updroid: updated android malware and its familial...

17

UpDroid: Updated Android Malware and Its Familial Classification Kursat Aktas, Assoc. Prof. Sevil Sen WISE Lab. Hacettepe University

Upload: others

Post on 27-Jul-2020

2 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

UpDroid: Updated Android Malware and

Its Familial Classification

Kursat Aktas, Assoc. Prof. Sevil Sen

WISE Lab.Hacettepe University

Page 2: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Page 3: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Mobile Security

📫 New mobile variants.

- Android is among the most targeted platforms by attackers.

- Mobile devices are usually protected by static analysis-based solutions. - Vulnerable to new attacks.- Vulnerable to new variants of existing attacks.

Page 4: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Updating

o One of the most effective evasion strategies.

Update attackso Does not contain any malicious code at the

installation phase.o Add its malicious code at runtime.

Page 5: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

UpDroid: Updated Android Malware

Page 6: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Collecting AppsKoodous oRecently submitted applications oNot detected by other analysists oContaining at least on loading activityoCollected 11490 apps

ApkpureoMost popular apps from each categoryoCollected 6299 apps

Page 7: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Analysis of Apps

Each app is run for 15 minutes.DroidBox outputs are collected.

Three filtering mechanism1. loading + data leakage2. loading + malicious network connection3. native code loading signature + data leakage or malicious network connection

Page 8: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Dataset Validationsending potential candidate update attacks to VirusTotal.

oDetected more than 10 Avs.oIts dominant label belonging to an updated attack family.o82.66% of candidates confirmed as updated attacks.o7.1% of all connected samples missed our filtering mechanisms.

Page 9: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

UpDroid Overview

21 malware families, 2479 malware samples

Page 10: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Family Classification

o Mobile malware variants are on the rise.o Commercial AVs are not reliable.

o Minimize the number of samples to be analysed.

o Help to decrease the analysis time.

Page 11: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Static + Dynamic features

Page 12: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Page 13: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Family Classification Results

Page 14: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Static Analysis-Based Approaches

Page 15: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Confusion Matrix for the Last5Y dataset

Page 16: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Conclusion

A new dataset, UpDroid is introduced.

Page 17: UpDroid: Updated Android Malware and Its Familial ...aselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/KursatAktas.pdf · 21 malware families, 2479 malware samples. Family Classification

Acknowledgement

This study is supported by TUBITAK (the project 115E150).

THE SCIENTIFIC AND TECHNOLOGICAL RESEARCH COUNCIL OF TURKEY

Welling Park Wellington Park Apartments 2479 Deer Run ... · Rafael Rocha Maintenance Technician Maria Perez Housekeeper Welling Park Wellington Park Apartments 2479 Deer Run Lewisville,

Catalogue LAN cuivre - Azenn€¦ · Corning Optical Communications Catalog LAN cuivre | LAN-2479-FR | Page 4 Corning Optical Communications Catalog LAN cuivre | LAN-2479-FR | Page

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Metamorphic Malware 1 Metamorphic Malware Research

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

ESMSJ ISSN: 2247 2479 ISSSN L: 2247 2479 Vol IV, Issue 2 2014

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Trafﬁc Exchanges

Intrusion Detection and Malware Analysis - Malware collection

Department of Campus Safety Hall 207 326 2479 …mainemaritime.edu/campus-safety/wp-content/uploads/sites/9/2017/09/campus...207-326-2479 [email protected] Admissions Visitors No

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Highland, Illinois Lodge #2479 - District 9 Loyal Order of Moosefiles.ctctcdn.com/069d9c16201/7789618b-de96-46b0-bc8d... · 2015. 8. 25. · Highland, Illinois Lodge #2479 - District

Malware & Anti-Malware

Fine Wines | Skinner Auction 2479

Highland, Illinois Lodge #2479 - District 9 Loyal …files.ctctcdn.com/069d9c16201/01f45be8-e22f-426e-8e4b-23...Highland, Illinois Lodge #2479 - District 9 Loyal Order of Moose Chartered

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

ESMSJ ISSN: 2247 2479 ISSN L: 2247 2479 Vol VI, Issue 2 2016esmsj.upit.ro/ESMSJ vol 6(2) pentru Denis pe site/ESMSJ vol 6 (2) 20… · 2 ESMSJ ISSN: 2247 – 2479 ISSN – L: 2247

2479 17th Avenue, Carmel

Practical Malware Analysis: Ch 11: Malware Behavior

Reversing malware analysis trainingpart9 advanced malware analysis

ESMSJ ISSN: 2247 – 2479 ISSSN – L: 2247 – 2479 Vol IV ...esmsj.upit.ro/ESMSJ. Vol IV Special number 2-2014 FINAL.pdf · Mladen Čudanov Cătălin Ducu Milica Jovanović Ivana

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

PDFC- · PDF file2479 2479 2479 2479 2479 2479 2479 2479 2479 2415 2365 2365 2365 2365 2365 2365 Mar 31 Apr 7 Apr 14 Apr 21 Apr 28 May 5 May 12 May 19 May 26 S$ pp 480

Geohydrology and Geochemistry Near Coastal Ground-Water ...pubs.usgs.gov/wsp/2479/report.pdfPaper 2479 Prepared in cooperation with the Accomack- Northampton Planning District Commission

Merritt Morning Market 2479-Aug 23

exercicio decreto 2479

Zararlı Yazılım Analizinde Güncel Problemleraselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/EnginKirda.pdf · Actors / APT Advanced Persistent Threats != malware! ... •Makine

TILE TRIMS AND FLOORING PROFILES CODE G/M · PDF filetile trims and flooring profiles code g/m 2009 2009 2009 2009 2009 2009 2009 ... 2479 2479 2479 2479 2479 2479 2479 2479 2479 2479

ISSN 2523-2479 Volumen 1, Número 2 Octubre Diciembre ... · Revista de Pedagogía Crítica Volumen 1, Número 2 – Octubre – Diciembre - 2017 ECORFAN® ISSN 2523-2479

IS 2479 (1981): Colour code for the identification of