Static analysis of Android applications for malware detection

点击翻译按钮获取中文摘要

Smartphone users need a way to verify that an application is safe before installing it. For now, the gold standard for verifying applications is to use dynamic analysis: execute the application in a sandbox (a safe environment external to the phone) and look for malicious behaviour. This approach has a few major problems, the first being the time needed. Executing and analyzing each malware individually in a sandbox takes between 10 and 15 minutes, which can really add up when there are thousands of samples to be analyzed. The second limitation is code coverage: preliminary analysis of execution traces show that, most of the time, only a small subset of the code is executed. On top of that, the more sophisticated malware have the ability to detect sandboxes and do nothing malicious while under analysis. Thales Research & Technology Canada would like to assess the feasibility of replacing dynamic analysis by static analysis for malware detection. Static analysis has the following advantages: it can be performed on the phone itself as no external sandbox is required, it is fast (though sometimes less precise) and covers the entire code. Thales' current malware detection tool bases its analysis on the presence of signatures (an a priori elaborated set of behaviours). These signatures are currently dynamically detected and contain information about possibly malicious actions performed by the application, e.g., sends text message automatically, accesses the call history, etc. For detecting these signatures, static analysis of the code appears to be a relevant solution. The main goal of this project is to study the feasibility of replacing dynamic analysis by static analysis for identifying malicious Android applications. To achieve this goal, a static analyzer prototype to detect signatures will be developed and experiments will be undertaken.