Static analysis of Android applications for malware detection

智能手机用户需要一种方法来验证应用程序在安装之前是安全的。就目前而言，黄金 验证应用程序的标准是使用动态分析：在沙箱(保险箱)中执行应用程序 电话外部环境)，并寻找恶意行为。这种方法有几个主要问题， 首先是所需的时间。在沙箱中单独执行和分析每个恶意软件需要 10到15分钟，当有数千个样本需要分析时，这一时间真的可以加起来。第二 限制是代码覆盖率：对执行跟踪的初步分析表明，大多数情况下，只有一小部分 执行代码的子集。最重要的是，更复杂的恶意软件能够检测到 沙箱，并且在分析过程中不做任何恶意操作。 泰利斯加拿大研究与技术公司希望评估用以下方法取代动态分析的可行性 用于恶意软件检测的静态分析。静态分析具有以下优点：它可以在 手机本身，因为不需要外部沙盒，它是快速的(尽管有时不那么精确)，并覆盖整个 密码。Thales目前的恶意软件检测工具基于签名(先验)的存在进行分析 精心设计的一套行为)。这些签名当前是动态检测的，并且包含信息 关于应用程序可能执行的恶意操作，例如自动发送文本消息、访问 呼叫历史等。 对于检测这些签名，代码的静态分析似乎是一个相关的解决方案。 本项目的主要目标是研究用静力分析代替动力分析的可行性。 识别恶意Android应用程序。为了实现这一目标，一个检测签名的静态分析器原型 将被开发并进行实验。

Smartphone users need a way to verify that an application is safe before installing it. For now, the gold standard for verifying applications is to use dynamic analysis: execute the application in a sandbox (a safe environment external to the phone) and look for malicious behaviour. This approach has a few major problems, the first being the time needed. Executing and analyzing each malware individually in a sandbox takes between 10 and 15 minutes, which can really add up when there are thousands of samples to be analyzed. The second limitation is code coverage: preliminary analysis of execution traces show that, most of the time, only a small subset of the code is executed. On top of that, the more sophisticated malware have the ability to detect sandboxes and do nothing malicious while under analysis. Thales Research & Technology Canada would like to assess the feasibility of replacing dynamic analysis by static analysis for malware detection. Static analysis has the following advantages: it can be performed on the phone itself as no external sandbox is required, it is fast (though sometimes less precise) and covers the entire code. Thales' current malware detection tool bases its analysis on the presence of signatures (an a priori elaborated set of behaviours). These signatures are currently dynamically detected and contain information about possibly malicious actions performed by the application, e.g., sends text message automatically, accesses the call history, etc. For detecting these signatures, static analysis of the code appears to be a relevant solution. The main goal of this project is to study the feasibility of replacing dynamic analysis by static analysis for identifying malicious Android applications. To achieve this goal, a static analyzer prototype to detect signatures will be developed and experiments will be undertaken.