Auditing Anti-Malware Tools by Evolving Android Malware and Dynamic Loading Technique

Although a previous paper shows that existing anti-malware tools (AMTs) may have high detection rate, the report is based on existing malware and thus it does not imply that AMTs can effectively deal with future malware. It is desirable to have an alternative way of auditing AMTs. In our previous pa...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on information forensics and security 2017-07, Vol.12 (7), p.1529-1544
Main Authors: Xue, Yinxing, Meng, Guozhu, Liu, Yang, Tan, Tian Huat, Chen, Hongxu, Sun, Jun, Zhang, Jie
Format: Article
Language:English
Subjects:
Android feature model
Androids
Bioinformatics
defense capability
dynamic loading
Dynamic loads
Evolutionary algorithms
Genomics
Humanoid robots
linear programming
Loading
Malware
malware generation
Mobile operating systems
Runtime
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Although a previous paper shows that existing anti-malware tools (AMTs) may have high detection rate, the report is based on existing malware and thus it does not imply that AMTs can effectively deal with future malware. It is desirable to have an alternative way of auditing AMTs. In our previous paper, we use malware samples from android malware collection Genome to summarize a malware meta-model for modularizing the common attack behaviors and evasion techniques in reusable features. We then combine different features with an evolutionary algorithm, in which way we evolve malware for variants. Previous results have shown that the existing AMTs only exhibit detection rate of 20%-30% for 10 000 evolved malware variants. In this paper, based on the modularized attack features, we apply the dynamic code generation and loading techniques to produce malware, so that we can audit the AMTs at runtime. We implement our approach, named Mystique-S, as a service-oriented malware generation system. Mystique-S automatically selects attack features under various user scenarios and delivers the corresponding malicious payloads at runtime. Relying on dynamic code binding (via service) and loading (via reflection) techniques, Mystique-S enables dynamic execution of payloads on user devices at runtime. Experimental results on real-world devices show that existing AMTs are incapable of detecting most of our generated malware. Last, we propose the enhancements for existing AMTs.
ISSN:1556-6013
1556-6021
DOI:10.1109/TIFS.2017.2661723