI, are enough to evade some of the existing dynamic analysis frameworks. We propose possible countermeasures to improve the resistance of current dynamic analysis tools against evasion attempts.
